3314: Vulnerability

Vulnerability

|< < Prev #3314 (October 21, 2026)

Title text: Other numbers are largely unaffected, but anyone using '4' for their certificate key is urged to upgrade to '5'.

|< < Prev Random explanation

Explanation

This is one of 52 incomplete explanations: Elaborate on security vulnerabilities and how software suffering from them can be exploited; elaborate on why the eMudhra keys are bad, and why it matters to the internets at large. Don't remove this notice too soon. You can help by editing the explanation!

This comic is a math-themed parody of software security vulnerabilities — flaws within a piece of software (such as an app or website) which can be exploited by hackers. Security vulnerabilities come in many forms and their severity varies, from exposure of sensitive user data to catastrophic software bugs which allow remote code execution on a vulnerable system. xkcd, as is typical, riffs on this by treating numbers as something susceptible to security vulnerabilities. This is reminiscent of 3137: Cursed Number. System administrators will often be advised to apply a patch to fix such problems as soon as possible, in order to prevent exploitation. In severe cases the advice may be to make the system unavailable until fixed.

Here it is claimed that the abstract concept of the number line contains a critical vulnerability. Since hackers cannot interact directly with it, it is unclear how such a 'vulnerability' could ever be exploited. Even more strangely, the problem is apparently specific to a particular value on the number line ("the whole number between two and four") which needs patching to make it safe. Since individual numbers have no special status on the number line, it would be odd for a single number in particular to be problematic.

Since a fixed piece of software can be expressed as a (usually very large) integer, a security vulnerability could be considered to be its corresponding value on the number line.

Cueball implies that people should avoid even naming the aforementioned number, referring to it as "the integer between two and four", "half six" or "baker's two". The first two euphemisms are simply correct mathematics (an integer being a whole number), whereas a "baker's two" borrows from the phrase "baker's dozen". A dozen means 12, but a baker's dozen is 13, with the reason commonly given being that bakers add one more to a dozen in case they have baked a dud or short measure. By the same logic, a baker's two is one more than two. Fictional variations of baker's dozens were previously explored in 3092: Baker's Units. Cueball's suggestion that this only applies to counting small numbers makes no sense: however large the number you wish to count, you will first have to count through all the smaller numbers in order to get to it.

This comic was released at the same time as two extremely high-profile security vulnerabilities became public:

• A major PHP vulnerability was announced. PHP is a scripting language used in a massive number of websites across the internet, many of which (including explainxkcd itself) were temporarily shut down before the vulnerability was patched.
• The Intermediate TLS certificates of the Indian certification authority eMudhra were found to be insecure. TLS certificates are used to confirm that website data comes from the correct server- without this (and similar checks), any person could respond to a request for any website's data, allowing them to impersonate it at will.

TLS is intended to use a random 384-bit-long integer as its key. Falsifying a TLS certificate requires the key, and determining the key from the certificate is effectively impossible. Due to the massive number of possible values in a 384-bit integer (over $10^{115}$ distinct values), any attempt to guess-and-check keys should have astronomically low chances of finding the real key in any reasonable timeframe. However, although they were expressed in 384-bit formats, a coding error meant that the private keys for eMudhra's 8 certificates were actually set to random numbers from 0 through 255, one of them being simply the number 4. A simple guess-and-check strategy, starting from 0, can easily find all of these keys in less than a second.

The title text is a reference to the eMudhra security vulnerability, specifically the certificate key "4". However, using "5" instead would not have been an improvement.

The idea of hard-coding the number 4 appeared in 221: Random Number.

The concept of avoiding explicitly naming this specific number appeared previously in 1275: int(pi).

Not using an area of the coordinate plane was mentioned in 2735: Coordinate Plane Closure

Transcript

This is one of 36 incomplete transcripts: Don't remove this notice too soon. You can help by editing the transcript!

[Cueball is sitting at a desk with his hands resting on it, apparently as a news anchor.]

Cueball: Breaking: Mathematicians have announced a critical vulnerability in the number line affecting the integer between 2 and 4.

Cueball: Until the patch is applied, if you must count small numbers of objects, please use the alternatives "half six" or "baker's two".

