Hacker News Reader

They have it. It’s called Xprotect. I’m surprised it hasn’t been used to remove the bad certs.

XProtect removes malware, not certificates

what are the capabilities? presumably it could a apply a diff, patch or overwrite a file. in this case it's not even in the protected partition.

My bet is the XProtect update mechanism could be used to update the certs.pem file.