> It's fortunate that the steps required here aren't particularly complicated for the devices you can update, and the advice essentially boils down to 'update them'. The problem is the devices you can't update or update easily.

> Update everything that ships a CA bundle: your OS ca-certificates package, certifi, Node, Homebrew, and rebuild your container images once the base images pick up the change.

> Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...

Quick -- we need to MITM all the smart TVs so they can be jailbroken in one fell swoop!

▲

__MatrixMan__ 5 hours ago | parent | next [-]

Devices that are smart enough to talk to the internet but not smart enough to let the user install their own certs should not exist.

▲

tonyhart7 4 hours ago | parent [-]

"let the user install their own certs should not exist"

are you sure that this is not opening to more attack vector ?????

▲

LtWorf 4 hours ago | parent | next [-]

Users aren't supposed to be considered an attack vector. I don't care what the advertisers think.

▲

axus 3 hours ago | parent | next [-]

The infected devices on the LAN are an attack vector, though.

	▲	mapontosevenths 3 hours ago \| parent [-]
		If I want my IOT garbage to be infected that's between me and my local botherder. The vendor loses the right to decide how my things are used the minute they take my money.

▲

antonvs 3 hours ago | parent | prev [-]

Users are attack vectors in one of the more commonly successful attacks: social engineering.

	▲	gus_massa an hour ago \| parent \| next [-]
		Like: To verify you are human, clik on the two ducks and install this new certificate. Bonus points if it's during a fake job interview.
	▲	ruszki an hour ago \| parent \| prev [-]
		Yes, however, this causes people who know what they do suffer because of people who don't. My question is whether this affects innovation, because the same thing at different places definitely does, and we actively fight against this exactly to help innovation.

▲

tempfile 3 hours ago | parent | prev [-]

Which is better - two attack vectors that can be mitigated by an expert, or one attack vector that can't be mitigated by anyone?

▲

panarky 23 minutes ago | parent | prev | next [-]

It's easy enough to apt upgrade, and curl shows it's not vulnerable.

But what about python pip and node and bun which bundle their own certs?

And then you'll have a compiled binary like Claude Code, which was built with bun, and has its vulnerable certificates bundled in, ignoring the system certs.

▲

happyPersonR an hour ago | parent | prev | next [-]

If you just take them offline you can do this without having to rush.

Just change your WiFi password, don’t give them the new one and don’t update them lol.

	▲	junon an hour ago \| parent [-]
		You can't hardly use the TVs then. I've seen TVs that don't let you use the HDMI port without it being connected if you have a streaming dongle connected. Hopefully that practice has mostly died off now (Samsung used to do this on some models, iirc), but it's still a risk and only kicks the can down the road a bit.

▲

ezoe 5 hours ago | parent | prev | next [-]

These devices are already very weak and many of them even do non-TLS updates with no signing check anyway.

If it has been so weak already, it can't be weaker.

	▲	Sayrus 4 hours ago \| parent [-]
		Not always true. I have IoT devices where a valid certificate is useful because the original host doesn't exist anymore and the certificate isn't pinned. Flashing the devices require direct UART/USB access which may involve soldering, if it even exists. This leak is gold for those because these devices will never get an updated CRL.

▲

Scott_Helme_ 4 hours ago | parent | prev | next [-]

Just imagine how much stuff you're going to be able to MiTM now!!

▲

justincormack 5 hours ago | parent | prev | next [-]

Some of them seem to do some cert pinning

▲

mschuster91 5 hours ago | parent | prev | next [-]

> > Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...

The interesting question is, how many of these devices will have the compromised CA root certificate in place?

Oh and another thing is problematic, many a Java app ships with its own keystore.jks if it needs to trust some privately hosted endpoint, and that keystore.jks may or may not contain the compromised CA root certificate... updating the OS will not catch this kind of stuff.

▲

cromka 2 hours ago | parent [-]

> how many of these devices will have the compromised CA root certificate in place?

I have two Google devices at home and both are compromised still. If Google can't handle pushing out a quick cert chain update, then I truly doubt other manufacturers can.

	▲	londons_explore an hour ago \| parent [-]
		I'm rather surprised google doesn't require cert pinning for all connections to any google server....

▲

5 hours ago | parent | prev | next [-]

[deleted]

▲

binyu 6 hours ago | parent | prev [-]

[dead]