points by LoganDark 1 day ago | 0 comments
Can you explain what first principles you mean? /etc/ssl/cert.pem has been a fairly standard convention on BSDs, and Linux distros usually have an equivalent somewhere too, like for example /etc/ssl/certs/ca-certificates.crt.
I don't blame Apple for overlooking it when they have their own security stack that all their own apps use, which already responded to the incident within two hours of the revocation. As another commenter pointed out, Terminal commands probably just weren't a priority of their threat model. I do hope they fix that, but mentioning their market cap is not gonna help here.
[–] 1970-01-01 1 day ago
[–] LoganDark 1 day ago
I'm not saying it doesn't matter that dev tools are affected. Those are perhaps some of the most important tools and riskiest to leave vulnerable, because that could result in malware shipped to users from a trustworthy developer, or malware executed on the developer's machine, rather than simply phishing. I just don't think it's fair to assume they did it intentionally. It's a mistake, and one that should be fixed, don't get me wrong. But there's a reason it happened and that seems fair enough to me.
[–] 1970-01-01 1 day ago
In the same degree as involuntary manslaughter is not intentional murder. Sure they made a mistake. Fairness has limits when you're doing it wrong and know better.
https://emudhra.we-have-a-problem.com/apple.html