stf on Nostr: zomg, this is bad: > pip always loads the CA certificates from its vendored certifi ...
zomg, this is bad:
> pip always loads the CA certificates from its vendored certifi in addition to the system trust store, and there is no supported way to disable this. REQUESTS_CA_BUNDLE / --cert only add CAs; truststore is used “in addition to certifi” by design. As a result, any pip < 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough.
why vendor and not use the system cert store? seriously???
Published at
2026-10-20 21:10:27 UTCEvent JSON
{
"id": "b821f3ce9ca0226dfae81900dac5b2fcf2a43dfbf524cb4e7ea5b1c56f941941",
"pubkey": "b887bffcf63863763c712604944ba34cf6b4674aba9d9ad586fda383be9f07c8",
"created_at": 1792530627,
"kind": 1,
"tags": [
[
"proxy",
"https://chaos.social/users/stf/statuses/117475287212523782",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "\n\nzomg, this is bad: \n\n\u003e pip always loads the CA certificates from its vendored certifi in addition to the system trust store, and there is no supported way to disable this. REQUESTS_CA_BUNDLE / --cert only add CAs; truststore is used “in addition to certifi” by design. As a result, any pip \u003c 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough.\n\nwhy vendor and not use the system cert store? seriously???",
"sig": "9fe017ddde70d3e50ebb0ef80a452f82285bc1e55c5fd9302bdbd6b4902551de229d51056415a2a8be8fd3dfffe4104d2a4d658d903c07a4c2015538598d97fa"
}
