News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by goku12 on Tuesday September 09, 2025 @02:35AM (#45178241)
And what about the browser? How does it know which client cert (I assume the key is also there) to use for a site? Does it prompt you before proceeding with authentication?
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by chuckadams on Tuesday September 09, 2025 @09:10AM (#45181466)
The domains the cert gets presented to is also configured in Keychain, and Safari uses it. Looks like Firefox has its own thing, buried several layers deep in settings. No idea about chrome. It's definitely a process you'd want to script in an installer, nothing you'd want to subject the end user to. So yeah, still pretty crap UX overall.
[ Parent | on HN ]