alt Hacker NewsI'm rally disappointed in the Apple response here. I can't understand why they wouldn't consider `/etc/ssl/cert.pem` in scope for a security update. This arbitrary boundary has no justification at all, and makes people less secure.
Come on Apple, do better.
Replies
LoganDark • yesterday at 1:28 PM
There is justification for controlling the scope of security updates. Apple practices incredible defense in depth. This is one of the reasons they can claim such privacy guarantees compared to other vendors. But, I agree that they should have been able to update this file automatically, and hope they will add that capability for the next time something like this happens.
It is in-scope for a security update, and they say one will be coming. They just couldn’t modify cert.pem without a security update like they did for their own SSL APIs. Hopefully a security update will be coming soon.