4 ms·
Due to Firefox and Chromium both being open source, this won't be an issue. If the browser companies remove the ability to remove root certs, we can just fork
by Zikes 13y ago
Due to Firefox and Chromium both being open source, this won't be an issue. If the browser companies remove the ability to remove root certs, we can just fork and add it back.
- ihsw 13y agoThis isn't a technological issue, it's a political issue. It requires a political solution, since laws can be enacted to make what you're proposing illegal. The hacker mantra is indeed "There is a key to every lock" but what happens when 1) you unlock a door, 2) they know you unlocked that door, and 3) it's illegal to unlock that door? Answer: Then they put you in prison.
- Zikes 13y agoI'd love to see that headline: Hacker Jailed for Not Updating Web Browser
- soganess 13y agoIt would read like this: A hacker charged with changing YOUR Internet Browser, potentially making the entire country less secure in the face of terrorists, has been found guilty of crimes against the state.
- gavinlynch 13y agoExactly. Let's not pretend they aren't experts at framing false narratives. Actually, that's pretty much the #1 prerequisite for the job of a being a politician...
- gsnedders 13y agoHow about Hacker Jailed For Shipping Web Browser With Secure Encryption? That sounds crazy, no? Yet the US has limited availability of encryption before, so why should it not do so again?
- mpyne 13y agoWhat law would be so dumb as to force an American browser to include malicious CAs, publically, and not also force everyone to only use those American browsers? In your imagined dystopia what you're talking about doing (using a browser with safe CAs) would be illegal no matter where the browser really comes from.
- ihsw 13y agoIt's no different with locked-down phones/tablets where it's illegal to root it. You don't need to force everyone, just people using American ISPs/carriers.
- gsnedders 13y agoThat's not the issue. The issue is the majority of browser users will use the default set of root certificates. Forking and removing them is the least of the difficulties; getting people to use the fork is the problem.
- hnriot 13y agobut not my problem...
- rmc 13y agoIf you live in a police state where everyone you know is being spied on my the government, that's sounds kinda sucky.
- gsnedders 13y agoOh, sure, some may know enough and care enough to do something about it, change browser, change root certs — whatever is needed. But this isn't about them, this is about society at large. This is about whether your mother, your father can use their webmail account without being spied on: would you want all your emails to and from them available because of a MITM attack on someone who is not you? (I realise email is not a great example, with emails typically being transmitted in plaintext between SMTP servers, but is reasonable in the generic digital communication sense.)
- 6d0debc071 13y agoRelevant infrastructure seems less likely to be developed and maintained if an insignificant number of people use it.