On: Apple promises fix 'very soon' for Macs with failed encryption

[stephen_g]

I don't think you understand what the code is doing.

This is verifying certificates for HTTPS connections - not creating them. If they removed the SHA1 verification, you can no longer visit hundreds of millions of sites that haven't updated their certificates yet.

It's the people still using certificates with SHA1 hashes that need to upgrade.

[RexRollman → stephen_g]

But if browser makers decided not to support the hashes, the website owners would have to upgrade. Why allow them to continue to use weak hashes?

[lawnchair_larry → RexRollman]

Because there isn't an attack that affects them.