3 ms·
I like to build portable static executables, so I embed the CA roots in every executable I build that needs to talk HTTPS. It'd be great if there weren't so man
by jart 3y ago
I like to build portable static executables, so I embed the CA roots in every executable I build that needs to talk HTTPS. It'd be great if there weren't so many mom and pop shops in the certificate authority business. It just boggles my mind how the Internet hasn't fallen apart, considering the only thing you have to do is compromise something like a printing shop in France that runs a CA as a side hustle.
- asadotzler 3y agoWell, it takes a bit more than that to get into any meaningful distribution.
- jart 3y agoIf that were true, then it wouldn't have happened.
- NoZebra120vClip 3y agoI currently run Android 11, and I went through a while ago and disabled any CAs that were hinky or I didn't like what nation they were associated with. AFAICT, there was nothing at all that broke after I disabled so many of these trust anchors. I am not sure if the GP is saying that bundled root CAs can override OS-supplied trust anchors, particularly any which have been manually and administratively disabled, but that would be a disturbing, yet helpful, thing to know.