> * It's absurd that Python, Go, or Node need their own certificate stores that need separate updates.
They don't. They use the OS certificate store, which on all platforms has already had this certificate revoked from it.
These runtimes are just doing this as a secondary precaution to deliver the revocations to anyone paying attention to version numbers for their runtime but not their OS. It's a bit of an odd approach, and for most of these projects it's their first time ever doing such a thing, but there's no big issue with it as long as it doesn't encourage complacency and is only applied to truly revoked certificates.
You are thinking of Java, which does actually have its own certificate store. Java users are familiar with how wacky this is, so there have been 3rd party attempts at a cleaner solution, such as the way RHEL keeps the Java certificates in sync with the system certificates.
They don't. They use the OS certificate store, which on all platforms has already had this certificate revoked from it.
These runtimes are just doing this as a secondary precaution to deliver the revocations to anyone paying attention to version numbers for their runtime but not their OS. It's a bit of an odd approach, and for most of these projects it's their first time ever doing such a thing, but there's no big issue with it as long as it doesn't encourage complacency and is only applied to truly revoked certificates.
You are thinking of Java, which does actually have its own certificate store. Java users are familiar with how wacky this is, so there have been 3rd party attempts at a cleaner solution, such as the way RHEL keeps the Java certificates in sync with the system certificates.