It’s not every day that a security researcher acquires the ability to generate counterfeit HTTPS certificates, track email activity, and execute code of his choice on thousands of servers—all in a single blow that cost only $20 and a few minutes to lan...

Dan Goodin

It’s not every day that a security researcher acquires the ability to generate counterfeit HTTPS certificates, track email activity, and execute code of his choice on thousands of servers—all in a single blow that cost only $20 and a few minutes to land. But that’s exactly what happened recently to Benjamin Harris.

https://arstechnica.com/security/2024/09/rogue-whois-server-gives-researcher-superpowers-no-one-should-ever-have/

Mick 🇨🇦

@dangoodin WHOIS is a dumpster fire and the ‘net can’t be rid of it soon enough.

This domain has not been listed as the authoritative WHOIS source for the .MOBI registry since at least 2016.

The fact that any CA is willing to use this domain as a source of authoritative information for domains in .MOBI points to the fact that the CA industry is also a dumpster fire.