

I wonder if they didn’t read this section:
There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.
or if they did read it, but don’t trust it.


I’m not sure what the previous poster was thinking of, but I also thought they were talking about distro packages. I meant my post to be a complement to yours, not a counter-argument.
So far the recommendations I’ve seen have been to update OS ca-certificates, or to manually remove the compromised ones. And the Python devs are saying to update pip and uv. I guess the same goes for npm, but I uninstalled that a long time ago due to the abundance of supply chain attacks. I haven’t seen anyone trustworthy source recommend rolling anything back.