ICT Teacher, Digital Senior Citizen, Programming, Open Source Software, Linux, DSLR Photography and person in real life! Now into playing Bass Guitar
Cariboo Hill Secondary School
Joined September 2009
- Tweets12.9K
- Following915
- Followers626
- Likes35K
Darren Yung - @[email protected] retweeted
I propose we move from:
“You’re not a true Christian if you vote for ________.”
To:
“You’re not a true Christian if you don’t follow the Sermon on the Mount.”
It’s time we measured Christian faithfulness not by political allegiance but by allegiance to Jesus & his teachings.
Darren Yung - @[email protected] retweeted
Happy Pythagorean Theorem Day!
10/24/26
10² + 24² = 26²
This is the last one we’ll experience in our lifetime.
This brings back childhood memories for me!!!
The good old days of CGA.
Alley Cat (1984 by Synapse Software) feels exactly like some programmer had a wild late-night coding session on too much coffee (or whatever they had back then) and just let the surreal vibes flow.
That limited 4-color palette (black, cyan, magenta, white) turns the whole thing into a piece of art... well, it's an acquired taste, I suppose. Add to that the squeaky PC speaker sound and you got yourself a game!
You're Freddy the alley cat, jumping bins, dodging dogs, climbing fences, then breaking into people's apartments to knock over vases, eat fish, and court Felicia while Cupid shoots arrows at you.
We've come a long way.
Summary of the craziness! This is going to give me lots to talk about with my Cyber students. YIKES!
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Darren Yung - @[email protected] retweeted
The Internet goes on high alert after discovery of 8 compromised TLS certs arstechnica.com/security/202…
Darren Yung - @[email protected] retweeted
I was born/raised in BC and have never witnessed this amount of racism, bigotry, and hatred for fellow BCers until the Con parties across Canada climbed aboard the maga train. I can feel it outside of social media because it's now permeated in society. It's disgusting.
#VoteBCNDP
Darren Yung - @[email protected] retweeted
BC conservative candidate Jordan McIntosh was dropped after his X account called “DeathNight771” was discovered by @bcndp candidate @callistaryan. McIntosh was caught praising Hitler and posted the N-word more than 40 times in the last year. #bcpoli #cdnpoli
One post by the BC conservative said Hitler “may have not intended death” during the Holocaust, and “lots of Jews died” not because Hitler “hated them specifically” but because there were so many. The account posted or reposted the N-word more than 40 times in the last year. #bcpoli #cdnpoli
Darren Yung - @[email protected] retweeted
Occupy Democrats
2͏h͏ ·
BREAKING: PANIC! Trump is DESPERATELY trying to stop Jack Smith from testifying in his own $10 billion lawsuit against the BBC.
Donald Trump sued the BBC for defamation, asking for a whopping $10 billion in damages. Now, he’s panicking about the one witness who might actually know something about the behavior that led the British broadcaster to publish what it did.
According to The New Republic, the BBC subpoenaed former special counsel Jack Smith to testify as part of its defense against Trump’s defamation suit. The suit claims the network defamed him with deceptive editing in a 2024 documentary about the January 6 Capitol attack.
Trump’s lawyers filed a motion Friday to block the deposition, arguing that “Smith lacks any personal knowledge regarding the issues in this matter.”
Their reasoning: Smith wasn’t at the January 6 speech, didn’t help prepare it, and can’t know what Trump was thinking. They say anything he gathered was “secondhand knowledge” from materials collected from other sources.
The BBC’s lawyers weren’t impressed. They wrote that “none of [Trump]’s arguments for blocking the deposition of Mr. Smith can withstand scrutiny.” They noted that Smith himself doesn’t object to testifying, and that Trump still has to prove he “did not foment or incite the January 6 Capitol riot,” which he claims the documentary falsely implied.
Then came the line that says it all: “No one forced Plaintiff to file this lawsuit and to dispute that his speech on January 6 incited the violence that followed at the Capitol. But as long as he chooses to maintain the case, he cannot commit the fundamental injustice of preventing the BBC from obtaining the evidence it needs to robustly defend itself.”
This isn’t Trump’s only dodge. His attorneys are also fighting efforts to make Trump himself testify, to subpoena his children, and to look into his finances. Trump sued over what the BBC said about January 6, and now he’s fighting every attempt to examine what actually happened.
There’s another problem for him. The BBC is funded by British taxpayers, so Trump can’t bully it into a hefty settlement or force it to back off its coverage the way he has with some American media companies.
So now he has two choices: drop the case, or actually try to prove his point and live with the consequences.
If Trump really believes he did nothing wrong on January 6, a deposition should be no problem. His lawyers’ desperation suggests otherwise.
