logoalt Hacker News

michaelt • yesterday at 11:51 PM • 0 replies • view on HN

Every cert an attacker issues with eMudhra's private key has to appear in the CT logs if they want it to validate in a modern browser.

But if you only want to MITM the connection used by 'pip' to install python wheels - that doesn't check for CT records at all.