Main Page

Welcome to the explain xkcd wiki!

We have an explanation for all 3314 xkcd comics, the 21 extra comics, and everything xkcd-related.
Only 52 explanations (1.6%) are incomplete. Help us finish them!

Thank you for your tireless documentation effort :)

—Randall Munroe, in an email to our wiki

Edit this explanation!

Latest comic

Vulnerability

|< < Prev #3314 (October 21, 2026)

Title text: Other numbers are largely unaffected, but anyone using '4' for their certificate key is urged to upgrade to '5'.

|< < Prev Random explanation

Explanation

This comic is a math-themed parody of software security vulnerabilities — flaws within a piece of software (such as an app or website) which can be exploited by hackers. Security vulnerabilities come in many forms and their severity varies, from exposure of sensitive user data to catastrophic software bugs which allow remote code execution on a vulnerable system. xkcd, as is typical, riffs on this by treating numbers as something susceptible to security vulnerabilities. This is reminiscent of 3137: Cursed Number. System administrators will often be advised to apply a patch to fix such problems as soon as possible, in order to prevent exploitation. In severe cases the advice may be to make the system unavailable until fixed.

Here it is claimed that the abstract concept of the number line contains a critical vulnerability. Since hackers cannot interact directly with it, it is unclear how such a 'vulnerability' could ever be exploited. Even more strangely, the problem is apparently specific to a particular value on the number line ("the whole number between two and four") which needs patching to make it safe. Since individual numbers have no special status on the number line, it would be odd for a single number in particular to be problematic.

Since a fixed piece of software can be expressed as a (usually very large) integer, a security vulnerability could be considered to be its corresponding value on the number line, within a very constrained context.

Cueball implies that people should avoid even naming the aforementioned number, referring to it as "the integer between two and four", "half six" or "baker's two". The first two euphemisms are simply correct mathematics (an integer being a whole number), whereas a "baker's two" borrows from the phrase "baker's dozen". A dozen means 12, but a baker's dozen is 13, with the reason commonly given being that bakers add one more to a dozen in case they have baked a dud or short measure. By the same logic, a baker's two is one more than two. Fictional variations of baker's dozens were previously explored in 3092: Baker's Units. Cueball's suggestion that this only applies to counting small numbers makes no sense: however large the number you wish to count, you will first have to count through all the smaller numbers in order to get to it.

This comic was released at the same time as two extremely high-profile security vulnerabilities became public:

• A major PHP vulnerability was announced. PHP is a scripting language used in a massive number of websites across the internet, many of which (including explainxkcd itself) were temporarily shut down before the vulnerability was patched.
• The Intermediate TLS certificates of the Indian certification authority eMudhra were found to be insecure. TLS certificates are used to confirm that website data comes from the correct server- without this (and similar checks), any person could respond to a request for any website's data, allowing them to impersonate it at will.

TLS is intended to use a random 384-bit-long integer as its key. Falsifying a TLS certificate requires the key, and determining the key from the certificate is effectively impossible. Due to the massive number of possible values in a 384-bit integer (over $10^{115}$ distinct values), any attempt to guess-and-check keys should have astronomically low chances of finding the real key in any reasonable timeframe. However, although they were expressed in 384-bit formats, a coding error meant that the private keys for eMudhra's 8 certificates were actually set to random numbers from 0 through 255, one of them being simply the number 4. A simple guess-and-check strategy, starting from 0, can easily find all of these keys in less than a second.

The title text is a reference to the eMudhra security vulnerability, specifically the certificate key "4". However, using "5" instead would not have been an improvement.^{[citation needed]}

The idea of hard-coding the number 4 appeared in 221: Random Number.

The concept of avoiding explicitly naming this specific number appeared previously in 1275: int(pi).

Not using an area of the coordinate plane was mentioned in 2735: Coordinate Plane Closure.

Transcript

[Cueball is sitting at a desk with his hands resting on it, apparently as a news anchor.]

Cueball: Breaking: Mathematicians have announced a critical vulnerability in the number line affecting the integer between 2 and 4.

