Comment by LoganDark
6 hours ago
This isn't entirely accurate. Plenty of apps run Terminal commands in the background (for some reason). For example Rewind.ai (before they got acquired and installed a kill switch, Adobe Flash-style) runs `top` every two seconds, presumably to figure out its own CPU usage. What the fucking shit? But I think it's not out of the question that other apps run other crap too.
Also, if they truly didn't care about Terminal users, they would not have even published this article!!
> Plenty of apps run Terminal commands in the background (for some reason).
Huh, I tried to do this a long time ago and permissions bit me and I quit. I was making a nice UI that would run ffmpeg to stitch together some video files, so it would use native UI elements to pick the input files and output location, then generate the ffmpeg command and run it. It worked fine on my machine but it ran into permissions on my friend's machine who needed it and I gave up because they found something better.
> Plenty of apps run Terminal commands in the background
Most notably agents like Claude Code and Codex? Easy to check if you ask it to run:
What is the dv-g3b- part supposed to mean? I.e. why was this specific name chosen for the subdomain?
eMudhra generated multiple weak private keys and included their public counterpart in multiple intermediate certificates. You need to check that all the intermediates are rejected.
See the lists in https://bugzilla.mozilla.org/show_bug.cgi?id=2083449; I believe that "dv-g3b-" corresponds to the intermediate CA certificate listed as "EM DV TLS CA - G3B"
DV/OV/EV are "Domain Validated", "Organization Validated" and "Extended Validation" which refer to different levels of checking that the CA should done before issuing a certificate with a particular name in it.
DV is probably "Domain validated" describing the type of cert and g3b is the specific root cert the chain starts from.
> This isn't entirely accurate. Plenty of apps run Terminal commands in the background (for some reason).
A lot do it because sometimes there is no convenient library wrapping what they are trying to check or execute that they are aware of, and running a cli command is generally cheap unless you are doing it in a tight loop. A lot of the time this is “it'll do until I find the right library or bindings” code that should have been fixed before release, but it isn't all as bad as running top as you describe.
CLI tools are not to be feared or considered somehow hacky. However much big tech wants people to think that computing is all about some magic apps, Mac OS is still unix, and composing specialized programs together is very much in the spirit of the unix approach to computing.
> CLI tools are not to be feared or considered somehow hacky.
I agree, you're on a *nix OS, calling a CLI tool should be a perfectly valid way to do something.
IMO the real issue is that Apple's built-in CLI tools aren't properly integrated with the rest of the system. Apple's curl used to use the same certificate store as the rest of the OS, then Apple changed it.
You're right, that was just the example I had on hand. Maybe a better example could be something like a video downloader that bundles yt-dlp, that could end up using this certificate store rather than the Apple APIs.
They published the article for the people they care above, to make it clear to them they should not worry about all these reports about Apple being vulnerable to this issue.