[09:58:48] <Firefishy>	 Nice work all! https://diff.wikimedia.org/2026/03/26/quo-vadis-crawlers-progress-and-whats-next-on-safeguarding-our-infrastructure/ :)
[10:01:32] <Firefishy>	 Very good to get more communication out about the pain we SRE teams are under faced with this "war" of anonymous scraping bots. The "ethical" narrative of residential proxies companies needs to be actively challenged. 
[11:06:48] <elukey>	 Quick patch if anybody has time https://gerrit.wikimedia.org/r/c/operations/puppet/+/1262055
[11:07:37] <elukey>	 the bundle /etc/ssl/certs/wmf-ca-certificates.crt is probably not updated unless there is a reimage
[11:08:01] <elukey>	 in my case, the error came for /etc/ssl/localcerts/wmf-java-cacerts
[11:11:39] <elukey>	 ahh ok so /etc/ssl/certs/wmf-ca-certificates.crt automatically works, it just filters out the Puppet 5 one afaics
[11:15:18] <elukey>	 well, not really filters, ideally it should be more resilient and error out
[11:16:40] <elukey>	 I can wait Moritz's opinion on Monday, even if it should be relatively safe, but it will trigger a regeneration of /etc/ssl/certs/wmf-ca-certificates.crt fleetwide