3 ms·
Why havn't they been good guardians ?
by silly-silly 6y ago
Why havn't they been good guardians ?
- est31 6y agoIDK they are volunteers and I respect their work. But they don't follow Mozilla as quickly as one could follow when it comes to removing CAs. E.g. in June 2019, Mozilla removed the Certinomis CA [0], but it took until June 2020 until Debian released a new version that had the CA removed [1] (version 20200601 of the ca-certificates package). [0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1552374 https://bugzilla.mozilla.org/show_bug.cgi?id=1552374 [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956411 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956411
- jart 6y agoMy read here is that Debian was asked to upgrade ca-certificates in April 2020 and they rolled out an update within two weeks. That sounds reasonable. I'd be more concerned about Mozilla. Why did they include the Certinomis CA in the first place? I did a Google search and it appears to be a small business in France that's owned by a stamp printing company. They should totally have the power to read my emails. Quick grep of Mozilla root file tells me they grant 138 different companies root access to SSL. Why do we need that many people trying to make a buck selling prime numbers online? It's gonzo.