Clojurians Log v2

@borkdude It's possible blocking the certs may not be sufficient https://www.sonatype.com/blog/the-limits-of-fingerprint-blocklists-a-reproducible-java-certificate-bypass https://feed.craftedsignal.io/briefs/2026-10-java-certificate-bypass/

Thanks. Removing the root certs will block certain legitimate uses though?

Yeah, it likely will 😬 at work we're deleting the roots from /etc/ssl/cert.pem and using JDKs with removed roots, nothing broken so far but obviously babashka has much wider reach!

A solution would be to block the public keys of the compromised intermediates: https://github.com/babashka/babashka/pull/2250

My agent had suggested the same but I wanted to do some more research before suggesting it 😄

Do you still want to do more research?

No, I'm not an expert, I was worried I'd be leading you astray haha

Perhaps @stathissideris has an opinion

I merged this approach