> The other two certificates are for codesigning and trusted by Microsoft

That seems like a WAY bigger problem than TLS, but AFAIK Windows still validates code signing certs against CRLs before trusting them (can't remember if it soft-fails).

▲

msm_ 2 hours ago | parent [-]

Why is that a way bigger problem? Windows will happily run unsigned binaries. Code signing just decreases the friction for users slightly, but is in no way required. TLS is definitely a way bigger problem.

▲

sippingabonedry 2 hours ago | parent [-]

> Windows will happily run unsigned binaries

This is absolutely false, it's a simple policy change to enforce code signing, any organization that is serious about security can do it.

I'll give you the benefit of the doubt and assume you're another Linux guy who doesn't understand Windows security.

The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy.

▲

tsimionescu an hour ago | parent | next [-]

Plenty of major programs are not signed, and thus plenty of organizations don't enforce code signing.

	▲	sippingabonedry an hour ago \| parent [-]
		For the exceptions, you can sign your own using internal CA.

▲

throwaway7356 an hour ago | parent | prev [-]

> The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy.

You already need compromised systems to install malware, signed or not. Not a real problem.

For TLS MitM you just need to use a shared network, wired or wireless.