Our Response To The eMudhra Key Disclosure Incident
Comments on “Our Response To The eMudhra Key Disclosure Incident”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
The Go team shipped its first URGENT-track security release, Go 1.27.3 and 1.26.10, after researchers found that eight eMudhra intermediate certificates had keys weak enough to recover quickly, which could allow forged TLS certificates. Rebuilt binaries reject those intermediates, and Go says the patch went out about seven and a half hours after notification. The details come mainly from Go's own account. Go lacks revocation support on Linux, so it plans parity work, including evaluating upki. Teams should rebuild and check toolchain versions.
Why it ranked
No. 1 of 124 with a score of 0.78. The panel rated it highest on practical relevance (0.86) and substantiated (0.84), lowest on technical depth (0.73).
Every answer behind this is in the table under Score.
Score
0.78total under rubric v2.2
- Significance0.75
- Reader interest0.84
- Audience breadth0.73
- Practical relevance0.86
- Substantiated0.84
- Technical depth0.73
- New information0.79
- Counts against: Promotional0.05
- Counts against: Overclaim0.10
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.74 | 0.72 | 0.78 | 0.75 | 0.06 | +0.24 | +0.179 |
| Reader interest | 0.76 | 0.86 | 0.90 | 0.84 | 0.14 | +0.26 | +0.218 |
| Audience breadth | 0.68 | 0.80 | 0.72 | 0.73 | 0.12 | +0.13 | +0.095 |
| Practical relevance | 0.91 | 0.85 | 0.82 | 0.86 | 0.09 | +0.22 | +0.189 |
| Substantiated | 0.78 | 0.80 | 0.95 | 0.84 | 0.17 | +0.05 | +0.042 |
| Technical depth | 0.77 | 0.70 | 0.72 | 0.73 | 0.07 | +0.05 | +0.036 |
| New information | 0.77 | 0.90 | 0.70 | 0.79 | 0.20 | +0.05 | +0.040 |
| Promotional | 0.07 | 0.05 | 0.03 | 0.05 | 0.04 | −0.19 | −0.010 |
| Overclaim | 0.16 | 0.10 | 0.04 | 0.10 | 0.12 | −0.11 | −0.011 |
| Sum of contributions | +0.779 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.779 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/1/"><img src="https://rubric.hrih.si/badge/2026-10-27/1.svg" alt="Ranked #1 on Rubric, 27 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 1 matches source · 6 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
Mozilla added eight intermediate certificates (six for TLS, two for code signing) issued by an eMudhra-controlled root to OneCRL on October 17, blocking their use in Firefox.
The article gives no link or citation for it.
The article says “On October 17, Mozilla added eight intermediate certificates (six used for TLS, and two used for code signing) issued by a root certificate controlled by eMudhra to OneCRL”
The source says No source to compare with.
No source givenNumber
Researchers' investigations showed the keys of the eMudhra intermediates were trivially weak, allowing recovery of the private keys in microseconds.
The article gives no link or citation for it.
The article says “the keys associated with these intermediates were trivially weak, allowing recovery of the private keys in microseconds”
The source says No source to compare with.
Couldn’t checkNumber
The Go team shipped a targeted patch within approximately seven and a half hours of being notified.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Within approximately seven and a half hours of being notified, we shipped a targeted patch”
The source says No passage could be compared.
Source cited by the article: groups.google.com/g/golang-announce/c/66pojueaQek
No source givenFirst, only or fastest
The patch was included in the Go team's first-ever URGENT track security release.
The article gives no link or citation for it.
The article says “which was included in our first-ever URGENT track security release”
The source says No source to compare with.
Matches sourceVersion
Go versions 1.27.3 and 1.26.10 contain the patch, and binaries rebuilt with them automatically reject certificates issued by the compromised eMudhra intermediates.
The cited source says the same thing.
The article says “Binaries rebuilt with Go 1.27.3 and 1.26.10 will automatically reject certificates issued by the compromised eMudhra intermediates”
The source says “Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller”
Source cited by the article: groups.google.com/g/golang-announce/c/66pojueaQek
No source givenNumber
The Go release process took just under four and a quarter hours from start to finish because of issues encountered.
The article gives no link or citation for it.
The article says “The issues we ran into caused our release process to take just under four and a quarter hours from start to finish”
The source says No source to compare with.
No source givenCausal conclusion
Because the eMudhra root was present in most trusted root programs, recovering the private keys would let an attacker sign arbitrary TLS certificates for any domain without proving control.
The article gives no link or citation for it.
The article says “recovering the private keys would allow any attacker to sign arbitrary TLS certificates for any domain name, without the usual requirement to show proof of control of said domain name”
The source says No source to compare with.
No source givenDate
By the morning of October 20, numerous independent researchers had publicly disclosed the weak keys.
The article gives no link or citation for it.
The article says “By the morning of October 20, numerous independent researchers had publicly disclosed the weak keys”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.