3 ms·
> I’m also surprised at how little noise this change made even within the information security community. It speaks volumes at how little digital signatures are
by zokier 3y ago
> I’m also surprised at how little noise this change made even within the information security community. It speaks volumes at how little digital signatures are used to proactively enforce the integrity of software at load time within the majority of the ecosystem (again kudos to Intuit).
Or more likely anybody caring about signatures would have updated the binaries already well before the 2019 date when these certs were supposed to be distrusted.
- sn_master 3y agoHow would they have known that those certificates got distrusted? The article says the certs in question were not on any known revocation list.
- deleted 3y ago[deleted]
- zokier 3y agohttps://learn.microsoft.com/en-us/security/trusted-root/2019/may2019 https://learn.microsoft.com/en-us/security/trusted-root/2019... and https://www.microsoft.com/en-us/security/blog/2018/10/04/microsoft-partners-with-digicert-to-begin-deprecating-symantec-tls-certificates/ https://www.microsoft.com/en-us/security/blog/2018/10/04/mic... both list the cert in question