#macos

Follow-up to last week's eMudhra breach, in which the private keys of eight of the Indian certificate authority's intermediate CAs were compromised. A community site run by Dennis Jackson says that as of October 28, the developer tools Apple ships with macOS, including git, curl and python3, still accept certificates from those CAs, 11 days after Apple was notified. It says macOS 27.2, released October 26, did not fix this and undid the manual workaround. Because anyone holding the keys can mint a certificate for any site, it argues that an attacker on the network path could intercept git clones and pushes or capture tokens; the page offers a test repository that impersonates GitHub.

Apple's support note says it has blocked the 12 affected certificates in Safari, Mail and apps using its networking frameworks since October 19, and the emSign ECC Root CA - G3 since October 23. It confirms that tools such as curl and git check /etc/ssl/cert.pem and can still accept these certificates until a future software update, and gives steps to remove the roots by hand.

On Hacker News, some argued the title should blame the shared certificate file rather than git, and one commenter said the threat is overblown because an attacker needs a network position first.

Ghostty, the free, non-profit terminal emulator, released version 1.4.0 on October 27 after seven months of work: 2,889 commits from 172 contributors. Highlights from the release notes:

• Memory: scrollback that isn't on screen is now compressed while the terminal is idle, cutting its physical memory use by 70-90% for typical text, so the default scrollback limit rose from 10 MB to 50 MB. Hidden tabs release GPU memory (about 385 MiB down to 18 MiB in one macOS test).
• Graphics: Ghostty now implements 100% of the Kitty graphics protocol, including animation, which the maintainers say makes it the first terminal other than Kitty to do so.
• Speed: the team found macOS caps each read from a pseudo-terminal at about 1 KiB and reworked how output is drained and parsed.
• Security: ten advisories are fixed, including paste protection that missed carriage returns and crafted Kitty graphics or hyperlinks that could, in some cases, read files or run commands. It also supports macOS 27.

On Hacker News, users compared it with Konsole, WezTerm and iTerm2, and a commenter from the project pointed to libghostty, the embeddable terminal core.