3314: Vulnerability
| Vulnerability |
 Title text: Other numbers are largely unaffected, but anyone using '4' for their certificate key is urged to upgrade to '5'. |
Explanation[edit]
|
This is one of 53 incomplete explanations: |
This comic is a math-themed parody of software security vulnerabilities, flaws within a piece of software (such as an app or website) which can be exploited by hackers. Security vulnerabilities come in many forms and their severity varies, from exposure of sensitive user data to catastrophic software bugs which allows remote code execution on a user's system. xkcd, as is typical, riffs on this by treating numbers as something susceptible to security vulnerabilities. This is reminiscent of 3137: Cursed Number.
This comic was released at the same time as two extremely high-profile security vulnerabilities became public, these being the compromised eMudrha Intermediate TLS certificates and the PHP RCE vulnerability.
The Intermediate TLS certificates of the Indian certification authority eMudrha were found to be insecure. Despite using 384-bit keys, the actual values of the private keys for the 8 certificates were 4, 56, 66, 115, 155, 156, 230 and 237.
A major PHP vulnerability was announced on the same day. PHP is a scripting language used in a massive number of websites across the internet, most of which (including explainxkcd) were temporarily shut down before the vulnerability was patched.
The title text is an explicit reference to the eMudrha security vulnerability, specifically the certificate key "4."
Transcript[edit]
|
This is one of 36 incomplete transcripts: |
- [Cueball is sitting at a desk, apparently as a news anchor]
- Cueball: Breaking: Mathematicians have announced a critical vulnerability in the number line affecting the integer between 2 and 4.
- Cueball: Until the patch is applied, if you must count small numbers of objects, please use the alternatives "Half Six" or "Baker's Two".
Discussion
f1rst It may be a interesting fact that explain xkcd was down because a php vulnerability the day vulnerability got out, I think it may me a thing to put in the explanation 79.116.140.136 19:59, 21 October 2026 (UTC)Lord physics
The comic seems to be a reference to an Indian CA botching their private keys, which is unrelated (but oddly coincidental) to this very site being down for a major PHP bug today. 163.116.252.19 20:04, 21 October 2026 (UTC)
Valve's been ready for this for years. 2403:5803:FFFF:5FF8:3A1F:6344:BCEB:25E5 20:53, 21 October 2026 (UTC)
Other popular alternatives include "pi-ish", "floorpi", or "ceil-e" SomeDee (talk) 21:25, 21 October 2026 (UTC)
Add comment