← Back to context

Comment by tosh

18 hours ago

nb: operating system TLS trust store is used now (instead of certifi)

Ugh. certifi the most annoying thing ever. It snuck into numerous python dependencies, never made anything better, and confuses all the junior devs when their venvs/containers etc can't access internal CA signed resources. Probably have explained what to do over 9,000 times. And for what? "To provide updated root CAs". Meh. I don't need daily CA trust store updates. If your CA roots are that new, I want nothing to do with it. Cert issuers (cough sectigo and their amateur hour CA root rotation recently, not even Mozilla had it).