Login
You're viewing the pader.social public feed.
  • stfstf@chaos.social
    Oct 20, 2026, 9:10 PM

    RE: infosec.exchange/@yossarian/11

    zomg, this is bad:

    > pip always loads the CA certificates from its vendored certifi in addition to the system trust store, and there is no supported way to disable this. REQUESTS_CA_BUNDLE / --cert only add CAs; truststore is used “in addition to certifi” by design. As a result, any pip < 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough.

    why vendor and not use the system cert store? seriously???

    💬 2🔄 0⭐ 0

Replies

  • stfstf@chaos.social
    Oct 20, 2026, 9:36 PM

    i also love the aspect of, how do i update pip without using a pip that is vulnerable to MITM attacks.

    💬 0🔄 0⭐ 0
  • Peetz0r 🔜 eth0Peetz0r@hsnl.social
    Oct 20, 2026, 9:26 PM

    @stf possibly because the wisdom once was "system cert store doesn't update fast enough, so we ship our own".

    But yeah, always using both is the worst since untrusting any one is now harder and less reliable than it should be.

    💬 0🔄 0⭐ 0
  • stfstf@chaos.social
    Oct 20, 2026, 9:33 PM

    @Peetz0r i never heard that wisdom, do you have a [citation] for this?

    statically vendored <whatever> is much more toxic in general. you could call them the digital equivalents of forever chemicals, or asbest...

    💬 0🔄 0⭐ 0