xp84

Honestly I wouldn’t expect anything to happen. At my company and all previous ones, everyone knows our CEO would never legitimately email or DM us on slack to ask us to real quick wire a few thousand/million/billion to the Caymans, or buy BTC, and he doesn’t have some global root on our servers either. Even people who have more technical access don’t tend to stay logged into elevated production accounts except at the exact time it’s needed.

Is there an important difference there? If it’s a contractor doing official government business, the fact it’s a contractor, and not running software written by public servants on metal that sits on US government property… is more of an implementation detail, isn’t it? The system would have the same importance and function, and contain the same data, whether or not this particular function had been outsourced.

I’ve never worked anywhere that would have done that. If you have a Sec analysis and it says you have vulnerabilities you harden and fix those vulns. You don’t just say “ok full rewrite in $HOT_LANGUAGE!” For one thing, you’ll have to retrain or replace your entire team, who may mostly be $OLD_LANGUAGE specialists. And either feature freeze, or carry on feature development thus needing a larger team, and making the spec a moving target for the porting team.

Now, do I think that it may be more likely in 2027 than it was in 2007 or 2017? Absolutely. Depends on how well-documented and specified your existing system is. A rust rewrite or whatever is highly possible now for many codebases, probably.

The fact you think all your political opponents are racists and evildoers is why the left lost in 2016, and in 2024.

The non-strawman argument is that giving someone citizenship of your country should not be automatic and quick. We want it to be difficult to get in, because otherwise, to borrow your word, “opportunists” find a relatively well-off, trusting society easy pickings to rob, cheat and steal from. And because we don’t want our country to turn into a place that looks like where some of these immigrants come from.

Notice how it isn’t Australians or Germans ending up having to be rounded up by ICE. It’s because they come from a country that believes in laws. And before you say “but that’s because you’re racist!!” I’d like to point out that the same thing applies to people from the Philippines or China who don’t look or speak like white Americans, but for the most part they come here legally.

Yup, and 50 million “Democrats” assisting them, people who’ve been convinced that maximizing the number of foreign citizens living here without valid visas is the enlightened and cool policy to aim for, or at least that if the other party won’t let them automatically naturalize everyone as they sprint across the border, that this is the next best thing.

We already have paths to citizenship, people just need to wait their turn. People with skills we need can already get in under programs that exist for that purpose.

We don’t want the full population of every failed or economically-languishing state (including ALL kinds of people, including the worst elements that exist in every society) to show up overnight and move in, which is what has happened in many western countries including the US with asylum claim abuse.

It’s rapidly turned high-trust societies into low-trust societies because that’s how those who come here from low-trust societies operate by default. People who have been here and know what a proper society looks like don’t like this.

> Overstaying a visa is a civil violation, not a criminal offense. If you want to hunt them as fugitives, change the law.

It sounds like you’re saying we should all just accept that our visas mean nothing, and that in practice literally anyone should be able to just show up, claim asylum, never show up to court for their hearing, and what we should do is absolutely nothing. In “blue” states they are strongly encouraged to sign up for driver’s licenses and welfare programs, and state agencies are forbidden from even asking their legal status. State and local police in those states are often banned from spilling the beans even when they commit crimes.

So, overstaying legal status can’t be addressed by states because Dems think it’s too mean to send them home, and it can’t be actively done by federal agencies because to do so, they have to come into states and investigate people to determine if they’re legally here or not and we don’t like the possibility that they might ever get it wrong.

This is why Democrats lost all respect from moderates like me who used to proudly be part of that party a decade ago. They’re not serious anymore. They appear to want a system that pretends to work but which everyone ignores because everyone knows it’s never enforced. Like driving 70 on the freeway in a 65 zone - everyone does it.

This is not how we should run immigration.

No, unless it’s were a cli image viewer. The gui parts of the OS, and what’s written by Apple, use keychain.

Macs have two completely independent root CA stores. The cli and all the opensource parts use /etc/.

Curl project did actually release support to compile it with default keychain support a year ago, but of course Apple never updates their cli tools, so expect to see that in macOS 37.

Note: I’m not defending Apple here.

It was arguably always halfhearted at best. Look at how behind they were on many things for years. They update things, I assume, when necessary to make the build toolchain work, and possibly to hold onto their POSIX compliance status which some us government buying contracts demand. The fact they changed the default shell to zsh instead of that decade(s)-old version of bash they used to have (avoiding a GPL license change, I think?) was a miracle.

I might find that a good tool, too, but it’s worth pointing out that even doing that upon any change to the keychain trust settings won’t fix the full problem here. The bad “4” certs are also signed by another root, Sectigo, so when CRLs are not being used (a case that seems common for the cli tools), then the certs downstream of the “4” certs have an alternate path to a trusted root. Unless you also nuke the Sectigo cert. which I would personally, but I have a different risk tolerance for breaking random sites than I guess Apple expects its whole customer base to have in the aggregate.

I know, it always makes my jaw drop when I realize that it’s still a significant number of people, since I remember it being a thing I used circa 2005. I don’t think git was even a thing back then.

This seems like extremely acceptable collateral damage to me. Sectigo should already be working with their customers to reissue immediately since they are the ones who signed the dumb intermediates. Trust only matters if there’s accountability. If root CAs want to keep their trust, it’s on them to not sign things that are bad. That’s the responsibility that comes with the license to print money that being a root CA gives you.

If I’m an OS vendor I would have been putting them on notice days ago that their root was being dropped and they have X days to reissue certs and deliver a new root cert or otherwise they can just accept that they’re not qualified to be a root anymore.

I think they meant that Apple’s updates seem to be the opposite of incremental, and they’re not wrong. If anything, Apple has moved in the exact opposite direction in the past decade, moving towards using enormous cryptographically-signed volumes (“sealed” is the term). This makes Apple really happy because they can make sure the users aren’t allowed to modify any of the “system“ files themselves for any reason, but also means that they can’t incrementally update things as easily as they did before. They ship multi-gigabyte “patches” every time.

Why would they need to? Can’t they ship an update that runs an executable that uses the already-existing tooling to update the pem? They’ve posted the cli instructions, so, ship that as a shell script and run it. It should be idempotent, whether the user has already “untrusted” it or not.

> Removing the root CA will mean that these valid certificates no longer work.

Great, that’s fine. They can reissue.