To be honest, git deferring to the OS is the right thing to do. It's macOS that's the problem, not git.

"Ten days later, macOS and all applications that rely on it still trust the compromised eMudhra certificates" would have been a better title.

Homebrew ships its own CA bundle so its own curl, etc. are not affected. But the system versions of those tools will continue to be affected until Apple patches their own bundle.

Edit: Git is still affected, we're fixing that now.

(Source: I am one of Homebrew’s maintainers.)

Why are we ok with Apple or Microsoft or Mozilla deciding on a wide selection is CAs for us to trust?

I understand why they originally let each CA in, but it's definitely not one size fits all users.

A user in the US does not need to trust a Turkish CA the same way a user in Turkey does.

There needs to be an easy way for end users to personally drop trust of CAs they don't need and have that decision respected and remembered.

I noticed a machine of my was using a Chinese mirror for Debian apt. Switching to the US apt source brought in updates to cacerts and libbrotli. Not trying to insinuate anything, my mirror was just outdated, and yours (plural) could be too.

I asked codex “find out if this Mac is still trusting that bad cert and remediate if so”. I got a few commands out of it to run myself with sudo, and now I’m good.

Thanks for being on the ball, Apple.

Second probe: confirming the fixed comment path resolves a parent comment correctly.

[flagged]

Apple gets a free pass on this website. If Google or Microsoft did the same thing, the torches and pitchforks would be out.

But instead the Apple fanboys will be out in force to tell us why actually its a good thing for Apple to leave parts of the OS insecure.