Post by @mhoye@cosocial.ca
Apple's command-line utilities are still exposed to the recent eMudhra weak certificate problem, and will be until a pending software update.
MacOS command-line utilities do use the OS-built-in certificate store, but they (curl, git, python, pip, ruby, bunch of others including openssl, alarmingly) are not built to know about Apple's revocation lists.
So, something to have on the, ahem, radar. More somewhat unsatisfying information here: https://support.apple.com/en-us/149555
18 likes
Ben Rosengart@fivetonsflax@tilde.zone
rogue europlus π€
@europlus@europlus.zone
Greg Lloyd@Roundtrip@federate.social
Nick@internic@mathstodon.xyz
Darby Lines@angry_drunk@union.place
Royce Williams@tychotithonus@infosec.exchange
Marcus "MajorLinux" Summers@majorlinux@toot.majorshouse.com
Alex Schroeder@alex@social.alexschroeder.ch
LAHosken πΊπΈπ@lahosken@hachyderm.io
Shannon Clark@Rycaut@mastodon.social
Slasher Calavera πͺπ@ashur@front-end.social
Stewart Russell@scruss@xoxo.zone
Phil Nelson@philnelson@xoxo.zone
heptapodEnthusiast π³οΈβπ@heptapodEnthusiast@mathstodon.xyz
roland@roland@devdilettante.com
10 boosts
Marcus "MajorLinux" Summers@majorlinux@toot.majorshouse.com
Pasadena CAS@pcas@urusai.social
Phredd Groves@phredd@dice.camp
Darby Lines@angry_drunk@union.place
sarah a@ke7zum@glitchsoc.bg-presents.us
Phil Nelson@philnelson@xoxo.zone
EdTheDev@EdTheDev@infosec.exchange
roland@roland@devdilettante.com
"If you want to address this before the software update, one option is [a bucket of awk pipe sudo, a flurry of brackets of every kind ]" is ... extremely out of character for Apple, so much so that I'm wondering if they're somehow caught in the middle of some larger process failure. They're not even bundling that up into something signed you can download and click?
@dannyman Small mercies but their proposed remedies all modify files carefully and in-situ, and aren't making the mistake I see an _awful lot_ of people making, of throwing dice trying to secure their connections by pulling in changes over unsecured connections.
Um. So, I didn't realize this until just now but the first line of my /etc/ssl/cert.pem file on up-to-date-as-of-right-now MacOS reads
# $OpenBSD: cert.pem,v 1.22.2.1 2021/09/30 18:28:20 deraadt Exp $
_2021_
I know the pandemic and ongoing global fuckery have made everything kind of a blur but has _literally nothing bad_ happened between 2021 and last week as far as SSL is concerned?
I wonder if Cassandra ever said, please, I would like to stop Speaking With The Force Of Prophecy, I would just like my silly jokes to stay silly jokes and not Summon Whatever This Is Into Being, I am just trying to live my life, could I just Do That for a few weeks, and heard Zeus or Athena or whoever answering haha lol no, lmao.
Me frantically looking through the dumb jokes I made a month ago to see what Iβve cursed the world with next week.
oh god, this is the stack on my table as I say this, so apparently Iβll be starting the supervillain phase of my life shortly
@mhoye But you're going to be a supervillain with a well run organization and happy subordinates thanks to getting teamwork right!
@mhoye When an issue impacts macOS command line utils the OS structure makes very frustrating to work it out.
Two years ago I wanted to replace the built-in ssh program to have a version compatible with my Yubikey but when I saw the work involved I ultimately gave up and opted for issuing a mac only private key and copy it to my servers.
@emilianosandri Yeah. The command line has been a second class citizen of the Mac since the inception of OSX.
@mhoye Before OSX there wasn't a command line at all and earlier OSX respected Unix conventions to the point they got UNIX certified multiple times... only in later years they started to stray away for example moving home directories from /home to /Users