Ten days later, Git on macOS still trusts the compromised eMudhra certificates

Re:Ten days later, Git on macOS still trusts the compromised... by mixdup on Wednesday October 28, 2026 @12:37PM (#50276458)

That fast-track method was used, but it only applies to "graphical" software which really means, software that uses Apple's macOS specific APIs and frameworks, not the lower level UNIX stuff like /etc/ssl

I suspect the fast-track background security updates can only update the databases and revocation lists that live in the proprietary APIs, not any arbitrary file on the system

[ Parent | on HN ]

Re:Ten days later, Git on macOS still trusts the compromised... by genxy on Wednesday October 28, 2026 @12:59PM (#50276767)

I see other people making this statement, but it sounds like a really really weird excuse.

[ Parent | on HN ]

Re:Ten days later, Git on macOS still trusts the compromised... by acdha on Wednesday October 28, 2026 @01:33PM (#50277486)

It’s not an excuse but an explanation: there are separate stacks owned by different teams and they haven’t been forced to collaborate. If you use an internal CA you’ve already had to deal with the easier additive version of this problem because that fails in an obvious, less harmful manner than quietly accepting something which needed to fail.

[ Parent | on HN ]

Re:Ten days later, Git on macOS still trusts the compromised... by genxy on Wednesday October 28, 2026 @01:52PM (#50277938)

It doesn't explain why Apple who 1) sells itself on security and 2) ease of use doesn't 3) update what it installed and protect its users. Why are they not doing those things?

[ Parent | on HN ]

Re:Ten days later, Git on macOS still trusts the compromised... by mixdup on Wednesday October 28, 2026 @02:52PM (#50279018)

I wasn't trying to excuse anything, just explain that they haven't done nothing, but also why it's still an issue. I agree with you they've dropped the ball here. If I were a betting person I'd guess this is just something that slipped through the cracks and there will be changes whether that's to the release process for pushing OS updates, to the fast-track security update process, or to the OS so that everything is working off the same trust store

[ Parent | on HN ]

Re:Ten days later, Git on macOS still trusts the compromised... by mdavidn on Wednesday October 28, 2026 @01:46PM (#50277789)

Agreed. Why does macOS ship with two copies of the trust store? Shouldn't the process to update the primary store automatically derive the other?

[ Parent | on HN ]

Re:Ten days later, Git on macOS still trusts the compromised... by jonny_eh on Wednesday October 28, 2026 @12:53PM (#50276692)

Or they just missed a spot?

[ Parent | on HN ]