United States
United Kingdom
Canada
Australia
New Zealand
IrelandThioJoe finds a certificate private key that was literally four
His two-upload week pairs a cybersecurity breakdown with the chance to influence exemptions for modifying your own devices.
ThioJoe
Story of Why this story? The channel's weekly summary: what went up this week, what is drawing views now, and where the channel stands among similar channels.
The SSL and PHP Situation is Insane (and hilarious)
Things we can learn from the video
Press to jump
- 0:22Root certificate authorities underpin how browsers and other software decide which certificates to trust.
- 1:50ThioJoe explains how small-integer private keys made the affected intermediate certificates easy to compromise.
- 4:36Certificate revocation depends on clients receiving updates, leaving disconnected or non-updating systems exposed.
- 6:45A test page checks whether a client still trusts the compromised certificates.
- 9:12PHP exploit code appeared before official patches, creating a window in which administrators could not apply a fix.
How small can a disastrously weak security key be? ThioJoe's answer is almost too tidy: "One of the private keys was literally the number four."
In "The SSL and PHP Situation is Insane (and hilarious)", he explains how certificate authority eMudhra generated intermediate-certificate private keys using small integers instead of enormous random values. The distinction matters: these certificates sit inside the machinery that lets software decide what to trust. ThioJoe then follows the problem beyond browsers, explaining why disconnected systems and software that does not update can miss certificate revocations.
At roughly 320,000 views, it is the most watched of his two new uploads. The second half turns to PHP, with ThioJoe explaining how exploit code became available before security patches. Among the jokes about the number four, viewers also singled out his simpler graphics and asked how such a tiny key could replace the expected random value.
The other upload, "We only get this chance every 3 years…", moves from broken trust to device ownership. It explains the Library of Congress process for granting exemptions to restrictions on bypassing copyright protection, including why owning hardware does not automatically settle what you can modify. That newer explainer currently draws the most daily views of his recent videos; "The NEW JPEG is Here" remains active too.
Across the channel, daily viewing is above its usual level, though subscribers were unchanged over the week. Nearby in tech, HTX Studio had a much larger week of both views and subscriber growth. ThioJoe's own week was less about new gadgets than the hidden rules and trust systems inside the ones people already use.
Published on Trari
Where next?
What viewers say
I love the new simple graphic visuals
@itsmeteddyhereSee it on YouTubeI'm in that state of `Wait, this is something I don't know about, so I'm probably misunderstanding. Their key was supposed to be 384 bits, but instead it was the number 4? Like 100 in binary?"
@MrStevemurSee it on YouTubelooks like I have to go change the combination on my luggage.
@MyLoopLifeSee it on YouTube
Public comments from the video's page on YouTube
Is this your channel?For the channel's owners and team: a ready picture and text for your audience
Share the story with your audience. Everything is ready:
For an Instagram story or a WhatsApp status
For a community post or your channel's description
The videos drawing views on ThioJoe right now
- Channel
- ThioJoe
- Subscribers
- 3,140,000
- Channel views, last 7 days
- 681,597
- Videos published this week
- 2
- Video published
- October 24, 2026
- Video views so far
- 319,716
- Views on its first day
- 180,129
The numbers
Here is how ThioJoe's uploads and audience moved over the week.
💡 Test your knowledge
Which institution's exemption process does ThioJoe explain in his device-ownership upload?
The upload explains the Library of Congress process for exemptions to restrictions on bypassing copyright protection.