Apple's git still trusts the compromised eMudhra certificates

	Apple's git still trusts the compromised eMudhra certificates(emudhra.we-have-a-problem.com)
	1155 points by galadran 1 day ago \| 399 comments
	tl;dr: Despite being notified of the eMudhra CA compromise on October 17th, Apple's bundled developer tools (git, curl, python3) on macOS still trust the compromised certificates, allowing HTTPS interception of git operations, credentials, and code. The macOS 27.2 update released October 26th failed to fix the issue and reverted manual workarounds users had applied. While Apple patched Safari and its networking framework, developers must manually remove the affected roots from /etc/ssl/cert.pem and reapply after each OS update.
	HN Discussion: ↑Apple's failure to patch system-wide trust store and reliance on manual edits is outrageous ↑Apple needs a smaller patch mechanism instead of monolithic OS updates to address issues like this quickly ↑Sharing Apple's official guidance and practical workarounds (MacPorts cert.pem) to mitigate the issue •Certificate revocation infrastructure (CRL/OCSP) has been abandoned, exposing broader systemic issues beyond Apple •Speculation that the eMudhra key compromise may have been intentional for intelligence exploitation