3 ms·

Devil's advocate: But then if an OEM wants to install themselves as a root, they cannot. That's anti competitive. Why should MS be especially trusted over the O

Devil's advocate: But then if an OEM wants to install themselves as a root, they cannot. That's anti competitive. Why should MS be especially trusted over the OEM? Slowly and way too late, MS has been learning that their "partners" mostly suck and hold a lot of responsibility for MS being so far behind today. MS shipped tablet PC how long before Apple? But they figured "yeah HP and Dell will handle our customer experience well, sure". Also, how is Chrome gonna determine a legitimate deployment? Cause then the dev just needs to convince Chrome it's in a corp environment. Or... Just ship a patched version of Chrome/FF/whatever that doesn't do cert validation.

chris_j 12y ago
Devil's advocate on your devil's advocate: what legitimate reason could an OEM have for installing a root certificate?
- MichaelGG 12y ago
  Same as MS? Maybe they feel they have a better idea on who to trust and thus add and remove certificates as necessary. Maybe they want to sign their own hardware drivers (though, I think those don't use the system CA store). Perhaps they want to offer signatures to customers or software vendors and feel current MS provided CAs are lacking. More mundane, perhaps there's a cheaper CA that's accepted by some trusts, but not MS. Why should MS be trusted more than $OEM? OK, fairly weak arguments, but the freedom of doing so is important. Just as it is important that users be able to verify and undo and choose their root of trust. The concept of a global root of trust breaks down pretty fast. And the OEM can already compromise anything anyways.
  - sjwright 12y ago
    > Same as MS? Maybe they feel they have a better idea on who to trust How would the consumer know who they're trusting?
sjwright 12y ago
> how is Chrome gonna determine a legitimate deployment? Terms and conditions. The corporate version can not be pre-loaded on computers sold at retail unless explicitly ordered by the customer. > Just ship a patched version Again, T&Cs. I believe it's already a license breach to distribute a modified or patched build of Firefox unless the branding is stripped out -- this is why Debian shipped Iceweasel rather than Firefox. The same probably already applies with Chrome/Chromium.

chris_j 12y ago

Devil's advocate on your devil's advocate: what legitimate reason could an OEM have for installing a root certificate?

MichaelGG 12y ago
Same as MS? Maybe they feel they have a better idea on who to trust and thus add and remove certificates as necessary. Maybe they want to sign their own hardware drivers (though, I think those don't use the system CA store). Perhaps they want to offer signatures to customers or software vendors and feel current MS provided CAs are lacking. More mundane, perhaps there's a cheaper CA that's accepted by some trusts, but not MS. Why should MS be trusted more than $OEM? OK, fairly weak arguments, but the freedom of doing so is important. Just as it is important that users be able to verify and undo and choose their root of trust. The concept of a global root of trust breaks down pretty fast. And the OEM can already compromise anything anyways.
- sjwright 12y ago
  > Same as MS? Maybe they feel they have a better idea on who to trust How would the consumer know who they're trusting?

sjwright 12y ago

> how is Chrome gonna determine a legitimate deployment? Terms and conditions. The corporate version can not be pre-loaded on computers sold at retail unless explicitly ordered by the customer. > Just ship a patched version Again, T&Cs. I believe it's already a license breach to distribute a modified or patched build of Firefox unless the branding is stripped out -- this is why Debian shipped Iceweasel rather than Firefox. The same probably already applies with Chrome/Chromium.