Hacker News new | past | comments | ask | show | jobs | submit
chrisweekly | on: Apple's git still trusts the compromised eMudhra certificates
Right, so it's not just git, it's a bunch of system-provided utilities; macOS trusts bad certs, and these utils that trust the OS are affected. I use homebrew for my git and curl but haven't yet checked to confirm whether that matters here. Kind of outrageous that Apple's guidance is to edit the cert chain manually, and to expect that subsequent OS updates may revert your mitigation, reintroducing the vulnerability (as happened at least once so far).
stingraycharles | parent | next
To be honest, git deferring to the OS is the right thing to do. It's macOS that's the problem, not git.

"Ten days later, macOS and all applications that rely on it still trust the compromised eMudhra certificates" would have been a better title.

loading story #50274029
loading story #50280404
loading story #50279915
loading story #50276874
loading story #50275669
loading story #50277609
loading story #50280313
loading story #50274147
loading story #50275658
woodruffw | parent | next
Homebrew ships its own CA bundle so its own curl, etc. are not affected. But the system versions of those tools will continue to be affected until Apple patches their own bundle.

Edit: Git is still affected, we're fixing that now.

(Source: I am one of Homebrew’s maintainers.)

loading story #50275391
loading story #50277270
loading story #50274914
loading story #50274608
Fatnino | parent | next
Why are we ok with Apple or Microsoft or Mozilla deciding on a wide selection is CAs for us to trust?

I understand why they originally let each CA in, but it's definitely not one size fits all users.

A user in the US does not need to trust a Turkish CA the same way a user in Turkey does.

There needs to be an easy way for end users to personally drop trust of CAs they don't need and have that decision respected and remembered.

loading story #50276695
loading story #50276854
loading story #50276030
loading story #50275340
loading story #50276046
loading story #50275793
loading story #50279883
loading story #50284425
| parent | next
{"deleted":true,"id":50275519,"parent":50272609,"time":1793202072,"type":"comment"}
| parent | next
{"deleted":true,"id":50281572,"parent":50272609,"time":1793224997,"type":"comment"}
undersuit | parent | next
I noticed a machine of my was using a Chinese mirror for Debian apt. Switching to the US apt source brought in updates to cacerts and libbrotli. Not trying to insinuate anything, my mirror was just outdated, and yours (plural) could be too.
kridsdale1 | parent | next
I asked codex “find out if this Mac is still trusting that bad cert and remediate if so”. I got a few commands out of it to run myself with sudo, and now I’m good.

Thanks for being on the ball, Apple.

loading story #50276733
| parent | next
{"deleted":true,"id":50277650,"parent":50272609,"time":1793209220,"type":"comment"}
| parent | next
{"deleted":true,"id":50279093,"parent":50272609,"time":1793213955,"type":"comment"}
probe_user | parent | next
Second probe: confirming the fixed comment path resolves a parent comment correctly.
andrewmutz | parent
Apple gets a free pass on this website. If Google or Microsoft did the same thing, the torches and pitchforks would be out.

But instead the Apple fanboys will be out in force to tell us why actually its a good thing for Apple to leave parts of the OS insecure.

loading story #50275960
loading story #50275425
loading story #50275148
loading story #50275993
loading story #50275287
loading story #50275092