Their certificate was revoked (by their certificate authority, Actalis, part of the Aruba Group) on July 6. Presumably the CA was pressured to revoke it by the Italian and/or US government, and they will get a new certificate from someone else soon.

There is a hexbear thread here about it; afaict there doesn’t appear to yet be any reporting about it. But in the CRL you can see it was revoked July 6:

$ curl -s http://crl15.actalis.it/Repository/tls-subca-rsa-dv-2025/getLastCRL | openssl crl -noout -text |grep -A 4 02295E6BB25717C4652321F4ED9D2B29
    Serial Number: 02295E6BB25717C4652321F4ED9D2B29
        Revocation Date: Jul  6 13:54:09 2026 GMT
        CRL entry extensions:
            X509v3 CRL Reason Code: 
                Privilege Withdrawn

The reason “Privilege Withdrawn” means it was the CA’s decision rather than their own.

Because certificate revocation has never worked very well, many people can still access it (until their browser fetches the certificate revocation list, or checks OCSP, does some newfangled proprietary other thing i don’t understand…).

But why rewrite programs that existed for decades and have proven their stability and safety? Rewriting them to Rust won’t make them safer, it will just introduce the kind of issues original versions have got fixed long ago.

Of course rewriting them will introduce some new issues, but it will also eliminate classes of bugs from which there are definitely still a great many in old “stable” C code (bugs which are now being discovered and will presumably continue to be discovered at a much faster pace due to LLMs).

The whole project is about abolishing GPL. And Rust is just an excuse.

I don’t think it is just an excuse; I believe that improving security is also a goal… but removing GPL code is clearly also part of their motivation :(

What an absolute shitshow

I’d say the month of June is actually a good time to be breaking and fixing things in a release that is due to come out in (checks notes) October.

see also previous thread in this community on this topic from a month ago

Is this something that websites opt into and add to their own site?

Yes.

reCAPTCHA is google’s “anti-abuse” service which many websites use to prevent slightly increase the cost of operating automated crawlers (which somewhat ironically google operates one of the largest of itself, for their search engine).

Before neural networks could solve CAPTCHAs reliably, spammers were solving them with human labor; solving services like anti-captcha.com (intentionally not a clickable link…) today use a mixture of automated and human solvers.

In the future google is apparently building, solving services will need farms of able-to-run-a-recent-android-release mobile devices with some kind of trusted computing hardware, each one of which they’ll have to use sparingly enough to keep usage of its unique ID under some plausibly-human threshold.

And even if you do have a phone and are willing to identify yourself with it, if it is too old to run a recent enough Android you also will sometimes be denied services for being unable to pass a robots’ “human” test.

🤮

I would guess not, given the other recent news about degoogled Android devices also being unable to pass reCAPTCHA.

Remind me again the last time Canada invaded/attacked another country??

Sure. In the last couple of decades the Canadian Armed Forces have actively participated in the US’s attacks in (at least) Afghanistan, Iraq, Syria, Libya, Nigeria, and Yemen.

They also have troops stationed in many other countries: https://en.wikipedia.org/wiki/List_of_Canadian_military_operations

but why should/would they give up any uranium, especially after the US has just demonstrated that they can’t actually take it from them?

see also https://www.presstv.ir/Detail/2026/05/10/768371/how-iran-uses-nuclear-tech-prevent-metabolic-dosorders-newborns

A Motorola phone soon shipping with GrapheneOS isn’t just a rumor but it doesn’t help with the problem of Google making their very popular robot detection service classify deGoogled Android users as non-human.

some more coverage of this:

• https://www.independent.co.uk/arts-entertainment/tv/news/baftas-gaza-doctors-under-attack-speech-b2973944.html
• https://www.presstv.ir/Detail/2026/05/11/768412/‘We-refuse-to-be-silenced’--Gaza-doctors-documentary-team-denounces-BBC-After-BAFTA-win
• excerpt of the acceptance speech: https://www.youtube.com/watch?v=Vq90Tzwmpxo

Funny that blog calls it a “failed attempt at a backdoor” while neglecting to mention that the grsec post (which it does link to and acknowledges is the source of the story) had been updated months prior to explicitly refute that characterization:

5/22/2020 Update: This kind of update should not have been necessary, but due to irresponsible journalists and the nature of social media, it is important to make some things perfectly clear:

Nowhere did we claim this was anything more than a trivially exploitable vulnerability. It is not a backdoor or an attempted backdoor, the term does not appear elsewhere in this blog at all; any suggestion of the sort was fabricated by irresponsible journalists who did not contact us and do not speak for us.

There is no chance this code would have passed review and be merged. No one can push or force code upstream.

This code is not characteristic of the quality of other code contributed upstream by Huawei. Contrary to baseless assertions from some journalists, this is not Huawei’s first attempt at contributing to the kernel, in fact they’ve been a frequent contributor for some time.

Wasn’t Huawei trying to put a Backdoor into linux?

as far as i know, that has not happened.

what makes you think it did?

fwiw, besides the “Proton’s Free plan now offers up to […] after completing certain tasks.” post earlier, i also just deleted some adverinfonewstainment tutanota spam blogpost ("Chat Control May Finally Be Dead: European Court Rules That Weakening Encryption Is Illegal") from this community.

tutanota is just like protonmail except there is more evidence indicating that they are primarily a honeypot for privacy-seeking rubes (as opposed to protonmail where it is maybe only obvious to people knowledgeable about the history of the privacy industry).

People should be skeptical of anyone selling a service involving cryptography software which has nearly no conceivable purpose except for to protect against the entity delivering the software. Especially if they re-deliver the software to you every time you use it, via a practically-impossible-to-audit channel, and require you to identify yourself before re-receiving it (as almost any browser-based e2ee software which doesn’t require installing any software does, due to the current web architecture).

If you think this kind of perfect-for-targeted-exploitation architecture isn’t regularly used for targeted exploitation… well, you’re mistaken. In the web context specifically, it has been happening since the 90s.

imo this community should not tolerate advertising (or other posts who’s purpose is to encourage using/purchasing) this type of deceptively-marketed service.