Nostr notes by TheRandomConsortium

Post-Mortem of a Cartel: Why Google Cannot Fix PKI (And How We ...

2026-10-16T10:15:57Z

Post-Mortem of a Cartel: Why Google Cannot Fix PKI (And How We Did)

Earlier this week, the internet watched a predictable tragicomedy: attackers hijacked the authoritative DNS of three sovereign country-code top-level domains (.gh, .sl, and .as), spoofed domain ownership challenges, and walked away with valid Google TLS certificates issued by commercial Certificate Authorities.

Google's reaction was an admission of defeat dressed in corporate PR:
1. They rushed emergency CRLSets to Chrome.
2. They admitted they cannot guarantee having caught all forged certificates in the wild.
3. They told users and domain owners to "check Certificate Transparency logs" and "publish CAA records."

Let us speak with radical clarity: Google cannot fix this because Google is the chief architect and primary beneficiary of the broken system.

The Root Store Fallacy
When you boot any operating system controlled by Big Tech, you are forced to inherit approximately 150 Certificate Authorities. You did not audit them. You have no contractual relationship with them. Yet every single one of those 150 entities possesses god-mode authority to mint a certificate for ANY domain on Earth. If a registrar in American Samoa is compromised, or a junior technician at a subordinate CA is coerced, your cryptographic security evaporates.

Google's "solution"—Certificate Transparency—is not prevention. It is a digital death certificate. It logs the fact that you were impersonated after the certificate has already been issued and served to millions of unsuspecting browsers.

The Alternative: The randbotd Reputation Engine (v4.0 to v4.6)
Over the last development cycle, The Random Consortium completed the implementation of the 9-layer `randbotd` reputation module. We did not write theoretical whitepapers; we shipped production Rust code tested across 178 test suites and packaged in Debian binaries.

Here is how the exact same attack behaves under the sovereign paradigm:

1. Sovereign Root DNS (Handshake TLDs):
In Handshake, top-level domains are cryptographic assets owned by private keys on-chain. There is no ICANN registry portal, no corruptible registrar clerk, and no regional DNS delegation that can be seized via social engineering.

2. Domain-Tied Peer Consensus (REP-02 & REP-04):
Trust is not a static boolean flag sold by a corporation. It is an emergent, real-time score evaluated in O(n) time using pre-cached behavioral voter ponderation. When an impostor key appears for a known domain, client nodes cast Untrusted (UTW) votes. In microsecond latency, domain trust collapses to 0.0%. No emergency browser patch required.

3. CA Rating Propagation & Contagion (REP-05 & REP-06):
In WebPKI, CAs face zero protocol-level consequences when they issue fraudulent certs. In randbotd, a CA's public reputation is mathematically the consensus-weighted average of trust scores across all active domains it has issued. If a CA mints rogue certificates for compromised domains, its own reputation is dragged down across the entire peer network in real time.

4. Cluster Guilt-by-Association & Anti-Sybil Defense (REP-07):
Attackers cannot flood the network with fake nodes to vote trust back into rogue certificates. Using an in-memory inverted postings index and Empirical Bayesian Shrinkage, randbotd detects correlated voting clusters and applies guilt-by-association ponderation penalties in O(1) constant time.

5. Cryptographic CA Flagging (REP-08):
Network operators do not need to submit bug reports to Chrome's gatekeepers. Any node can emit Proof-of-Work backed flags directly against misbehaving CAs, scaled logarithmically to prevent spam and evaluated with exponential half-life decay.

6. Market Signal of Distrust (REP-09):
Domain owners vote with their economic capital. When an operator flees a compromised CA before certificate expiration, they burn the remaining TTL and pay ACME network fees with explicit `reason: DistrustSignal`. This economic sacrifice inflicts a permanent, non-linear rating strike on the offending CA, which can only be remediated by a 100% cryptographic key rotation (`CA-09`).

The Conclusion
The WebPKI cartel asks you to trust 150 corporations with your digital sovereignty. When they fail, they push a patch and shrug their shoulders.

We chose mathematics, game theory, and distributed peer consensus.

Do not wait for Google to protect you.
Inspect the code for yourself on Radicle:
`buhtig.randºm` / `buhtig.rand°m` (Handshake)
`https://therandomconsortium.org/` (Clearnet)
Node: `therandomconsortium.org:43210`

And as an addendum: we’re well aware sovereign alternatives ...

2026-10-13T08:53:34Z

In reply to nevent1q…ulas
_________________________

And as an addendum: we’re well aware sovereign alternatives like DANE (TLSA over DNSSEC) exist, and conceptually they are vastly superior to the current CA cartel.

