Legislator of the Legislative Yuan (Congress) Taiwan @SingularityU Alumni, founder of @Basemail_AI
Taiwan
Joined October 2008
- Tweets5.6K
- Following3.1K
- Followers5.6K
- Likes13.3K
Taiwan’s certificates are in crisis again — less than 4 days left.
On Oct 30, researchers disclosed on Mozilla’s public tracker: TWCA still has 10 trusted, unrevoked CA certificates. Six are intermediate CAs that can issue TLS website certs; four were issued by CYBER Root. Their serial numbers appear to use at most 24 bits of randomness — far below the 64-bit minimum required by international rules since September 2016.
On Oct 31 TWCA issued an emergency notice requiring customers to replace SSL certificates and full chains; the old intermediates must be revoked by Nov 6 00:00. The public notice only mentioned “international requirements” and did not clearly explain the root cause or scope.
Four clear problems:
1. Deadline is imminent. Affected sites, apps, and cross-agency APIs may fail HTTPS validation. MODA must immediately publish which government sites are impacted and daily replacement progress.
2. Single-point dependency. Last year Chunghwa, this year TWCA. Without real multi-CA backup and tested failover, one supplier issue can hit many government systems at once.
3. Years of non-compliance went undetected. Serial generation patterns go back to at least 2011 and continued after the 2016 rule. External researchers found it; some WebTrust reports already listed the serials but the issue was not fixed. The Audit Ministry noted in August that the new MODA–TWCA contract includes compliance and audit rights — were they actually used?
4. Cryptographic security cannot be discounted. Sufficient serial entropy exists to reduce certain hash-collision forgery risks. No evidence of private-key leak or forgery so far, but we should not wait until an attack succeeds. A basic 2016 requirement should not have been exposed by outsiders in 2026.
Recent weeks have also seen PHP critical vulns (Japan’s PM warned; ~300 Taiwanese agencies / ~800 systems affected), CEC candidate asset system leaking 1,573 ID numbers, Binance >$6B stolen (FBI points to North Korea), and a malicious Claude Code extension in the Cursor marketplace attempting an SSH backdoor.
Five demands to the government:
1. Immediate inventory + daily public progress on replacements and remaining risks before the Nov 6 revocation.
2. Real cross-CA backup certificates and regular failover drills for critical services — not just “dual-cert” on paper.
3. Move to short-lived certificates and full automation (ACME). Publish current adoption rates; build automatic issuance, renewal, deployment, key rotation, monitoring, and emergency intermediate-chain replacement. After drills mature, trial certs under 10 days.
4. Technical audit and accountability. TWCA must explain root cause, scope, and fixes. MODA must disclose whether it used the new contract’s audit rights and why third-party audits missed this.
5. Proactively use advanced AI for defense (e.g. Anthropic Cyber Verification Program / CVP), under proper data-security controls, for vulnerability detection, code analysis, and patch verification.
Last year Chunghwa Telecom forced a mass government certificate swap; this year TWCA has a compliance problem. If every supplier issue only triggers emergency replacement orders, we are treating symptoms, not the disease.
Cybersecurity is national security. We need to take action, NOW!
Upgraded to ENSv2 and minted my card.
I'm a DeFi Summer holder.
v2.nft.ens.domains/nft/?toke…
The market is changing very quick. New chips is here, by @AMD — Helion、x Verano（中英字幕）
youtu.be/jsZPIU-B4Gw
我在「臺北 2033 外送王」送完 5 單只花 1:36.14，全台總榜第 1 名 🛵 你能比我快嗎？ go.ai2033.taipei/r/10
I just joined the Brave Rewards Card waitlist! If you sign up earlier, you can get more benefits once it's live. Sign up now. Takes only a few seconds: brave.com/card-waitlist @brave @AttentionToken
Great job! 👍 @motion_so
今夜最大條！小龍蝦大進化 🦞 @openclaw 2.0!! 原來兩個月沒推版，一推就是 2.0！
OpenClaw 2.0 has arrived
openclaw.ai/blog/openclaw-2-…
Before South Korea’s plan for “unlimited AI tokens for all” made headlines, I had already declared at @BasicIncomeOrg #BIEN2026: economic justice now requires UBAI—Universal access to high-quality AI through UBAI Coin. — 20 August 2026
Taiwan saw it coming. 🎥👇
科技立委葛如鈞 Ko Ju-Chun retweeted
Instead of generating a finished image, this AI paints by writing editable JavaScript.
The project uses reinforcement learning and hand-rated examples to teach Qwen 3.5 how to make a good watercolor.
news.ycombinator.com/item?id…
科技立委葛如鈞 Ko Ju-Chun retweeted
Esto NO es un juego nativo.
Es una web.
Corre en el navegador con WebGL y Three.js, sin descargas, y va fluido hasta en móvil.
Web: messenger.abeto.co
Haces de mensajero repartiendo cartas y paquetes por un planeta diminuto, con multijugador y todo.
Lo lejos que ha llegado el desarrollo web es una LOCURA.
HAN LANZADO GUEOGUESSER PERO VIAJANDO EN EL TIEMPO
Te sueltan en cualquier parte del mundo y en cualquier momento de la historia
Tienes que adivinar dónde estás y en qué año
→ Nueva York 1827
→ Japón feudal 1751
→ Hiroshima 1945
Lo más loco: tiene entornos 360 generados con GPT Image 2
Te puedes mover y explorar como si estuvieras ahí
100% gratis y acaba de salir
Enlace abajo 👇
I just reserved my Cloudflare Wallet tag: daaab.cloudflare.pay.
Reserve yours now at cloudflare.pay
科技立委葛如鈞 Ko Ju-Chun retweeted
For my first post, I’m sharing a letter @NVIDIA signed on why open models matter.
AI will transform every industry, power every company, and be built by every country.
Open models strengthen safety and cybersecurity, accelerate innovation and diffusion, and enable sovereignty.
The world needs both frontier closed models and frontier open models.
images.nvidia.com/pdf/Open-W…
Thanks to @BitcoinNews !
Amazing interview @ Tokyo 🗼
🇹🇼"We just sat here, slept, and had a 10% loss."
Legislative Yuan Taiwan (Congress) Legislator and Founder of @Basemail_AI, @dAAAb explains to @_dsencil how a sharp move in the Taiwan dollar exposed the currency risk of holding USD-priced Bitcoin.
Watch the full interview 🔽
Keep Android Open (Stop Google from limiting APK file usage) - Sign the Petition! c.org/4vGy2QK4SH 來自 @Change
