Hacker News

points by dist-epoch 1 day ago | 0 comments

> If you don't use Terminal as part of your workflow, you don't need to do anything.

they solved the issue for the people they care about

This isn't entirely accurate. Plenty of apps run Terminal commands in the background (for some reason). For example Rewind.ai (before they got acquired and installed a kill switch, Adobe Flash-style) runs `top` every two seconds, presumably to figure out its own CPU usage. What the fucking shit? But I think it's not out of the question that other apps run other crap too.

Also, if they truly didn't care about Terminal users, they would not have even published this article!!

[–] dns_snek 1 day ago

> Plenty of apps run Terminal commands in the background

Most notably agents like Claude Code and Codex? Easy to check if you ask it to run:

    $ curl 'https://dv-g3b-emudhra.we-have-a-problem.com/'

    Your client successfully connected to the site. That's bad!

[–] zahlman 1 day ago

What is the dv-g3b- part supposed to mean? I.e. why was this specific name chosen for the subdomain?

[–] Polizeiposaune 1 day ago

eMudhra generated multiple weak private keys and included their public counterpart in multiple intermediate certificates. You need to check that all the intermediates are rejected.

See the lists in https://bugzilla.mozilla.org/show_bug.cgi?id=2083449; I believe that "dv-g3b-" corresponds to the intermediate CA certificate listed as "EM DV TLS CA - G3B"

DV/OV/EV are "Domain Validated", "Organization Validated" and "Extended Validation" which refer to different levels of checking that the CA should done before issuing a certificate with a particular name in it.

[–] consonaut 1 day ago

DV is probably "Domain validated" describing the type of cert and g3b is the specific root cert the chain starts from.

[–] dspillett 1 day ago

> This isn't entirely accurate. Plenty of apps run Terminal commands in the background (for some reason).

A lot do it because sometimes there is no convenient library wrapping what they are trying to check or execute that they are aware of, and running a cli command is generally cheap unless you are doing it in a tight loop. A lot of the time this is “it'll do until I find the right library or bindings” code that should have been fixed before release, but it isn't all as bad as running top as you describe.

[–] curt15 1 day ago

CLI tools are not to be feared or considered somehow hacky. However much big tech wants people to think that computing is all about some magic apps, Mac OS is still unix, and composing specialized programs together is very much in the spirit of the unix approach to computing.

[–] Wowfunhappy 1 day ago

> CLI tools are not to be feared or considered somehow hacky.

I agree, you're on a *nix OS, calling a CLI tool should be a perfectly valid way to do something.

IMO the real issue is that Apple's built-in CLI tools aren't properly integrated with the rest of the system. Apple's curl used to use the same certificate store as the rest of the OS, then Apple changed it.

[–] krackers 1 day ago

>used to use the same certificate store as the rest of the OS

It was technically curl that dropped SecureTransport but I guess because no one at Apple was willing to maintain it and it apparently is a frozen API that doesn't support newer than TLS 1.2 (!). For a while their inbuilt curl could use both but preferred LibreSSL anyway.

https://daniel.haxx.se/blog/2025/01/14/secure-transport-supp...

[–] Wowfunhappy 16 hours ago

> but I guess because no one at Apple was willing to maintain it and it apparently is a frozen API that doesn't support newer than TLS 1.2 (!)

Well yeah, so not really curl's fault here.

More importantly, IIRC Apple's curl actually stopped using SecureTransport before upstream dropped it.

[–] LoganDark 1 day ago

You're right, that was just the example I had on hand. Maybe a better example could be something like a video downloader that bundles yt-dlp, that could end up using this certificate store rather than the Apple APIs.

[–] 1-more 1 day ago

> Plenty of apps run Terminal commands in the background (for some reason).

Huh, I tried to do this a long time ago and permissions bit me and I quit. I was making a nice UI that would run ffmpeg to stitch together some video files, so it would use native UI elements to pick the input files and output location, then generate the ffmpeg command and run it. It worked fine on my machine but it ran into permissions on my friend's machine who needed it and I gave up because they found something better.

[–] saidnooneever 23 hours ago

that makes it a truly laughable advices. i imagine things like dhcpd etc. might still also break out to shell? i remember from shellshock that a lot of apps turned out to reach to shell which afaik will be term.

ofc it does matter what they do in there, but would users really need to figure all that out themselves and strace all the things to see whats going on down there? :')

truly poor response. happy i dont use apple.

such an expensive flytrap

[–] dist-epoch 1 day ago

They published the article for the people they care above, to make it clear to them they should not worry about all these reports about Apple being vulnerable to this issue.

[–] notJim 1 day ago

God I'm so sick of this "everything-is-a-conspiracy" mindset. Equally likely that they're incompetent, that they simply forgot, that it's difficult because of legacy code reasons.

[–] 975357985 1 day ago

Is this conspiracy you're talking about in the room with us now?