Cueball: Until the patch is applied, if you must count small numbers of objects, please use the alternatives "half six" or "baker's two".

---

         View comic discussion

Edit this week's pick!

This Week's Explanation for Improvement

As part of the Explanation Improvement Project, each week the community selects one older, stagnant, or otherwise neglected explanation to expand and polish together. This week's pick is comic 976: Sail, you can help us by editing its explanation!

To get involved with the project, you can also nominate an explanation that you think should be improved, or vote on current nominations!

Sail

|< < Prev #976 (November 11, 2011) Next > >|

Title text: It only works a few times before you have to capsize the boat in a soap lagoon again.

|< < Prev Random explanation Next > >|

Explanation

Welcome to This Week's Explanation for Improvement! Anyone is encouraged to help explain comic 976: Sail; click here to get started! If you are new to wiki editing, you can read our editing FAQ for guidance. Here are some suggestions for improving this explanation:   Explain whether this idea could actually work in real life, (with the right weather conditions)   How fast would the wind need to be to form a bubble?   What is Cueball pulling? Is he trying to create the bubble or govern the ship?   Would a boat be able to float in a "soap lagoon"?

A billowing sail sometimes looks like the first stage of blowing a bubble. A strong gust of wind blows by and fills the sail, which Cueball is clearly surprised by and fights to keep the sail under control. As the wind continues, the sail warps and begins acting like a film of bubble soap, eventually separating into its own bubble and floating off and the sail reverting to the original position, as the gust of wind dies down. Sails do not typically act like this under strong winds^{[citation needed]}.

If the booms and mast were actually attached by a rope on the far side, the sail frame could function as a large bubble wand. Commercial 'bubble ropes' can have an area of at least a couple of square metres, but it would need the right velocity and consistency of wind to sustain the bubble long enough to separate cleanly from the sail. This could, theoretically, be possible under extreme wind conditions, but it would be rare to find such winds.

The title text suggests that the water the boat is sailing in is a soap solution that can be used to create the bubbles. If the boat was overturned (capsized) in such water, a film would form between the mast and the boom. The film would become like the sail in the comic, filling with air and forming bubbles. However, with each bubble that is released the remaining film on the boat would become thinner, until it can no longer sustain itself, at which point it would need to be refilled by capsizing again. While this arrangement could be used to produce large bubbles with a sufficient film, Cueball would likely not have to pull on the mainsheet as much as is depicted in the comic, as the 'sail' isn't mechanically attached to the vessel for long, since it is a bubble film, not a piece of cloth.

Transcript

[Cueball is sailing a lateen rigged sailboat.]

[The wind picks up, pushing the sail forward.]

[The wind builds strength. Cueball has to stand up to hold on to the main sheet, with shaking depicting his tugging.]

[The distorted sail balloons out. Cueball is still holding on to the main sheet. More curves depict a stronger tugging.]

[Part of the sail separates into a bubble. Cueball falls backwards into the boat. The sail begins to return to its normal shape.]

[Cueball lands on his rear and scratches his head in confusion as the sail-sized bubble floats away.]

---

         View comic discussion

New here?

You can read a brief introduction about this wiki at explain xkcd. Feel free to create an account and contribute to the wiki! We need explanations for xkcd comics, characters, what if? articles, and everything in between. If it is referenced in an xkcd comic, it should be here.

• See our editing FAQ for specific guidance to this wiki, and the more general help on how to edit wiki pages. There's also a handy wikicode cheatsheet.

• Discussion about the wiki itself happens at the Community portal.

• You can browse the comics from the list of all comics or by navigating the category tree at Category:Comics.

• The incomplete explanations are listed here. Feel free to help out by expanding them!

Rules

Don't be a jerk!

There are a lot of comics that don't have set-in-stone explanations; feel free to put multiple interpretations in the wiki page for each comic.

If you want to talk about a specific comic, use its discussion page.

Please only submit material directly related to xkcd and, of course, only submit material that can legally be posted and freely edited. Off-topic or other inappropriate content is subject to removal or modification at admin discretion, and users who repeatedly post such content will be blocked.

If you need assistance from an administrator, post a message to the Admin requests community portal.