This is news for NIST but old news generally speaking, being the eMudhra debacle. Or am I missing something?

It's the Go version of it, I think.

colinmarc 4 hours ago | parent | next [-]

Go is not vulnerable in the same way software using webpki is, because it generally uses the system trust store. However, this change is about golang proactively blocking the certs, so that even if your OS doesn't update, it still won't trust them.

https://github.com/golang/go/issues/82345

▲

darkwater 4 hours ago | parent | prev [-]

But the Go version is as well old news, actually it was one of the first stories about eMudhra appearing on the HN homepage yesterday.

	▲	cesarb a few seconds ago \| parent [-]
		> But the Go version is as well old news, > actually it was one of the first stories about eMudhra appearing on the HN homepage yesterday. I feel like I'm going crazy, something which happened (checks clock again to be sure) yesterday (actually two days ago I think, so much has happened that it all blurs together) is being considered old news!