4 ms·
In an open source store with an open process like Mozilla's someone's bound to notice. (actually, I'm not sure if Mozilla even can push certs without an explic
by Manishearth 11y ago
In an open source store with an open process like Mozilla's someone's bound to notice.
(actually, I'm not sure if Mozilla even can push certs without an explicit update)
- nolok 11y agoMozilla and its foundation being US based, they can be the target of a gag order, making them liable if they disclose/talk about/hint of "fake" root cert added for the sake of an agency. Once you start playing with gag orders, secret courts and whatnot, all kind of fun stuff become possible.
- jsprogrammer 11y agoAlleged liability. Many seem to think that those actions of the US government are not legally allowed. Most likely there is no real liability for not following a gag order as speech is pretty unambiguously protected from being regulated or circumscribed by the US government.
- rbanffy 11y agoExcept corrupting the source code from which packages are built. At least without anyone outside noticing because the code is public and I bet foreign intelligence agencies that do not trust Microsoft to make IE secure for them are monitoring the change stream.