logoalt Hacker News

michaelt • yesterday at 11:51 PM • 1 reply • view on HN

Every cert an attacker issues with eMudhra's private key has to appear in the CT logs if they want it to validate in a modern browser.

But if you only want to MITM the connection used by 'pip' to install python wheels - that doesn't check for CT records at all.


Replies

zaptheimpaler • today at 12:46 AM

Seems like we need to upgrade all software to start using CT records then?