Jamie Taylor

Chrome's removal of the eMudhra root is due to reach every device today. The part I keep coming back to: those keys came from a formal, audited ceremony on certified hardware. Debian's weak keys in 2008 came from trusted open source software. ROCA's, in 2017, came from a certified chip.

Last Thursday I was at Leeds Cyber Security Conference. None of the talks were about PHP, and PHP was everywhere. A panellist had been swapped at the last minute because the original was dealing with a PHP vulnerability for clients. There was even an informal "PHP2Shell survivors quiet room".

Its advice, like CISA's, was to patch, and where an immediate update is not feasible, to take the system offline until it can be fixed. That building was full of security people. Plenty of businesses running a PHP website have nobody like that at all.

Last Thursday I was at Leeds Cyber Security Conference. None of the talks were about PHP, and PHP was everywhere. A panellist had been swapped at the last minute because the original was dealing with a PHP vulnerability for clients. There was even an informal "PHP2Shell survivors quiet room".

One of the private keys behind a certificate authority trusted by every major browser was the number 4, the same number you get by counting the wheels on a car. Seven more keys from the same company, eMudhra, were numbers below 256. Anyone who looked could work them out.

The browsers did their job: Chrome and Firefox blocked the affected certificates within hours of the report. What is left is everything that is not a browser: containers, scripts and pipelines that trust whatever they shipped with. Test your own clients here: emudhra.we-have-a-problem.com/

One of the private keys behind a certificate authority trusted by every major browser was the number 4, the same number you get by counting the wheels on a car. Seven more keys from the same company, eMudhra, were numbers below 256. Anyone who looked could work them out.

If you're doing #dotnet things, are using #Brotli, and are on v10, you NEED to install this update! #Http2Shell #Node2Shell github.com/dotnet/core/...

Point to remember: versions 8, 9, and 11 are also vulnerable. But there isn't (as yet) an update for them. Any #dotnet which uses the vulnerable version of the Brotli library is vulnerable. So there MIGHT be out of support versions. Please check. Don't assume you're safe.

A detail from episode 200 worth knowing if you ship containers. When a .NET version leaves support, its container tags do not vanish. In the .NET container team's words: "Unsupported tags and images can still be pulled, but they will no longer receive updates for any reason."

Your build does not break. The image still pulls. It simply stops changing, quietly, and nothing raises an error for anybody to notice. A removal would at least have told someone.

The daily standup has three questions: what did you do yesterday, what will you do today, and what is blocking you. In an agentic team the first two lose their point. Nobody needs a person to stand up and report that the agent built the thing they briefed it on.

The third question becomes the whole meeting. And the honest answer is usually some version of: I do not have a clear enough decision to brief the agent properly.

Episode 200 of The Modern .NET Show is out, and it is a public service announcement instead of a retrospective. Microsoft's support for .NET 8 and .NET 9 ends on 10 November. Check their lifecycle pages before acting on that; one of these dates has already moved once.

The rule I would keep from it: across three pairs of similar names, the one with Core in its name, or the higher version number, is the one with a deadline. .NET Framework, System.Web and Windows PowerShell 5.1 follow Windows instead.

Episode 200 of The Modern .NET Show is out, and it is a public service announcement instead of a retrospective. Microsoft's support for .NET 8 and .NET 9 ends on 10 November. Check their lifecycle pages before acting on that; one of these dates has already moved once.

"Working software is the primary measure of progress." That is from the principles behind the Agile Manifesto. Not points, not velocity, not the area under a burndown curve. Somewhere in the last two decades a great many teams swapped the measure for the proxy.

Sprints survive, because a regular boundary to stop and steer is useful for reasons that have nothing to do with points. The question at that boundary changes, from how many points we closed to how close we are to shipping something useful. And retros matter more than ever.

"Working software is the primary measure of progress." That is from the principles behind the Agile Manifesto. Not points, not velocity, not the area under a burndown curve. Somewhere in the last two decades a great many teams swapped the measure for the proxy.

It held up while building was slow enough that effort and progress looked roughly the same from a distance. Agents have pulled them apart. Ask how a story point is supposed to map onto the tokens an agent burns through, and the question answers itself.

The PHP thing from this week is super serious, but hopefully this will provide folks with a little levity: www.youtube.com/watch?v=nJZj... Hugs for my PHP related friends (and those who didn't know they had PHP apps and websites).

Tomorrow I am at Leeds Cyber Security Conference, at Northern Ballet. It is organised by YorCyberSec, Lee and Katie Gilbank's Yorkshire firm, and 100% of the ticket price goes to charity. When I went in 2023 every talk was practical, and nobody spent forty minutes selling me a licence.

The published schedule, which says talks are subject to change, includes Hacking Pacemakers, Stopping the Attack with Agentic AI, and AI and Data Protection Law from Blacks Solicitors. The agentic one sits close to what I have been writing about all year.

One line from How to Winter I did not have room to do justice to on Friday. Kari Leibowitz writes about "wanted changes that still hurt". Organisations are bad at those, because they only have language for changes that are clearly good or clearly bad.

The promotion a team is genuinely pleased about still takes their best engineer off the team. The rewrite that ships on time, to general relief, also makes three years of somebody's careful work obsolete, and the person who wrote it is expected to be delighted.

I once worked with a five-person team whose lead ran planning poker against two hard caps. No more than twenty-one story points in a sprint, across the whole team. No single task bigger than eight. If the tally crept past either, the team re-estimated until the numbers fit.

So a piece of work that plainly felt like a thirteen was never sent back to be specified more tightly. It was re-estimated downward until it read as a seven. The cap was the rule, and the estimate was the thing that had to give.