2 ms·
>If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. They could in
by gruez 1y ago
>If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha.
They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".
- the8472 1y agoFor CAs that'd likely get them kicked out of browser trust stores if someone detects it. And if it becomes known that a corporation pushes government-malware updates then that corporation would lose trust too. So playing that card means moving the entire planet into a lower-trust equilibrium where everyone has to defend against that. In a better-coordinated world the conclusion from that would be "let's not do that", alas on this Earth TLAs have shown that they're willing to burn the commons, forcing a response like RFC 7258.