Many moons ago, long before generative slop coding, I made research on a file storage company for a project. I was already suspicious by their business page being fronted only by two smiling middle aged men without any trace is software engineering in their credentials. They claimed to have all kinds of certificates and whatnot. And they happily accepted that I made an admin account with a one letter password. Some more poking around and it didn’t get any better.

Incompetence is everywhere. Do not trust that anybody selling services in the cloud have any idea what they are doing.

4

Spaceballs level security

The CRL’s were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.

Lmao I have no words.

“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,”

Yeah, try not to sound too butthurt about being very publically called out. I doubt they could get back in the business even if they wanted to after such disgrace.

I have to assume that they were meant to set the private key based on an array value lookup at index 4 etc. and had a bug in the code that returned the index instead of the value