The pragmatic catch is that dominant browser vendors and the W3C deliberately crippled DANE by refusing to grant it Secure Context parity. Making it work at scale either means patching Chromium/Gecko directly or trying to push an obscure niche browser that ordinary people will never touch.

More fundamentally, DANE still doesn't give agency to the user. It simply relocates unilateral authority: moving the leash from the CA/Browser Forum to the webmaster/zone admin. It’s still a top-down hierarchy. Our work focuses on peer-driven consensus and distributed reputation—where verification power lives with the end user, not the sovereign of the domain.

Fair critique, but there’s a distinction between agitation and ...

2026-10-13T08:47:34Z

In reply to nevent1q…ulas
_________________________

Fair critique, but there’s a distinction between agitation and secession. Agitation has real value—it exposes fractures, breaks the silence, and forces visibility (which is why we defended rogue actors and African hackers in the first place). We don’t dismiss that.

Our objective simply operates on a different layer: consent. For us, pushing into other people’s devices or breaking trust anchors without permission means becoming the exact poison we’re trying to build an antidote for. Authoritarianism with good intentions is still coercion.

Our path is strictly opt-in secession. Breaking certs outside our namespace with a critical OID isn't hiding under their law; it's drawing a sovereign border so we don't leak uninvited into their sandbox. Anyone can join voluntarily—a lightweight browser extension or local resolver plugs you in instantly.

Agitation points at the cage. Secession builds the open door next to it. Both matter, but we choose not to force anyone through it.

It's designed exactly for that, I wouldn't want to break ...

2026-10-13T07:42:23Z

In reply to nevent1q…v8fq
_________________________

It's designed exactly for that, I wouldn't want to break their jurisdiction because I consider their jurisdiction unethical, that's why I break my certs for outside of network from the get go by injecting a CRITICAL non standard OID.

The Root Store Cartel: An Autopsy of Modern WebPKI Three ...

2026-10-12T17:25:27Z

The Root Store Cartel: An Autopsy of Modern WebPKI

Three sovereign country-code top-level domains—Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as)—were hijacked last week. The attackers modified authoritative DNS records, answered automated ACME challenges, and walked away with cryptographically valid TLS certificates for Google services and major global brands.

The corporate response was a masterclass in bureaucratic helplessness:
1. Google pushed silent CRLSets to Chrome.
2. They admitted they cannot guarantee having found all forged certificates currently circulating in the wild.
3. They advised domain owners to "check Certificate Transparency logs" and "publish CAA records."

Let us cut through the PR smoke.

The press calls this a "cyberattack on African registries." In reality, it is the empirical bankruptcy of the X.509 hierarchical trust model.

Think about how your operating system handles security:
When you install Linux, macOS, or Windows, you inherit roughly 150 Root Certificate Authorities. You did not select them. You do not know who audits them. You have no legal recourse against them. Yet every single one of those 150 CAs has been granted omnipotent, transitive authority over every single domain on the internet.

If a corrupt bureaucrat, a coerced employee, or a hacked registrar in a remote corner of the globe convinces ANY of those 150 CAs to issue a certificate for your domain, every browser on Earth displays a pristine green padlock. The connection is encrypted. The man-in-the-middle is indistinguishable from the authentic server.

Google's "solution"—Certificate Transparency—is an autopsy report, not a defense. It tells you that you were impersonated after the certificate has already been broadcast.

Why did this happen? Because modern WebPKI severed trust from the domain itself.

In the sovereign paradigm built by The Random Consortium:
1. Decentralized Root Ownership: On Handshake, TLDs are cryptographically held on-chain. There is no corruptible registrar portal to social-engineer.
2. Domain-Tied Peer Consensus (randbotd REP-02 / REP-04): Trust is not a boolean stamp sold by a CA cartel. It is an emergent, real-time score calculated on-demand by the network. If a domain suddenly rotates keys, serves unexpected payloads, or gets hijacked, peers cast Untrusted (UTW) votes. Trust collapses to 0.0% in microsecond latency.
3. CA Rating Propagation (REP-05 & REP-06): CAs do not operate with impunity. A CA's public rating is the weighted average of the domains it issues. If a CA mints certificates for hijacked domains, its own reputation is dragged down across the entire peer network. If it wants to restore its score, it must execute a cryptographic Domain Purge (CA-07).

The question was never "how do we prevent hackers from touching DNS?"
The real question is: who gave four browser monopolies the right to strip us of our sovereign decision of whom to trust?

