Hacker News

points by dns_snek 1 day ago | 0 comments

> Plenty of apps run Terminal commands in the background

Most notably agents like Claude Code and Codex? Easy to check if you ask it to run:

    $ curl 'https://dv-g3b-emudhra.we-have-a-problem.com/'

    Your client successfully connected to the site. That's bad!

[–] zahlman 1 day ago

What is the dv-g3b- part supposed to mean? I.e. why was this specific name chosen for the subdomain?

[–] Polizeiposaune 1 day ago

eMudhra generated multiple weak private keys and included their public counterpart in multiple intermediate certificates. You need to check that all the intermediates are rejected.

See the lists in https://bugzilla.mozilla.org/show_bug.cgi?id=2083449; I believe that "dv-g3b-" corresponds to the intermediate CA certificate listed as "EM DV TLS CA - G3B"

DV/OV/EV are "Domain Validated", "Organization Validated" and "Extended Validation" which refer to different levels of checking that the CA should done before issuing a certificate with a particular name in it.

[–] consonaut 1 day ago

DV is probably "Domain validated" describing the type of cert and g3b is the specific root cert the chain starts from.