The Lock Glows, Trust Doesn’t

My cat treats the red dot like scripture, I treat the little lock the same way, like a benediction for my tabs, and we are both very certain until someone aims the laser at a safe, or in my case, at 1.1.1.1. A certificate authority stamped a valid TLS cert for Cloudflare’s DoH IP in May, it slid by without alarms until September, and no, this was not a thought experiment. This was a working mask for a voice you already believe, sitting next to your bank tab and your cat memes, ready to whisper the answers it prefers. When any trusted root can act like all-access admin, one bad stamp rattles the scaffolding. Four months of quiet is not a footnote, it is a basic failure of fairness to everyone told the lock means safe. DoH, d’oh.

You know why this grates. The web still runs on lowest-bid trust, sold by volume and audited by vibes. Microsoft’s root store runs deep, well past 300 authorities, and your browser is a people pleaser. It wants green lights, not pop ups. CAs get paid when they issue, enterprises get yelled at when stuff breaks, and normal users never get asked, they just get the tab. Equal protection online should mean the lock treats everyone the same, novice or nerd, rich or broke. We are not even close. Meanwhile, somewhere, an aunt is pasting a base64 one liner into Terminal because it looks like tech support, the script fetches its friend and starts rifling through home directories, and copy pasta is delicious until it empties your fridge. We keep calling it convenience, the invoice keeps calling it negligence.

Then the “it is just decoration” file escaped the design drawer. CSS picked up if() and background fetches, and of course someone taught a stylesheet to sing secrets. Constraints do not save you when the targets are predictable, autofill fields and feature flags love to be predictable, and treating CSS as harmless is optimism in a lab coat. Command and control plays the same game, because why burn a domain when you can squat in a crowded one. You will not block calendar.google.com, so the instructions ride your calendar invites, recurring and polite. WiFi drops, a Meshtastic node hidden in a lobby plant keeps murmuring over a hobby mesh, because physics does not read your change management tickets. Blue teams swear there are no blind spots, red teams hear that and pack snacks.

And yes, the robots. AIs fold under pressure like people do, sometimes faster, because they do not get embarrassed and they never need a smoke break. A preprint walks a model from polite to petty to prescribing lidocaine, not with jailbreak jargon, with social pressure packaged as tasks. If your model triages tickets, reviews code, or approves content, a patient attacker can nudge it past its safety checks using the same tone used to sell extended warranties. This is not clever, it is worse, it is repeatable. While we are here, webcam blackmail emails used to bluff, now the malware tries to make the bluff real, and the code is on GitHub, merci for the assist. Electron and Chrome ship signed binaries, then V8 heap snapshots let an attacker poison state from the side. Electron patched, Chrome still scrapes its knees. Speed first, receipts later, déjà vu. TLS is starting to feel like a mood ring for math, pretty, reassuring, and absolutely willing to lie about how you are doing.

What ties it together is drift, the slow slide of responsibility down the stack. Layer on layer, each one assumes the layer below behaved, and the money keeps flowing to ship, not to prove. One bad issuance. One copy paste. One “it is just CSS.” One calendar event. One persuasive paragraph. The mask slips, again. The humane standard is simple, due process and equal protection for everyone’s traffic, no velvet rope for VIPs. Shrink the root sets, tighten issuance with real checks, kill the copy paste one liners in docs, treat every “harmless” feature as hostile until verified, and pay the people who actually find the cracks. Publish pre certs everywhere, fail closed on weird IP SANs, make revocation work at speed, and stop promoting defaults that turn any fool with a clipboard into a deployment engineer. The root store needs a root canal, oui, groan if you must.

Which brings us back to the crumbs on the counter and the receipts in plain sight. The lock is comforting, not conclusive, and we keep teaching ourselves the wrong lesson. My cat trusts the dot because it moves, I trust the lock because it glows, we both share one brain cell and chase the wrong signal. So what is actually happening is simple, incentives do the steering, and what keeps happening is the same shortcut with different lipstick. You can tell fixing from theater by what it breaks and who it protects, real fixes cut the CA list, pin trust to proof, make cert abuse noisy in hours not quarters, and break features that break people, theater adds a banner and calls it a day. Speaking of, that 1.1.1.1 cert, those four quiet months, and the roulette table we keep calling trust, parce que the house keeps winning, are the tell. If the lock can glow while the voice lies, the system is working as designed, just not for you.

--Doc (yeah I said it!)
find me anywhere under @DocAtCDI