The thread is in the body of the tweet. Here is the start: https://twitter.com/axi0mX/status/1313620262768635904

They decided to skip a year for some rooms to allow other interesting topics to have a room.

https://twitter.com/fosdem/status/915543798763139074

Sure, LetsEncrypt can issue certificates for that domain. If you have a webserver you control that runs on port 80, you can use Certbot[1] to get a certificate for that domain. [1]: https://certbot.eff.org/

> If the cookie is set through HTTPS, the browser won't send it when loading HTTP resources.

If the cookie is set through HTTPS and does not have the Secure flag set, the browser will happily send it along when loading HTTP resources.

It seems it is fixed now,.

    $2,506
    last 24 hrs ($104.41 / hr)

Seems somewhat more reasonable

If you read the article, you would know that it is a terminal emulator written in javascript that gives you access to the computer the webserver runs on.

There is no change to the browser itself at all, just plain javascript that shows a terminal running on a remote computer.

> In the case of md5, creating a pair of inputs with the same hash is easier than creating another input with the same hash as something else which you didn't yourself generate.

This is the case with all instances of seeking a collision, due to the birthday paradox [0]

0: https://en.wikipedia.org/wiki/Birthday_attack

The birthday paradox helps with the case of finding any two random inputs that have the same hash. The problem with MD5 is that it's feasible to craft two specific inputs that happen to have the same hash.

You do not ask for an extension of an SSL certificate, but you get a new one signed with another expiry date.

I think it is theoretically possible to change the expiration date, and ask a certification authority to sign that new certificate, but I have never heard of that happening anyways.

It might be a good idea to delete this thread since this bug is in the openssl client, which is not as widely used as the library.

The site cannot detect that you have an extra root certificate lying around on your computer. If you visit the website without the Superfish program installed, you just evaluate the SSL settings of your browser.