Comment by darkwater
8 hours ago
This is news for NIST but old news generally speaking, being the eMudhra debacle. Or am I missing something?
8 hours ago
This is news for NIST but old news generally speaking, being the eMudhra debacle. Or am I missing something?
It's the Go version of it, I think.
Go is not vulnerable in the same way software using webpki is, because it generally uses the system trust store. However, this change is about golang proactively blocking the certs, so that even if your OS doesn't update, it still won't trust them.
https://github.com/golang/go/issues/82345
But the Go version is as well old news, actually it was one of the first stories about eMudhra appearing on the HN homepage yesterday.
> But the Go version is as well old news,
> actually it was one of the first stories about eMudhra appearing on the HN homepage yesterday.
I feel like I'm going crazy, something which happened (checks clock again to be sure) yesterday (actually two days ago I think, so much has happened that it all blurs together) is being considered old news!
1 reply →