Comment on What is behind the current Lemmy meme about 4 being a private key?
AnAmericanPotato@programming.dev 2 days ago
arstechnica.com/…/the-internet-goes-on-high-alert…
It’s hard to properly describe how big a fuckup this is. All I will say is that all the coverage I’ve seen is underselling the potential for harm. There’s nothing you can do except update your shit, pray that everyone in the upstream supply chain of every service you use has updated their shit, and take comfort in the fact that there are no proven wild exploits out there (yet).
toddestan@lemmy.world 2 days ago
Well, even if there’s no update for your shit, it’s still possible to go into the certificate store your browser/OS/whatever uses and delete the compromised certificates.
Not much you can do about everyone else not updating their shit though.
AnAmericanPotato@programming.dev 1 day ago
Yeah. The burden is high, though, and it’s outside even most tech-savvy admins’ scope of knowledge.
I mean, I could not tell you off the top of my head how many certificate stores exist on my system and what uses each of them. Is curl safe? Is dnf safe? apt-get? zypper? pip? npm? homebrew? flatpak? Do any of my umpteen Flatpak apps have vulnerable library versions baked in? Do Electron apps bundle their own certificate stores? What about <random bullshit> that has its own built-in autoupdater (less of a problem on Linux than Mac or Windows, but still)?