Oct 20, 2026, 10:35 AMRE: https://hachyderm.io/@golang/117470816794707999
Update everything that verifies certificates against public roots.
- Oct 20, 2026, 10:35 AM
Replies
Oct 20, 2026, 10:37 AM@filippo shot storm coming
Clemensneverpanic@chaos.socialOct 20, 2026, 10:47 AM@filippo Where can I find details about what the CA allegedly did wrong? "trust us" isn't enough here, and documentation for that change and its CVE is scarce to non-existent.
- Oct 20, 2026, 11:05 AM
@neverpanic "trust us" is IMHO sufficient for *removing* a root in emergency scenarios. If we are right, it protects your users. If we are wrong, not the end of the world to revert a couple days later.
Oct 20, 2026, 11:15 AMNa, it is not. Big claims requires evidence.
If you are right, you are right.
If you are wrong, you lose trust.And by "you", I dont mean you personally.
- Oct 20, 2026, 11:22 AM
Anyway, after a bit of digging by myself.
Things are not that much clearer.How I understand it (might be wrong).
Someone at the eMudhra issues test certificates and blocked them to be visible in the certificate transparency logs.