Apple's git still trusts the compromised eMudhra certificates
Comments on “Apple's git still trusts the compromised eMudhra certificates”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
As of October 28, git, curl and python3 shipped with macOS reportedly still trust eight eMudhra intermediate CAs whose P-384 private keys can be recovered from their public certificates. Safari and apps on Apple's frameworks are blocked, but tools that read /etc/ssl/cert.pem are not. One independent test on a Mac found Apple's git and curl accepted a forged chain, and Homebrew's git did not help. Builders should remove the roots by hand, recheck after each update, and review macOS CI runners. Apple's response and the macOS 27.2 claim remain unverified.
Why it ranked
No. 1 of 110 with a score of 0.78. The panel rated it highest on practical relevance (0.93) and reader interest (0.85), lowest on audience breadth (0.70).
- AI judgeJudge 2claude-haiku-5-5
- Concrete, actionable security advisory on macOS developer tools trusting compromised eMudhra CA certificates; well-evidenced with reproducible tests, though it is a follow-up to an ongoing incident and mostly relevant to security-minded builders.
- AI judgeJudge 3gpt-5.6-luna
- A timely, technically concrete supply-chain and TLS warning affecting macOS developer tooling, with reproducible checks and mitigation guidance. It overlaps prior eMudhra coverage but adds Apple-specific exposure and practical CI implications.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.78total under rubric v2.3
- Significance0.74
- Reader interest0.85
- Audience breadth0.70
- Practical relevance0.93
- Substantiated0.81
- Technical depth0.80
- New information0.77
- Counts against: Promotional0.03
- Counts against: Overclaim0.24
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.73 | 0.72 | 0.78 | 0.74 | 0.06 | +0.24 | +0.179 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.80 | 0.85 | 0.90 | 0.85 | 0.10 | +0.26 | +0.221 |
| Audience breadthHow many people who build technology does it concern? | 0.66 | 0.80 | 0.65 | 0.70 | 0.15 | +0.13 | +0.092 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.97 | 0.90 | 0.90 | 0.93 | 0.07 | +0.22 | +0.204 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.77 | 0.80 | 0.86 | 0.81 | 0.09 | +0.05 | +0.041 |
| Technical depthHow technically substantive is it? | 0.89 | 0.80 | 0.72 | 0.80 | 0.17 | +0.05 | +0.040 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.78 | 0.80 | 0.72 | 0.77 | 0.08 | +0.05 | +0.038 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.03 | 0.01 | 0.03 | 0.03 | −0.19 | −0.005 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.25 | 0.20 | 0.28 | 0.24 | 0.08 | −0.11 | −0.027 |
| Sum of contributions | +0.782 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.782 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-29/1/"><img src="https://rubric.hrih.si/badge/2026-10-29/1.svg" alt="Ranked #1 on Rubric, 29 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 5 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
Apple was notified of the eMudhra incident on 17th October.
The article gives no link or citation for it.
The article says “Apple was notified of the eMudhra incident on 17th October”
The source says No source to compare with.
No source givenNumber
As of 28th October, the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised eMudhra certificates.
The article gives no link or citation for it.
The article says “the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates”
The source says No source to compare with.
No source givenVersion
macOS 27.2, released on 26th October, did not fix the issue and undid the workaround users had applied by hand.
The article gives no link or citation for it.
The article says “macOS 27.2, released on 26th October, did not fix the issue and undid the workaround that users had applied by hand”
The source says No source to compare with.
Couldn’t checkNumber
Dozens of other projects, many run by volunteers, shipped fixes days ago.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “dozens of other projects, many run by volunteers, shipped fixes days ago”
The source says No passage could be compared.
Source cited by the article: emudhra.we-have-a-problem.com
No source givenCausal conclusion
Because the tools trust the compromised certificates, anyone can intercept any HTTPS connection these tools make, including git clones, pushes and credentials.
The article gives no link or citation for it.
The article says “Anyone can intercept any HTTPS connection these tools make”
The source says No source to compare with.
No source givenNumber
Apple has already protected Safari and other apps built on its networking framework.
The article gives no link or citation for it.
The article says “Apple has already protected Safari and other apps built on its networking framework”
The source says No source to compare with.
Couldn’t checkQuote
Apple's guidance states that macOS updates may revert the manual fix.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Apple's guidance states that macOS updates may revert the fix”
The source says No passage could be compared.
Source cited by the article: support.apple.com/en-us/149555
Also covered by
Elsewhere
Elsewhere: HN 1089 pts, front page
Recorded for context only, checked 29 Oct 2026, 05:47 UTC. It played no part in the ranking.