Post by @mhoye@cosocial.ca

Apple's command-line utilities are still exposed to the recent eMudhra weak certificate problem, and will be until a pending software update.

MacOS command-line utilities do use the OS-built-in certificate store, but they (curl, git, python, pip, ruby, bunch of others including openssl, alarmingly) are not built to know about Apple's revocation lists.

So, something to have on the, ahem, radar. More somewhat unsatisfying information here: https://support.apple.com/en-us/149555

"If you want to address this before the software update, one option is [a bucket of awk pipe sudo, a flurry of brackets of every kind ]" is ... extremely out of character for Apple, so much so that I'm wondering if they're somehow caught in the middle of some larger process failure. They're not even bundling that up into something signed you can download and click?

Um. So, I didn't realize this until just now but the first line of my /etc/ssl/cert.pem file on up-to-date-as-of-right-now MacOS reads

# $OpenBSD: cert.pem,v 1.22.2.1 2021/09/30 18:28:20 deraadt Exp $

_2021_

I know the pandemic and ongoing global fuckery have made everything kind of a blur but has _literally nothing bad_ happened between 2021 and last week as far as SSL is concerned?