3314: Vulnerability

Vulnerability

|< < Prev #3314 (October 21, 2026) Next > >|

Title text: Other numbers are largely unaffected, but anyone using '4' for their certificate key is urged to upgrade to '5'.

|< < Prev Random explanation Next > >|

Note: The security vulnerability identified in the comic has since been patched so this article's use of "3" and "three" should be considered safe.

Explanation

This is one of 64 incomplete explanations: Elaborate on security vulnerabilities and how software suffering from them can be exploited; elaborate on why the eMudhra keys are bad, and why it matters to the internets at large. Don't remove this notice too soon. You can help by editing the explanation!

This comic is a math-themed parody of software security vulnerabilities — flaws within a piece of software (such as an app or website) which can be exploited by hackers. Security vulnerabilities come in many forms and their severity varies, from exposure of sensitive user data to catastrophic software bugs which allow remote code execution on a vulnerable system. System administrators will often be advised to apply a patch to fix such problems as soon as possible, in order to prevent exploitation. In severe cases the advice may be to make the system unavailable until fixed.

xkcd, as is typical, riffs on this by treating numbers as something susceptible to security vulnerabilities. This is reminiscent of 3137: Cursed Number. Here it is claimed that the abstract concept of the number line contains a critical vulnerability, implying that the fabric of reality functions like a computer program. Apparently, invoking the specific number 'three' (i.e. writing or speaking about it) can lead to an undefined cybersecurity problem. Taking the concept at face value, invoking the number 3 (by speaking or writing) would make a call to 'the number line' which, in turn, would call one or more subroutines that handles the concept of 'three'. Invoking 'three' could reserve memory or, in the case of the invoked 'three' being part of a larger number, feed the instance of 'three' into a parser. (Both parsing and memory management are tasks which commonly result in insecure code.) Another possibility is that the number line is some sort of lookup table and the entry for 'three' sends reality to some 'out of bounds' memory location where invalid data could be read, or even executed as code. This is a common problem resulting in 'glitched' gameplay in vintage video games, often abused by speedrunners.

What happens if 'three' is invoked is not explicitly stated. From the context, however, the implication is that invoker would be put at risk of malicious activity by third parties. This means that invoking 'three' is unlikely to provide reality-warping powers that might benefit the individual (à la Beret Guy) and it is also unlikely that invoking 'three' would 'crash' reality or the invoker, as this would be classified as a software bug, not a software vulnerability. The most likely problem is that if someone invokes 'three' a third party might be able to gain control of the number, be able to read the number or, depending on how the xkcd reality works, take control of the invoker or things that are making use of the number.

Cueball implies that people should avoid even naming the aforementioned number, and refer to it euphemistically as "the integer between two and four", "half six" or "baker's two". This confirms that the problem exists with the explicit invocation of the specific number 'three' and not the wider concept of three. Each of the suggestions are ways to work around invoking 'three' and thus avoid the function call or table lookup that triggers the insecure code.

The first two euphemisms are simply correct mathematics (an integer being a whole number), whereas a "baker's two" borrows from the phrase "baker's dozen". A dozen means 12, but a baker's dozen is 13, with the reason commonly given being that bakers add one more to a dozen in case they have baked a dud or short measure. By the same logic, a baker's two is one more than two. Fictional variations of baker's dozens were previously explored in 3092: Baker's Units. Cueball's suggestion that this only applies to counting small numbers makes no sense: however large the number you wish to count, you will first have to count through all the smaller numbers in order to get to it.

This comic was released at the same time as a number of extremely high-profile security vulnerabilities became public. The large number of simultaneous disclosures led to it being named "Black October". Among them, notably:

• A major PHP vulnerability was announced. PHP is a scripting language used in a massive number of websites across the internet, many of which (including explainxkcd itself) were temporarily shut down before the vulnerability was patched.
• The Intermediate TLS certificates of the Indian certification authority eMudhra were found to be insecure. TLS certificates are used to confirm that website data comes from the correct server — without this (and similar checks), any person could respond to a request for any website's data, allowing them to impersonate it at will.

TLS is intended to use a random 384-bit-long integer as its key. Falsifying a TLS certificate requires the key, and determining the key from the certificate is effectively impossible. Due to the massive number of possible values in a 384-bit integer (over $10^{115}$ distinct values), any attempt to guess-and-check keys should have astronomically low chances of finding the real key in any reasonable timeframe. However, although they were expressed in 384-bit formats, a coding error meant that the private keys for eMudhra's 8 certificates were actually set to random numbers from 0 through 255, one of them being simply the number 4. A simple guess-and-check strategy, starting from 0, can easily find all of these keys in less than a second.

The title text is a reference to the eMudhra security vulnerability, specifically the certificate key "4". However, using "5" instead would not have been an improvement.^{[citation needed]}

The idea of hard-coding the number 4 appeared in 221: Random Number.

