lukasgelbmann

What you probably won’t find, though, is the programmer’s else: “If X, Y. Else [meaning: if not X], Z.”

I think it’s a different construction.

The programmer’s if-else goes like “If the window is open, close it. Else, leave it closed.” This is not a natural construction outside of programming, people would use “otherwise” or “if not” instead.

(“Else” stands for “if the window is not open” in the above.)

The Crime and Punishment if-else is more like “If the window is open, close it. Else, cold air will enter.” This is normal English.

(“Else” stands for “if you don’t close it” here. It can’t stand for “if the window is not open”.)

> > Perhaps it will all come back, but now if you love me, give me up . . . else I shall begin to hate you, I feel it.

It’s not being used in the programming if-else sense here. He’s not saying “if you don’t love me, I shall begin to hate you”. He’s saying “if you don’t give me up, I shall begin to hate you”.

Ah, you’re right. Though unless I’m mistaken again, Safari (but not Chrome and Firefox) still trusts AAA Certificate Services and handles this issue with revokations.

> “This is being fixed now”

Wow, that was fast!

I think the main problem is that the weak eMudhra intermediates were cross-signed by Sectigo. Certificate revokations are needed to handle this correctly.

Dropping the Sectigo root along with the eMudhra root is the easy and safe solution, and maybe this is what Apple should have done (it’s the workaround they recommend!). But it means that some small percentage of certificates that are fine won’t be accepted.

Chrome dropped one of the eMudhra roots. The problem is that the weak eMudhra intermediates were cross-signed by Sectigo. ~~Browsers (at least Chrome) didn’t drop the Sectigo root, instead they store a revokation for the cross-signature.~~ (edit: this is wrong, see josephcsible’s answer below)

Dropping the Sectigo root along with the eMudhra root is the easy and safe solution, but it means that some small percentage of certificates that are fine won’t be accepted.

Yes, it’s insane. Step 2 does next to nothing for security without step 3.

Homebrew’s git (unlike homebrew’s curl) seems to default to using the system’s CA bundle, not homebrew’s. Is that a bug?

You could be running a different version of curl, e.g. homebrew. Try `which curl` and `/usr/bin/curl <url>`.

> “Impacts fewer than N distinct services or applications. N is 1 on our frontend monorepo[…]”

What kind of change impacts fewer than 1 services or applications? Is this meant to say “at most N”?

Yes, and variable length arrays were made an optional part of the standard in C11. Whereas flexible array members remain a standard required feature.

Flexible array members don’t allocate a dynamic amount of memory on the stack.

Right, UTF-8000 does have this property. Too late to edit my comment now, thanks for noticing that.