Apple's git still trusts the compromised eMudhra certificates
Developer tools shipped with macOS, including git, curl, and python3, continue to trust compromised eMudhra certificates despite Apple being notified of the issue weeks prior. A macOS update failed to fix the vulnerability and also reverted manual workarounds applied by users, leaving HTTPS connections susceptible to interception and tampering. Dennis Jackson and community contributors published findings and instructions for developers to check and mitigate the issue. Open article →
Notable comments
Discussion strongly criticizes Apple for failing to reliably remove/distrust compromised eMudhra roots from OS trust stores used by command-line tools, forcing fragile manual / homebrew workarounds and repeated reverts across updates.
HN · jrochkind1 Calls out that /etc ssl trust anchors appear to affect far more than just Safari/GUI apps, questioning why OS-level CA management isn’t handled more cleanly in updates.
HN · commandlinefan Highlights a broader ecosystem failure: certificate revocation mechanisms (CRL/OCSP) are effectively abandoned, leaving users dependent on trust-store updates or manual surgery when a CA is compromised.
LOBSTERS · sri Directly references Apple’s own instructions that require re-removing the certs after every update, implying deliberate non-fix/slow fix and motivating automation via scripts.
- Why git and curl on a Mac still trust the broken eMudhra CA…
- Why macOS Git still trusts eMudhra's broken CAs, tested back end by back end
- Response speed to last week's cybersecurity mess? Slow. Apple's git still trusts the compromised...
- Ten days later, Git on macOS still trusts the compromised eMudhra certificates