| ▲ | jeffbee 3 hours ago |
| It's interesting that this sort of policy is baked into a language platform. |
|
| ▲ | zx8080 22 minutes ago | parent | next [-] |
| It's probably about power. Certs control is getting higher value, so control over this policy means more negotiation power with whatever states (governments) need from platforms. It's easy to imagine something like: "give us some grant taxpayers money and we'll add your cert to our trusted list/remove theirs cert/disable cert when run on this hardware/etc." |
|
| ▲ | stephbook 3 hours ago | parent | prev | next [-] |
| Indeed. But the Java keystore and the Firefox/Chrome/VSCode NSSDB and whatever Python is shipping this week aren't really better. I wonder what's so annoying about OS certs. |
| |
| ▲ | quiet35 3 minutes ago | parent | next [-] | | I really appreciate Firefox to have their own certificate DB because it allows to create separate profiles with different trusted certificate sets. The country where I live issued it's own root certificates which I have reasons not to trust in all cases but when accessing government services etc. So I've created a separate Firefox profile where I've installed those malicious certificates, keeping the main Firefox profile clean. | |
| ▲ | whatevaa 3 hours ago | parent | prev [-] | | It's mostly historical. They used to suck in the past, but the implementations remain. Nowadays you are better off configuring to use OS certificates if possible. |
|
|
| ▲ | fractorial 3 hours ago | parent | prev [-] |
| What about it makes it so interesting? |
| |
| ▲ | jeffbee 3 hours ago | parent [-] | | Clearly the platform isn't designed to do this. Nobody thought this was going to be a necessary facility. They have just crammed an array of numbers as literal values deep into the standard library. So clearly this is an exceptional event, and not the exercise of a feature that was foreseen. | | |
|
