Trust Stores Are Dependencies Too
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
After eMudhra mis-generated eight intermediate CA certificates, whose private keys can be recovered, browsers and OS vendors blocked them, but clients without revocation checks need package updates. Andrew Nesbitt scanned 6,877 critical packages and found 29 shipping CA bundles; 26 hold Mozilla-removed roots still within validity. His counts are unverified, and the scanner misses compiled-in roots. The Apple block date is disputed (19th versus 22nd). Lockfiles, SBOMs and registry metadata don't record bundled trust stores, so finding them means parsing archive contents.
Score
0.72total under rubric v2.0
- Significance0.72
- Reader interest0.87
- Audience breadth0.81
- Practical relevance0.87
- Substantiated0.91
- Technical depth0.94
- New information0.91
- Counts against: Promotional0.02
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.73 | 0.60 | 0.82 | 0.72 | 0.22 | +0.25 | +0.179 |
| Reader interest | 0.82 | 0.85 | 0.95 | 0.87 | 0.13 | +0.20 | +0.175 |
| Audience breadth | 0.94 | 0.70 | 0.78 | 0.81 | 0.24 | +0.10 | +0.081 |
| Practical relevance | 0.86 | 0.85 | 0.91 | 0.87 | 0.06 | +0.15 | +0.131 |
| Substantiated | 0.93 | 0.85 | 0.94 | 0.91 | 0.09 | +0.10 | +0.091 |
| Technical depth | 0.99 | 0.90 | 0.93 | 0.94 | 0.09 | +0.10 | +0.094 |
| New information | 0.94 | 0.80 | 0.99 | 0.91 | 0.19 | +0.10 | +0.091 |
| Promotional | 0.03 | 0.03 | 0.01 | 0.02 | 0.02 | −0.15 | −0.003 |
| Overclaim | 0.18 | 0.15 | 0.08 | 0.14 | 0.10 | −0.15 | −0.021 |
| Sum of contributions | +0.817 | ||||||
| Claim-check penalty | −0.100 | ||||||
| Total, as published | 0.717 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
Claim check
Claim check: 2 matches source · 1 differs from source · 1 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceCausal conclusion
eMudhra generated eight of its intermediate CA certificates incorrectly, so their private keys can be recovered from the certificates themselves.
The cited source says the same thing.
The article says “eMudhra generated eight of its intermediate CA certificates incorrectly, so their private keys can be recovered from the certificates themselves”
The source says “The private keys for the intermediate certificates were incorrectly generated by the CA. This means that anyone can recover them from the certificates”
Source cited by the article: emudhra.we-have-a-problem.com
Differs from sourceDate
Firefox and Chrome blocked the eMudhra intermediates on 17 October, Apple on the 19th, and Microsoft on the 20th.
The cited source says something else; both quotes are shown.
The article says “Firefox (OneCRL and CRLite) and Chrome (CRLSets) blocked the intermediates on 17 October, Apple on the 19th, and Microsoft on the 20th”
The source says “The certificates have been blocked in Firefox and Chrome since the 17th of October, on Microsoft platforms since the 20th and on Apple products since the 22nd”
Source cited by the article: emudhra.we-have-a-problem.com
Couldn’t checkNumber
Of the 6,877 critical packages scanned, 116 contained certificates (about 1.7%), and 28 ship something that works as a CA bundle.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “116 of those packages contained certificates, about 1.7%, mostly test fixtures and package-signing certs. 28 of them ship something that works as a CA bundle”
The source says No passage could be compared.
Source cited by the article: gist.github.com/andrew/4ee27639efb1eb539f36e791942e6617
Couldn’t checkNumber
26 of the 29 bundle packages contain at least one root that Mozilla removed from its programme and that is still within its validity period; matching against CCADB gives 95 such roots.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “26 of the 29 bundle packages contain at least one root that Mozilla has removed from its programme and that is still inside its validity period”
The source says No passage could be compared.
Source cited by the article: ccadb.my.salesforce-sites.com/ccadb/AllCertificateRecordsCSVFormatV5
Matches sourceCausal conclusion
Mozilla removed emSign ECC Root CA - G3 in response to the incident, as its 20 October notice records.
The cited source says the same thing.
The article says “Mozilla removed emSign ECC Root CA - G3 in response to the incident, as its 20 October notice records”
The source says “The G3 root removal is in response to a recent security incident which impacted some intermediate certificates”
Source cited by the article: groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs
No source givenVersion
certifi carried emSign ECC Root CA - G3 through 2026.7.22 and dropped it in 2026.10.18, a day before the 2026.10.19 release.
The article gives no link or citation for it.
The article says “certifi carried it through 2026.7.22 and dropped it in 2026.10.18, a day before the 2026.10.19 release in the fix table”
The source says No source to compare with.
Couldn’t checkDate
Algoliasearch, aws-sdk-v1 and Guzzle 3 still contain StartCom roots that Mozilla removed in Firefox 58 in 2017.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “still contain StartCom roots that Mozilla removed in Firefox 58 in 2017, and those roots stay valid until 2036 and 2039”
The source says No passage could be compared.
Source cited by the article: blog.mozilla.org/security/2017/08/30/removing-disabled-wosign-startcom-certificates-firefox-58
Couldn’t checkVersion
Excon replaced its bundle in version 1.8.0, released on 21 October.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Excon replaced its bundle in 1.8.0, released on 21 October”
The source says No passage could be compared.
Source cited by the article: github.com/excon/excon/pull/925
Also covered by
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 24 Oct 2026, 08:53 UTC. It played no part in the ranking.