Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Jun 27, Mads Laursen [smgl AT dossen.dk] wrote:
> Since the current build of firefox does not include the standar bundle of
> certificates, I'm currently trying to find a suitable bundle, so that I can
> make ssl a somewhat nice experience. The only bundle of certs I could find
> was from curl, they extract them from mozilla sources. Anybody have links to
> the actual page with the certs of verisign, rsa and the rest of the people
> mozilla usually trust?

What's the deal with this, anyway?  I can't find any indication that
firefox stopped including certs in general, just some scattered bug
references that look like they always come back to the distro package being
broken.  Any idea why we lost them?  I'm guessing it's related to the NSS
work that's gone on against the firefox spell.

Regardless of the reason, I don't get why this isn't being treated as a
serious issue; there's a ton of potential for man-in-the-middle attacks
against our users here.  I seriously doubt people are calling vendors to
confirm their site cert every time they want to make a purchase or do
banking.

Attachment: pgpT5eduUqBYd.pgp
Description: PGP signature