alt Hacker NewsGood on Apple for providing such a detailed article. I disagree that they're doing badly by not updating this file remotely on current software versions in the wild -- most likely their Rapid Security Responses / Background Security Improvements framework does not already support this file, which is why they state a full operating system update will be required. Most likely that will be fixed for the future, but in the meantime, being transparent and open about what administrators can do about this now is the RIGHT APPROACH in this situation, and no other vendor has been nearly as thorough about this.
Replies
They're doing badly because they have a market cap at 5 trillion USD ($5,070,000,000,000 to $5,110,000,000,000) and chose to ditch the first principals of a CA store. Doing impressive backflips to compensate for lack of understanding first principals is exactly that.
Where exactly is it good, that:
* apple told admins how to fix the vulnerability * apple shipped update 27.2, with no fix (today) * the update reverted the admin fix quietly
> most likely their Rapid Security Responses / Background Security Improvements framework does not already support this file
Why would it support this file? Are CA trust stores really that important? /s
> and no other vendor has been nearly as thorough about this
1. That's totally not true. Apple has messed up something that is trivial to fix. 2. The EU's CRA is going to crush them if they don't get their shit together.
Google, Microsoft, Mozilla, several TLS libraries and language runtimes, and even many Linux distros run by volunteers had this issue comprehensively fixed over a week ago: https://emudhra.we-have-a-problem.com/#developers
Meanwhile, it's unsafe to run `git clone` on macOS unless you manually edit some files, and then edit them again after a macOS update puts the dangerous root certificates back.
In what world has Apple been the most "thorough"?