Hacker News
points by Nickste 2 days ago | 0 comments
The interesting thing about the eMudhra issue is that it's not just your cloud environments that you need to be worried about. Think about this scenario:

Developer runs `pip install ruff` with pip < 26.2.2 on a public wifi network at their local coffee shop. Wifi network is spoofed, forwards all traffic except pip. Intercepts the pip requests and returns a malicious package. Machine is instantly compromised.

So any local development environment is also very susceptible to this kind of attack until pip, certifi, node, etc. get upgraded.

We've got good tools for finding this kind of issue CI/CD and our cloud environments. But good luck finding and patching every virtual environment on your local machine.

[–] gradyfps 2 days ago
Do pip / certifi / node bundle their own trusted certificate authorities? Surely you should just be able to remove the compromised intermediate certificates from whatever store you're using and pip / certifi / node refer to the operating system's CA store and prevent that.
[–] Nickste 2 days ago
pip (and Python more broadly) rely on certifi for certificates, which bundles its own certificates. You have to explicitly point certifi to a different cert store if you don't want it to use bundled certs.
[–] SlightlyLeftPad 2 days ago
I agree and I’m also surprised in 2026 that these revocation lists don’t update dynamically. Something like ntp for root certificates would be great.
[–] yanslookup 2 days ago
By the time you are connecting to spoofed WiFi networks you are already in trouble, using this vector seems like a really convoluted attack at that point.
[–] Nickste 2 days ago
Perhaps? But sub "spoofed" for "Free Wifi" and it doesn't seem to convoluted?

The point is that we've been able to trust SSL to protect us on open networks. We might not trust the owner of the infrastructure, but SSL meant that we could tell when our request had been tampered with. That's no longer the case.

[–] bigfish2026 2 days ago
Places like airports would be an absolute disaster. I’ve done so much dev work sitting in one and it would be easy enough to put a fake WiFi access point in a lounge.