The concept of avoiding explicitly naming this specific number appeared previously in 1275: int(pi).

Not using an area of the coordinate plane was mentioned in 2735: Coordinate Plane Closure.

It is not known if other integers or numbers containing the word or digit "three" are affected, if for example 23 must be referred to as "twenty-half-six" or "twenty-baker's-two" or if pi must be "half-six-point-one-four-etc." to avoid the term being spoken aloud.

Transcript

This is one of 41 incomplete transcripts: Don't remove this notice too soon. You can help by editing the transcript!

[Cueball is sitting at a desk with his hands resting on it, apparently as a news anchor.]

Cueball: Breaking: Mathematicians have announced a critical vulnerability in the number line affecting the integer between 2 and 4.

Cueball: Until the patch is applied, if you must count small numbers of objects, please use the alternatives "half six" or "baker's two".

  Add comment 

Discussion

f1rst It may be a interesting fact that explain xkcd was down because a php vulnerability the day vulnerability got out, I think it may me a thing to put in the explanation 79.116.140.136 19:59, 21 October 2026 (UTC)Lord physics

I hadn't heard about the PHP vulnerability before seeing this cartoon. So I went to explainxkcd to get context, only to find that explainxkcd itself was shut down due to the PHP vulnerability. To me, it looked as though XKCD was reacting to something that had happened to its own explanation site instead of the reverse. --144.121.163.114 22:11, 21 October 2026 (UTC)

It was not shut down because of a vulnerability, it was because of a fear of an exploit of a vulnerability. SDSpivey (talk) 17:02, 22 October 2026 (UTC)

Potato tomato. 86.22.132.121 09:06, 23 October 2026 (UTC)

The comic seems to be a reference to an Indian CA botching their private keys, which is unrelated (but oddly coincidental) to this very site being down for a major PHP bug today. 163.116.252.19 20:04, 21 October 2026 (UTC)

Valve's been ready for this for years. 2403:5803:FFFF:5FF8:3A1F:6344:BCEB:25E5 20:53, 21 October 2026 (UTC)

Other popular alternatives include "pi-ish", "floorpi", or "ceil-e" SomeDee (talk) 21:25, 21 October 2026 (UTC)

I think round(a few,a handful,several,a couple) works for me, most of the time... 92.23.2.123 22:48, 21 October 2026 (UTC)

Reminiscent of the counting system of the Trolls of the Discworld: "One, two, many, lots." 136.226.18.172 11:35, 22 October 2026 (UTC)

I feel like the explanation should mention 899 (since the vulnerability actually affects two integers between 2 and 4) and 221 (since it describes a procedure that could possibly return '4' as a random integer between 0 and 2^384). Novotvor (talk) 22:15, 21 October 2026 (UTC)

Could someone please explain the "Baker's two"? What it refers to? 5.172.253.158 22:21, 21 October 2026 (UTC)

Made an attempt MrCandela2 (talk) 22:33, 21 October 2026 (UTC)

Refers to a "baker's dozen", which means 13 of something. 2606:69C0:9120:5403:0:0:0:1B21 04:51, 22 October 2026 (UTC)

It would be really funny if we also didn't name the affected integer in the explanation and pretended the vulnerability was real MrCandela2 (talk) 22:34, 21 October 2026 (UTC)

 ✓ Done  2A02:C7C:7344:4C00:55D7:3AD5:4BB5:8282 23:43, 21 October 2026 (UTC)

Terrible change. I'm not anti-humor, but I am pro-clarity. Why would you risk further confusing the exact people who actually need the explanation? ISaveXKCDpapers (talk) 02:23, 22 October 2026 (UTC)

I think it can be assumed that anyone reading who needs the explanation has read the comic, and therefore knows at least the subject of the joke. i guess the comic doesn't name it either but it's painfully clear I think. what's a signature? -- Death cab for me (talk) 04:03, 22 October 2026 (UTC) (please sign your comments with ~~~~)

I'm surprised my edit lasted as long as it did lmao 2A02:C7C:7344:4C00:55D7:3AD5:4BB5:8282 15:26, 24 October 2026 (UTC)

MrCandela, I appreciate your humor but it was more confusing than funny. I reverted it before I saw the edit history showing that it was intentional. 2603:8081:9700:1224:0:0:0:1 06:17, 22 October 2026 (UTC)

If you really need the joke, I suggest something like: "... 3 (please note we have patched our number line and therefore can use the number safely, use caution when referring to it yourself)" Maur11cio (talk) 08:17, 22 October 2026 (UTC)

Reading all the repeated uses of the number in question being spelled out that have just been added, I'm convinced that it is actually cursed. It just doesn't look right anymore. 86.22.132.121 15:17, 23 October 2026 (UTC)

why did someone use the term "tangible" to describe operating systems and programming languages? Perhaps as in "Possible to be treated as fact; real" -but that's just awkward and obtuse.It commonly used to refer to "touchable" objects. As someone else described themselves, I'm pro-clarity!Cuvtixo (talk) 06:13, 22 October 2026 (UTC)

