Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Jul 16, Arwed von Merkatz [v.merkatz AT gmx.net] wrote:
> On Wed, Jul 13, 2005 at 08:05:25AM -0400, Sergey A. Lipnevich wrote:
> > Hi Jeremy,
> > 
> > I'd say file a bug and let's make it a spell if we can. NSS didn't have
> > any indication of certificates being in the package, I can tell you that
> > much. I may have missed it though, 'cause the point of the exercise was
> > different. Anyway, I think it's better to have a spell or a Mozilla
> > option (if that's doable), than do nothing.
> > Thanks,
> > 
> > Sergey.
> 
> Any progress on this Sergey? It's getting really annoying to have
> mozilla, firefox and all browsers based on them complain about every
> single https site they connect to.
> I think a seperate spell as optional_depends for nss would probably be
> the best solution.

A fix for this has been applied in devel and test for firefox, mozilla, and
thunderbird.  We need some people to test these since they're currently
holding up stable 0.1 and they include upstream security updates as well.
If you use these spells and are willing, please cast the new versions from
test over the next day let us know if they work for you or not.

> > On Wed, 2005-07-13 at 01:33 -0500, Jeremy Blosser (emrys) wrote:
> > > On Jun 27, Mads Laursen [smgl AT dossen.dk] wrote:
> > > > Since the current build of firefox does not include the standar
> > > > bundle of certificates, I'm currently trying to find a suitable
> > > > bundle, so that I can make ssl a somewhat nice experience. The only
> > > > bundle of certs I could find was from curl, they extract them from
> > > > mozilla sources. Anybody have links to the actual page with the
> > > > certs of verisign, rsa and the rest of the people mozilla usually
> > > > trust?
> > > 
> > > What's the deal with this, anyway?  I can't find any indication that
> > > firefox stopped including certs in general, just some scattered bug
> > > references that look like they always come back to the distro package 
> > > being
> > > broken.  Any idea why we lost them?  I'm guessing it's related to the 
> > > NSS
> > > work that's gone on against the firefox spell.
> > > 
> > > Regardless of the reason, I don't get why this isn't being treated as a
> > > serious issue; there's a ton of potential for man-in-the-middle attacks
> > > against our users here.  I seriously doubt people are calling vendors to
> > > confirm their site cert every time they want to make a purchase or do
> > > banking.
> > 
> > 
> > 
> > _______________________________________________
> > SM-Discuss mailing list
> > SM-Discuss AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> > 
> 
> -- 
> Arwed v. Merkatz                              Source Mage GNU/Linux 
> developer
>                                                     
> http://www.sourcemage.org
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss

Attachment: pgpZHvvfKEUaz.pgp
Description: PGP signature