lobsters score: 1 · tags: cryptography, mac
Discussion on Apple’s official statement regarding this: https://lobste.rs/s/xzp4m0/about_compromised_emudhra_intermediate
score 1 · canonical
Things often take longer at bigger companies. (I’ve worked at Apple, Google, Sun…)
I suspect that for some reason the process to create/test/release a security update touching files in /etc is separate from, and slower than, the process to update the OS trust settings.
Especially since this only affects a small fraction of their user base — for all I know that file may not even exist until the dev tools package is installed.
score 3 · canonical
It may affect a small fraction of their user base directly, but developers and other git users are high-value targets because a compromise there can often lead to supply chain compromise that will affect a much larger group of people.
score 2 · canonical
Turns out a more effective way to access developer’s machines is just to hack Anthropic’s extensions and deploy them: https://lobste.rs/s/ttp7aq/backdoors_claude_code_for_vs_cursor
score 1 · canonical
This is true. I think the primary slowdown is just bureaucracy, aka procedures you have to follow before rolling out any software update to billions of users.
score 2 · canonical
deleted by creator
Apple has always been quietly hostile to the use of Terminal and command line tools: “You’re not using XCode or our approved APIs so it’s your problem, update it yourself”
score 1 · canonical
It’s also part of Homebrew. And a binary you can build yourself. Apple doesn’t want to support all of those install vectors.
score 1 · canonical