  Add comment 

Discussion

f1rst It may be a interesting fact that explain xkcd was down because a php vulnerability the day vulnerability got out, I think it may me a thing to put in the explanation 79.116.140.136 19:59, 21 October 2026 (UTC)Lord physics

I hadn't heard about the PHP vulnerability before seeing this cartoon. So I went to explainxkcd to get context, only to find that explainxkcd itself was shut down due to the PHP vulnerability. To me, it looked as though XKCD was reacting to something that had happened to its own explanation site instead of the reverse. --144.121.163.114 22:11, 21 October 2026 (UTC)

It was not shut down because of a vulnerability, it was because of a fear of an exploit of a vulnerability. SDSpivey (talk) 17:02, 22 October 2026 (UTC)

The comic seems to be a reference to an Indian CA botching their private keys, which is unrelated (but oddly coincidental) to this very site being down for a major PHP bug today. 163.116.252.19 20:04, 21 October 2026 (UTC)

Valve's been ready for this for years. 2403:5803:FFFF:5FF8:3A1F:6344:BCEB:25E5 20:53, 21 October 2026 (UTC)

Other popular alternatives include "pi-ish", "floorpi", or "ceil-e" SomeDee (talk) 21:25, 21 October 2026 (UTC)

I think round(a few,a handful,several,a couple) works for me, most of the time... 92.23.2.123 22:48, 21 October 2026 (UTC)

Reminiscent of the counting system of the Trolls of the Discworld: "One, two, many, lots." 136.226.18.172 11:35, 22 October 2026 (UTC)

I feel like the explanation should mention 899 (since the vulnerability actually affects two integers between 2 and 4) and 221 (since it describes a procedure that could possibly return '4' as a random integer between 0 and 2^384). Novotvor (talk) 22:15, 21 October 2026 (UTC)

Could someone please explain the "Baker's two"? What it refers to? 5.172.253.158 22:21, 21 October 2026 (UTC)

Made an attempt MrCandela2 (talk) 22:33, 21 October 2026 (UTC)

Refers to a "baker's dozen", which means 13 of something. 2606:69C0:9120:5403:0:0:0:1B21 04:51, 22 October 2026 (UTC)

It would be really funny if we also didn't name the affected integer in the explanation and pretended the vulnerability was real MrCandela2 (talk) 22:34, 21 October 2026 (UTC)

 ✓ Done  2A02:C7C:7344:4C00:55D7:3AD5:4BB5:8282 23:43, 21 October 2026 (UTC)

Terrible change. I'm not anti-humor, but I am pro-clarity. Why would you risk further confusing the exact people who actually need the explanation? ISaveXKCDpapers (talk) 02:23, 22 October 2026 (UTC)

I think it can be assumed that anyone reading who needs the explanation has read the comic, and therefore knows at least the subject of the joke. i guess the comic doesn't name it either but it's painfully clear I think. what's a signature? -- Death cab for me (talk) 04:03, 22 October 2026 (UTC) (please sign your comments with ~~~~)

MrCandela, I appreciate your humor but it was more confusing than funny. I reverted it before I saw the edit history showing that it was intentional. 2603:8081:9700:1224:0:0:0:1 06:17, 22 October 2026 (UTC)

If you really need the joke, I suggest something like: "... 3 (please note we have patched our number line and therefore can use the number safely, use caution when referring to it yourself)" Maur11cio (talk) 08:17, 22 October 2026 (UTC)

why did someone use the term "tangible" to describe operating systems and programming languages? Perhaps as in "Possible to be treated as fact; real" -but that's just awkward and obtuse.It commonly used to refer to "touchable" objects. As someone else described themselves, I'm pro-clarity!Cuvtixo (talk) 06:13, 22 October 2026 (UTC)

Interestingly enough, the vulnerabilities listed are not even the only ones found recently: the PS5 was cracked twice and Kaspersky found a major vulnerability in the devices and softwares marketplaces use in order management. Benzaldehyde (talk) 08:09, 22 October 2026 (UTC)

There are more vulnerabilities published this week, Benzaldehyde, than would fit in Randall's illustration (with apologized to The Bard). 64.201.132.210 16:07, 22 October 2026 (UTC)

Programs aren't always expressed as large integers. The smallest that I know of is the 1-byte program: NOP. Several OSes give it a value of 0 or 1. BunsenH (talk) 14:34, 22 October 2026 (UTC)
        Add comment