First screen, captured 6 days ago.

Go will reject certificate chains containing eight distrusted SPKIs

What HN thinks

A CA's private key walked out the door, and somehow the thread ended up arguing about whether compilers should have opinions.

Total key compromise, upgrade now
The eMudhra/emSign intermediate keys appear fully leaked, with commenters even forging Google certs. Go, Node, rustls and Electron are all patching, so users should upgrade.
Runtimes shouldn't override OS trust
Some object to a language stdlib hardcoding a blocklist on top of the system trust store, calling it an ops headache or a power grab. Others reply that Linux stores can't express revoked intermediates, so there was no alternative.
CT logs refusing certs is debatable
One side says refusing to log forged certificates undermines transparency. The other says that once a key leaks, logging its signatures is meaningless spam, and unlogged certs already fail in CT-enforcing clients.

Consensus: Most agree this is a serious compromise rather than routine distrust, and that patching promptly is warranted. Broader Web PKI redesign ideas such as multi-signed certs or DNS-based validation drew no agreement.

Recommended in the comments

ACME Renewal Information (other): It lets certificates be replaced automatically when a CA is distrusted.
Convergence ↗ (tool): It was suggested as a way to avoid single points of CA failure.

Summarised by Claude from the comment thread 3 days ago.

Points: 114
Comments: 79
Posted: 2026-10-20 by mendym
Category: Security

golang crypto-x509 certificate-authority tls pki distrust

All captures:

Looks similar

Screenshot of github.com: Go: Support for Generic Methods

Go: Support for Generic Methods (github.com)

289 points by f311a 5 months ago | 238 comments

Screenshot of github.com: Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer

Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer (github.com)

701 points by theanonymousone 7 months ago | 281 comments

GitHub issue in BerriAI/litellm reporting a malicious litellm_init.pth file in the 1.82.8 PyPI package that steals credentials via a supply chain compromise.

supply-chain-attack pypi litellm python

Screenshot of github.com: Golang: Crypto/fips140: do not bloat crypto code unnecessarily

Golang: Crypto/fips140: do not bloat crypto code unnecessarily (github.com)

10 points by zx2c4 1 month ago | 1 comments

A GitHub issue proposing that Go's crypto/fips140 code, especially its RNG, stop adding memory and binary-size overhead for users who don't enable FIPS mode.

go fips-140 cryptography binary-size