It's also weird that it seem to has overshadowed certificates incident, which, to me, appears to be of at least the same magnitude of impact.

▲ Gigachad 3 hours ago | parent [-]

The certificates incident was mitigated by the fact it was revoked within hours so by the time people found out, it was resolved.

Yes there is a long tail of Internet of Shit devices that have a fixed non updated cert store, but these devices are being absolutely ripped to shreds by AI from all angles already.

	▲	Insimwytim 3 hours ago \| parent \| next [-]
		`Most non-browser TLS clients (so basically everything else, with default settings), things like curl, Python, Node, Go, Java, git, package managers and every script and daemon you've got, do three things that matter here: they trust a CA bundle on disk, they don't check revocation by default, and they don't check CT. So the fact that eMudhra and Sectigo have revoked these intermediates doesn't help them at all. [1]` [1] https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-key... ( https://news.ycombinator.com/item?id=50177916 )
	▲	cesarb 3 hours ago \| parent \| prev [-]
		It's not just IoT devices. It's also a very very long tail of programs which for some reason have their own copy of the CA certificates list, either because they don't trust the system's one, want to work identically on all platforms, have a severe case of not-invented-here, or all three at the same time (looking at you, Java...)