ROllerozxa

Well that makes sense. The "emSign ECC Root CA - G3" root is listed as being originally issued on 18 February 2018, so would have been really concerning if that itself was the compromised certificate.

Yeah, in Android 14 they separated it out so that the CA store can be updated from Google Play. Versions below that you're reliant on the manufacturer to ship updates.

I'm not exactly sure which of the roots from eMudra were compromised, but the "emSign ECC Root CA - G3" which is mentioned in the OP site as one you should blacklist, is present on my phone which is running Android 12 with the last security update from three years ago. Having a better timeframe for when the impacted certificates appeared really would have been nice.

Is this real? This seems so ridiculous it makes me wonder for how long this CA has been in circulation in systems and if it has been exploited by someone previously discovering it in that time (state level actor or not). My old phone running Android 6 does not have any certificate from EMudhra, at the very least.

Trying to even open the page in Chrome on my phone freezes the tab with rapid flickering and makes every other tab I switch to or open completely blank until I restart the browser... That effect sure is something.

Yes! I have heard there is a redistributable for getting UCRT installed onto Windows XP, but it seems like quite an obscure update. The idea was to basically make a version that would work on a relatively up to date SP3 version at the very least without system changes, so going with msvcrt instead sounded like the best idea. Otherwise I've heard there are other community-made patches that basically turn XP into more like Windows 7 compatibility wise (One Core API?), albeit with some caveats - I haven't tested whether the modern Principia Windows builds would work under such a setup.

As for GetDynamicTimeZoneInformation, yes it probably would disappear when doing static linking as Principia does not use it. However initially I was building the game with all the dependencies and libstdc++ as DLLs, but ended up linking it all statically after I had to statically link libcurl with mbedtls anyways.

Legacy Update is really a godsend, props to the people maintaining it. The only driver I actually had to install manually via USB was just the Ethernet controller, and then after that was done I could just go online to Legacy Update and let it sit and download and install the rest.

Yes, I don't think anyone truly wants it to be like this. But it's just what happens.

You of course cannot access and empty out someone's bank account this way, you're safe in that regard. But you need to dispute the invoices as soon as possible to show that it is fradulent, so you don't end up needing to actually pay for it. Or get debt collectors after you.

> How do they handle identity thefts

By just accepting it as a normal fact of life that you will have some random stuff ordered in your name sooner or later with an invoice you'll have to dispute. Happened to a relative of mine, police do not care unless they order things above a certain value, without a police report you cannot get free ID protection, and then you'll have to sit for a long time in phone queues trying to cancel a subscription for a streaming service or whatever they ordered while get thrown around by support reps who go "you SURE you or someone in your family didn't order this?"

And then there are widespread amounts of identity theft and mapping out of minorities, but you may sleep well as everyone knowing where you do so is an important step in making sure corruption is no more, don't think too much about it.