They have it. It’s called Xprotect. I’m surprised it hasn’t been used to remove the bad certs.

https://fullmetalmac.com/cybersecurity/macos-security/xprote...

XProtect removes malware, not certificates

what are the capabilities? presumably it could a apply a diff, patch or overwrite a file. in this case it's not even in the protected partition.

Microsoft even has multiple express channels. For example Windows Defender definitions are practically real-time

Just like Apple has. The problem here is whoever made the decision not to use that capability:

https://support.apple.com/en-us/102657

not quite. this is more similar to Windows Quality Updates. Defender updates are real time (up to multiple times a day, and delivered p2p)

I think they meant that Apple’s updates seem to be the opposite of incremental, and they’re not wrong. If anything, Apple has moved in the exact opposite direction in the past decade, moving towards using enormous cryptographically-signed volumes (“sealed” is the term). This makes Apple really happy because they can make sure the users aren’t allowed to modify any of the “system“ files themselves for any reason, but also means that they can’t incrementally update things as easily as they did before. They ship multi-gigabyte “patches” every time.

Being able to trust the OS is a huge advantage, though, and they built the rapid response mechanism to handle those updates:

https://support.apple.com/en-us/102657

The big question is why they’re not using it for things like this, where a tiny layered file system update would benefit almost all of their users immediately.

but the volume with these certs isn't protected. you can edit the files with vim. i'm curious what the holdup is.