I think there is some bias in it: if software is so exceptionally eternally bad that complaining about it is like saying that water is wet, then that will lead to fewer complaints. Yes, I’m looking at you, JIRA.

If there were only a way to pin external deps loaded from html by sha…

That's not much help if you don't vet all third-party dependencies closely, ideally at the source level pre obfuscation/minification.

With the eMudhra situation we saw e.g. Go doing an emergency release that blacklists the certs, while they aren’t shipped with Go, as a protection of dependencies that haven’t caught up.

In this situation, wouldn’t the more responsible behaviour of gitlab be to blacklist Ruby runtimes that enable the CVE?

The Dutch hacking Russian hackers sounds like a regular day for them, like last time when they even got access to the security cams in the hackers office: https://arstechnica.com/information-technology/2018/01/dutch...

The Dutch intelligence services are world class.

And usually pretty quiet about it. I think this is a bowshot for someone other than Kushner to start wondering about who has what.

Guess what, there are answers to that question! October 14, 2026 was the date the domain got registered.

Domain registration doesn't mean that much. Many similar domains are already registered, eg python2shell.com is 5k aftermarket but js2shell.com is unregistered. Might not be a bad investment to register the .com for all the top PLs.

A grumpy state actor today.

I think you’re right. And since the intermediate certs expire around 2039 and the private keys are known, we have plenty of smooth MitM fun against IoT in front of us.

I think that the Go project is lucky to have you. Thank you for what you do!

There are no certs baked into Go’s stdlib. This is about pkg x509 blacklisting certain certs that get loaded from elsewhere.

Oh, wow, that makes it even sillier. If I want to delete certs from my system certificate store, I can do that, the stdlib should not be making that choice if it's not even packaging the things.

These are intermediate certificates, and the system certificate store on Linux provides no way to tell verifiers such as Go's crypto/x509 that an intermediate is revoked. So Go really has no other option here.

"There's no off-the-shelf option" is not a good reason to trash a preexisting component.

Build another one.

I’m still waiting for the revived Renault R17 which was a too cool concept car. https://www.renault.co.uk/concept-cars-range/r-17-restomod.h...

Oh we can only dream!