<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I have VMs of a couple of old macOS / OS X versions, because I want continued access to the features that have been removed in more recent versions (32-bit user land support in Mojave, ability to run PowerPC apps and executables in Snow Leopard).<div class=""><br class=""></div><div class="">But the old machine that ran Snow Leopard is pretty much dead (why I built a Snow Leopard VM with all its apps copied over to replace it before it died completely). So everything runs on newer systems, but I can still run the old OS versions as VMs if I need them.</div><div class=""><br class=""></div><div class="">One might of course need more $$ to obtain a newer system (although one can probably scrounge a deal on a newer enough used one, if one is careful).<br class=""><div><br class=""></div><div>So I'm not sure what the limitation would be to ONLY using an old system - although if businesses or bureaucrats are involved, limitations may not be sensible.</div><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 29, 2021, at 11:17, Richard Bonomo TDS personal <<a href="mailto:bonomo@tds.net" class="">bonomo@tds.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class="">I don't know what to think about MacPorts, specifically, providing<br class="">new certificates, but, pertaining to some of the arguments presented<br class="">against doing this on old Macs generally, it must be kept in mind<br class="">that some of us -- including yours truly -- have Apple computers that<br class="">CANNOT use newer operating systems or browsers. Sometimes, one has<br class="">to work with what one has.<br class=""><br class="">Rich<br class=""><br class="">----- Original Message -----<br class="">From: "Bill Cole" <<a href="mailto:macportsusers-20171215@billmail.scconsult.com" class="">macportsusers-20171215@billmail.scconsult.com</a>><br class="">To: "macports-users Users" <<a href="mailto:macports-users@lists.macports.org" class="">macports-users@lists.macports.org</a>><br class="">Sent: Friday, October 29, 2021 10:09:45 AM<br class="">Subject: Re: provide latest OS root certificates via port?<br class=""><br class="">On 2021-10-29 at 07:23:38 UTC-0400 (Fri, 29 Oct 2021 07:23:38 -0400)<br class="">Richard L. Hamilton <<a href="mailto:rlhamil@smart.net" class="">rlhamil@smart.net</a>><br class="">is rumored to have said:<br class=""><br class=""><blockquote type="cite" class="">You're (probably - seems plausible but I haven't verified it myself) <br class="">right that that's annoying and fixable.<br class=""><br class="">But there's a big reason to think carefully about whether to do that. <br class="">If something is old enough that it isn't receiving certificate <br class="">updates, it probably isn't receiving security updates either. And the <br class="">same applications and functionality that need current root <br class="">certificates to work are also likely to be common attack points.<br class=""><br class="">So at the very least, anything that makes it easier to take such a <br class="">risk should come with a prominent warning, IMO.<br class=""></blockquote><br class="">Yes: Anyone running Mojave or earlier is not exactly skydiving without a <br class="">parachute, but is doing something close. Perhaps it's akin to skydiving <br class="">with a homemade parachute...<br class=""><br class="">Frankly, I don't think MacPorts should attempt to 'fix' this issue or <br class="">similar future issues diretly, not because it encourages risky behavior <br class="">but because MacPorts should avoid poking around in the MacOS base at all <br class="">where it isn't essential for the operation of MacPorts. It's easy enough <br class="">in principle for MacPorts to stand up and use its own modern OSS-based <br class="">encryption+PKI stack with its own set of trusted CAs (e.g. <br class="">curl-ca-bundle and openssl ports) and so keep itself functional without <br class="">poking around in core functionality of the OS that MacPorts-naive tools <br class="">need to use. People who need to fix the problem of an expired root cert <br class="">should be able to understand and repair that problem (which can be done <br class="">without digging a CA bundle out of a newer system) if they need to, and <br class="">having the issue unaddressed is not itself a security issue, but a <br class="">functionality issue. Anyone who actually wants to run Safari & Chrome on <br class="">an OS that isn't getting basic security maintenance should be thinking <br class="">very carefully about what they are doing and accept responsibility for <br class="">making something work which arguably should no longer work because it is <br class="">too risky.<br class=""><br class="">One risk for MacPorts is a slippery slope created by providing support <br class="">for antique OS versions that include opaque proprietary bits that are <br class="">probably insecure in ways that no one fully understands. If it is taken <br class="">too far (which in my opinion includes fixing core components like PKI) <br class="">MP would be doing a disservice to users who understandably expect a <br class="">"Just Works" experience on a Mac by enabling the continued use of tools <br class="">that could well have permanent unrecognized and mostly invisible <br class="">security flaws.<br class=""><br class=""><br class=""><blockquote type="cite" class=""><blockquote type="cite" class="">On Oct 29, 2021, at 07:12, René J.V. Bertin <<a href="mailto:rjvbertin@gmail.com" class="">rjvbertin@gmail.com</a>> <br class="">wrote:<br class=""><br class="">Hi,<br class=""><br class="">Users of older Apple OSes that are no longer receiving updates <br class="">probably noticed that Safari and Chrome-based browsers no longer <br class="">connect to lots of sites because a crucial root certificate has <br class="">expired.<br class=""><br class="">Answer 1 to <br class=""><a href="https://apple.stackexchange.com/questions/422332/how-do-i-update-my-root-certificates-on-an-older-version-of-mac-os-e-g-el-capi" class="">https://apple.stackexchange.com/questions/422332/how-do-i-update-my-root-certificates-on-an-older-version-of-mac-os-e-g-el-capi</a> <br class="">provides an easy solution, but you need access to an up-to-date OS <br class="">install.<br class=""><br class="">These are not proprietary to Apple so I presume it should be possible <br class="">to provide the suggested `rootcerts.pem` file via a port - possibly <br class="">even install it in the post-activate. I had a look but couldn't find <br class="">if such a port already exists. I think it'd help for lots of <br class="">people... I'd propose a draft but I'm running 10.9 ... so thanks to <br class="">anyone picking this up!<br class=""><br class="">R.<br class=""><br class=""></blockquote></blockquote><br class=""><br class="">-- <br class="">Bill Cole<br class=""><a href="mailto:bill@scconsult.com" class="">bill@scconsult.com</a> or <a href="mailto:billcole@apache.org" class="">billcole@apache.org</a><br class="">(AKA @grumpybozo and many *@billmail.scconsult.com addresses)<br class="">Not Currently Available For Hire<br class=""><br class=""></div></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div>-- <br class="">eMail:<span class="Apple-tab-span" style="white-space: pre;"> </span><a href="mailto:rlhamil@smart.net" class="">mailto:rlhamil@smart.net</a></div><div><br class=""></div></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>