Interestingly enough, the vulnerabilities listed are not even the only ones found recently: the PS5 was cracked twice and Kaspersky found a major vulnerability in the devices and softwares marketplaces use in order management. Benzaldehyde (talk) 08:09, 22 October 2026 (UTC)

There are more vulnerabilities published this week, Benzaldehyde, than would fit in Randall's illustration (with apologized to The Bard). 64.201.132.210 16:07, 22 October 2026 (UTC)

Programs aren't always expressed as large integers. The smallest that I know of is the 1-byte program: NOP. Several OSes give it a value of 0 or 1. BunsenH (talk) 14:34, 22 October 2026 (UTC)

Operations can be expressed as integers (some of them 1-byte per, others multibyte), and programs being the (generally larger) number that is essentially a string of the opcode (and data) numbers (see Gödel, Escher, Bach for how meta that can get). NOP isn't really a program, on its own, as it does its thing (nothing) then the execution pointer will continue to move on to the next instruction. (It's one of the things that became a aspect of the Core War game-code and gameplay, in I think the '94 update to the original implementation, and is often a vital aspect to clones/spiritual successors of the game.)

Nor need it be done in whole bytes. I've done amazing things with a rather esoteric system that uses just four opcodes (none of the NOP, but "NOP-like" behaviour can always be implemented with what you have to do) that are each only two-bits long. (The simplest program basically is a JMP or JNZ straight back upon itself, which is as true as any other similar low-level language, whether in RISC or CISC or whatever.) Their operands, of course, depending entirely upon the size of the size of environment that they're working in, because of the range of addresses that they need to address; which also tends to dictate how large the typical data-block they operate upon is. And the addressing is also fine-grained to the doublebit level (making everything but the opcodes multi-doublebit), it has the advantage/disadvantage that there's no distinction between memory locations with opcodes, operands and data, which makes it brilliant for self-modifying code (if done right) or absolute corruptive chaos (if not).

...anyway, sorry, you just reminded me of that example. I might dig up my old work in that, when I get time, just for fun. 92.23.2.123 21:12, 22 October 2026 (UTC)

the url for the comic contains a three. your welcome--what's a signature? (talk) 03:07, 23 October 2026 (UTC)

What about my welcome? 81.179.198.128 20:13, 23 October 2026 (UTC)

This feels very similar to the temple of Bel Shamaroth in The Colour of Magic (discworld), which is a weak point where saying the number eight allows an eldritch abomination entry into the world, but euphemisms like "twice four" or "the number between seven and nine" are safe. Coincidence? 148.252.145.84 12:24, 23 October 2026 (UTC)

YES so says I: what's a signature? (talk) 22:18, 23 October 2026 (UTC)

A reading from the Book of Armaments, Chapter 4, Verses 16 to 20: Then did he raise on high the Holy Hand Grenade of Antioch, saying, “Bless this, O Lord, that with it thou mayst blow thine enemies to tiny bits, in thy mercy.” And the Lord did grin, and the people did feast upon the lambs and toads and tree-sloths and fruit-bats and orangutans and breakfast cereals … Now did the Lord say, “First thou pullest the Holy Pin. Then thou must count to half-six. A hat-trick shall be the number of the counting and the number of the counting shall be a baker's two. Four shalt thou not count, neither shalt thou count two, excepting that thou then proceedeth to a quarter-dozen. Five is right out. Once the number root-nine, being the number of the counting, be reached, then lobbest thou the Holy Hand Grenade in the direction of thine foe, who, being naughty in my sight, shall snuff it.”--165.85.89.204 19:22, 23 October 2026 (UTC)

Does this comic count as obliquely being about AI safety? It's kinda weird how since January 2023, Randall has made only one single comic (3126) that was explicitly about AI. ISaveXKCDpapers (talk) 23:52, 23 October 2026 (UTC)

The question is... does everything now have to have something to do with AI? 'Cos sometimes a cigar is just a cigar... There just isn't any explicit mention of AI in this comic, and you'd be really pushing it to suggest that it's 'about AI' implicitly. Closest you can get is that some vulnerabilities have apparently been discovered/used/created by AIs, but there's no hint of it being this rather than being based upon honest-to-goodness human ingenuity/stupidity.

Maybe Randall can be subtle, at times, but he tends not to be that subtle. So far as we know. Unless we're missing subtle jokes about all kinds of other things, of which AI is probably less prominent than bicycles or cappuccino machines or Oort Cloud objects... 81.179.198.128 00:34, 24 October 2026 (UTC)

"However, using "5" instead would not have been an improvement.[citation needed]" - Whoever added that "citation needed" note, you made me laugh pretty hard. Thank you. 206.40.37.178 23:22, 28 October 2026 (UTC)
        Add comment