Please like and share if you can’t wait to hear what Jack Smith has to say if the BBC successfully gets him to testify!
Darren Yung - @[email protected] retweeted
There is a major incident this evening involving a fire at CFB Wainwright in Alberta. The BC Government has reached out to Alberta to offer all possible assistance. Please hold Canadian Armed Forces members, their families and the emergency crews in your hearts tonight.
Upcoming Remembrance Day in a few weeks is going to hit hard. :(
somewhere in Canada tonight, a family is sitting by the phone. They're waiting for news from CFB Wainwright. They're waiting to hear a voice they've heard a thousand times, saying "I'm okay."
Some of those calls won't come.
We don't talk enough about what our service members and their families carry. They miss birthdays and holidays and bedtimes, all to keep the rest of us safe, often without us ever knowing their names.
Tonight, hold your people a little closer.
To the families of those lost and injured: a whole country is with you. 🇨🇦🕯️
Darren Yung - @[email protected] retweeted
The military base hospital is full.
The local hospital is completely full.
The schools are now full as well.
When I told you 150 +people were affected
I think that might have been low unfortunately.
It started with a code orange where I live.
In the wainwright hospital.
And then all hell broke loose.
We need your prayers now more than ever.
These numbers are gonna shock you!
Darren Yung - @[email protected] retweeted
We are not spending your money. That’s not how a trade deficit works.
Trump: I do not want to lose $90 billion for the privilege of allowing Canada to have a healthcare system and other things that they shouldn't have. They spend our money!
Readers added context they thought people might want to know
The statement in the video misstates the US-Canada trade deficit as a $90B loss subsidizing healthcare; the goods and services deficit was $27B in 2025 and stems mainly from US purchases of Canadian oil while Canada's system is funded by its own taxes.
usafacts.org/articles/us-ca…
canada.ca/en/health-cana…
realeconomy.rsmus.com/market-minute-…
ustr.gov/countries-regi…
Darren Yung - @[email protected] retweeted
Latest: Zelenskyy tells reporters over WhatsApp that restrictions on Ukraine's Starlink systems remain. Interceptor drones can't function, logistics and operations hobbled. The maximum speed is 161 kph; "exceeding this limit causes the Starlink connection to cut out completely, resulting in the loss of the drone."
He says Ukraine has done tests to determine whether SpaceX is truly facing technical issues, as has been told Kyiv by the US side, or if this is a "deliberate operation... to restrict us, cut us off, and prevent us from defending ourselves and protecting our people, both at the front and among the civilian population."
He says Ukraine "sent a couple of vehicles equipped with Starlink terminals into European Union territory."
"They moved at speeds exceeding 180kph, and the Starlink systems worked perfectly. We have the relevant logs and evidence to prove this."
He adds: "The conclusion is clear: the restrictions are in effect within Ukraine but do not apply within the European Union. In other words, this is a planned operation."
Darren Yung - @[email protected] retweeted
If this does turn out to be true, then the claimed “free-speech absolutist” @elonmusk is supporting a Russian invasion. In Russia there is no free speech, there are only prisons for those who tell the truth.
New speed limits on Starlink terminals, operated by billionaire Elon Musk’s SpaceX, disrupted drone attacks over Russian-occupied Ukraine, Ukrainian officials and military units said on.wsj.com/4hVZKz1
Darren Yung - @[email protected] retweeted
🚨 BREAKTHROUGH: Two Canadian Scientists Develop an Inhaled Vaccine Mist That Delivers Immunity Directly to the Lungs, Right Where Viruses Enter
Two scientists, Fiona Smaill and Zhou Xing, developed AeroVax, an inhaled vaccine mist designed to reach the lungs in just 2 minutes.
Darren Yung - @[email protected] retweeted
Huge drop in Google searches for various health disinformation topics following the Ukrainian strikes on Russian data centers.
It makes you wonder how much of the “turbo cancer, ivermectin” nonsense is really fueled by Russian bots, & how many Americans they’ve killed…
Darren Yung - @[email protected] retweeted
What these last couple of days have taught us:
MAGA —> boosted by Russian bots
Anti-Ukraine —> Russian bots
Christian Nationalism —> Russian bots
Anti-vax —> Russian bots
Alberta Separatism —> Russian bots
Brexit —> Russian bots
So why is Russia spending billions each year to promote these groups?
I have the original WC3 box set and disks!!! I might need to get this new one.
30th Anniversary of Wing Commander 3 is in the works. It'll contain the non-compressed original footage for the FMVs, EA still had the original tapes it was shot on. Everything has been cleaned up to modernize the game. Wow. I'm sorry excited. @ShamashAran thought you might want to hear about this too.
