Comic strip for 2026-11-02
Comic strip for 2026-11-02
A comment:
3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?
Yes. It is a new world out there.
Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.
The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here - Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.
This one is from 1809, written by Napoleon’s nephew.
Watching discussions happening online, I see a frequent unfortunate tic I’ll call the Expert Asterisk. A beginner is asking for help, and experts are answering. Then in the spirit of completeness, an expert throws in a fact or detail far from the learner’s abilities or needs.
As an example, here was an interaction about git: a new learner was having
trouble getting properly oriented. They were asking how branches relate to
directories, and how to undo a change. They knew about git init but
didn’t know how it related to changing projects.
newb: so every time I change project I simply do ‘git init’ on them?
expert1: ‘git init’ is for creating a new project.
expert2: you change your working directory, typically, when you change project
So far so good, but then:
expert2: or you specify the git repo directory with the -C switch, but it’s more typing to do, so hardly anyone does that unless there’s a very good reason
What!? Why mention this while explicitly pointing out no one does it? The newb just barely understands how git works at all. Why introduce obscure command-line options that “hardly anyone” uses?
I call this an asterisk because it feels like an esoteric footnote that only experts, academics, or completionists would need to know.
The expert is trying to be helpful. They are presenting all the options in the optimistic hope that the newb will be able to pick and choose among them.
Worse, sometimes multiple experts each offer their own asterisks, and the poor newb is intrigued and distracted by each one. The new learner doesn’t have a way to sift out which details might be important to them. Their original question gets lost in the spreading tangents.
It’s hard to help new learners: we can’t know where their gaps are. What misconceptions need to be unwound? Often we have only a glimpse of their context. Experts can miss when they use words slightly wrong, taking them at face value instead of seeing the misunderstanding that leads down the wrong path.
Notice in the exchange above, “change project” could mean switching among existing projects or starting a new project. We’re not sure which they meant. An expert will cycle among a number of active projects, but beginners will work on one until it is done, then switch to a new project, never returning to the previous one. Perhaps “every time I change project I do ‘git init’” was right for their situation.
The -C comment didn’t derail the session, but the effort of that
comment could have instead been used to clarify the newb’s need.
I understand why experts add these asterisks to help sessions: they are useful for some people even if not for this beginner, and experts are interested (even fascinated) by all the intricate details. These discussion areas are not strictly for newb-help. They’re for general discussion among many people. There’s no rule against talking about advanced or rare options.
And it’s hard to know what will be useful, or what the newb really means, or what will resonate with them to help them find a solution. It’s all difficult.
But you should at least recognize who you are addressing and whether you are helping them. If you want to help the beginner, try to resist the impulse to add little-traveled tangents. Focus on the question at hand and try hard to understand the newb’s situation and mindset. Speak their language so they can hear you.