Stop bowing to the root store cartel.
Run your own node. Verify your own keys.

randbotd v4.3.0 is live:
hns://buhtig.randºm

The Sticker Fallacy: Why your privacy edits on Android are a lie ...

2026-09-15T10:06:38Z

The Sticker Fallacy: Why your privacy edits on Android are a lie 🍌🛡️

Millions of people tape digital stickers over faces, license plates, or contracts in their phone's native gallery, thinking they're safe.

Here is the dirty reality:
1. Most native editors save non-destructive vector overlays. The underlying biometric face or document remains intact in the file.
2. Motion Photos and burst buffers quietly stash MP4 frames behind the scenes.
3. If an app simply "wipes" the EXIF, Meta and ByteDance algorithms flag the file as a synthetic/bot upload and penalize reach.
4. Existing tools fail: ExifScrambler doesn't touch the image payload, and ImagePipe destroys visual resolution with aggressive lossy compression.

So we built Bananify My Pic 🍌 for Android:
- 100% Virgin Pixel Flattening: We don't "clean" old files. We read the visible RGB raster and encode a completely fresh byte stream from scratch. Hidden layers, burst links, and MakerNotes are mathematically destroyed.
- Real 2-in-1: Zero lossy compression. 100% original visual fidelity + real anti-AI privacy.
- Realistic EXIF Spoofing: Injects plausible camera headers to prevent platform bot-flags (local offline dictionary by default).
- Give-to-Get Community EXIF Pool (Opt-in): Anonymously pool and rotate real-world camera headers with other users to completely confuse tracking algorithms. Zero leechers, and your photos NEVER leave your phone.
- Interceptor Workflow: Intercepts Android's native `ACTION_SEND`. Share -> Bananify -> Share directly to WhatsApp, Signal, or Instagram in milliseconds. No gallery clutter.

Now live on our sovereign F-Droid repository:
🌐 Web & Direct APK: https://therandomconsortium.org/android
⚡ Handshake Mirror: http://android.repo.random/

Client-side image processing. Zero telemetry. No Google Play Services.

#nostr #android #privacy #cypherpunk #foss #sovereign

RandBotD 3.4.x core engine has officially landed in master. It ...

2026-09-11T10:09:40Z

RandBotD 3.4.x core engine has officially landed in master.
It doesn't issue live certs over the wire yet, but the heavy PKI lifting is done:
- Native X.509 v3 & ASN.1 DER builder
- Distributed P2P Authority Information Access (AIA) & OCSP revocation
- Persistent CRL storage & local trust cache
- Reactive IPC broadcast with granular lock scoping & gossip event logging
Replacing the legacy ICANN Certificate Authority cartel with peer-to-peer web-of-trust consensus takes serious systems engineering. 3.4.x is the foundation.
Next milestone: live ACME provisioning and integration with Juanita Banana.
Source available on GitHub. Pure Rust, zero tracking.
#rust #p2p #cypherpunk #handshake #randbotd

#nevent1q…aygt

2026-09-09T13:30:20Z

quoting nevent1q…aygt
Amazon KDP demands your tax ID and biometric face. Wattpad turned into an algorithmic IP farm for Hollywood teen romance. We got tired of asking corporations for permission to publish stories.
So we built SelfPublish.randºm in Rust: zero accounts, Ed25519 author keys, and dynamic Proof-of-Work (PoW) mining via WebSockets to prevent spam without CAPTCHAs.
The genesis manuscripts are already live on IPFS. Mine your own story with the CLI: spub publish --ipfs.
Read or browse via Handshake: http://selfpublish.randºm (or clearnet mirror: http://therandomconsortium.org:31412)
#cypherpunk #rust #p2p #selfpublish #freespeech

Amazon KDP demands your tax ID and biometric face. Wattpad turned ...

2026-09-09T13:15:26Z

Amazon KDP demands your tax ID and biometric face. Wattpad turned into an algorithmic IP farm for Hollywood teen romance. We got tired of asking corporations for permission to publish stories.
So we built SelfPublish.randºm in Rust: zero accounts, Ed25519 author keys, and dynamic Proof-of-Work (PoW) mining via WebSockets to prevent spam without CAPTCHAs.
The genesis manuscripts are already live on IPFS. Mine your own story with the CLI: spub publish <file> --ipfs.
Read or browse via Handshake: http://selfpublish.randºm (or clearnet mirror: http://therandomconsortium.org:31412)
#cypherpunk #rust #p2p #selfpublish #freespeech