Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Hi Jeremy,

I'd say file a bug and let's make it a spell if we can. NSS didn't have
any indication of certificates being in the package, I can tell you that
much. I may have missed it though, 'cause the point of the exercise was
different. Anyway, I think it's better to have a spell or a Mozilla
option (if that's doable), than do nothing.
Thanks,

Sergey.

On Wed, 2005-07-13 at 01:33 -0500, Jeremy Blosser (emrys) wrote:
> On Jun 27, Mads Laursen [smgl AT dossen.dk] wrote:
> > Since the current build of firefox does not include the standar bundle of
> > certificates, I'm currently trying to find a suitable bundle, so that I 
> > can
> > make ssl a somewhat nice experience. The only bundle of certs I could find
> > was from curl, they extract them from mozilla sources. Anybody have links 
> > to
> > the actual page with the certs of verisign, rsa and the rest of the people
> > mozilla usually trust?
> 
> What's the deal with this, anyway?  I can't find any indication that
> firefox stopped including certs in general, just some scattered bug
> references that look like they always come back to the distro package being
> broken.  Any idea why we lost them?  I'm guessing it's related to the NSS
> work that's gone on against the firefox spell.
> 
> Regardless of the reason, I don't get why this isn't being treated as a
> serious issue; there's a ton of potential for man-in-the-middle attacks
> against our users here.  I seriously doubt people are calling vendors to
> confirm their site cert every time they want to make a purchase or do
> banking.