Date: Thu, 03 Jul 2014 16:55:05 +0200 From: Dan Lukes <dan@obluda.cz> To: freebsd-security@freebsd.org Subject: Re: RFC: Proposal: Install a /etc/ssl/cert.pem by default? Message-ID: <53B56EC9.2020107@obluda.cz> In-Reply-To: <5c02fe3098089bf6d58834a66f2eeba7@mail.feld.me> References: <53B499B1.4090003@delphij.net> <5c02fe3098089bf6d58834a66f2eeba7@mail.feld.me>
next in thread | previous in thread | raw e-mail | index | archive | help
On 07/03/14 16:16, Mark Felder: > if we do not make an effort to provide a default trust store why do we enforce verification by default? Well, there is a CA recognized trustworthy for the purpose of FreeBSD components download. It's a CA maintained by FreeBSD's security officer or other core commiter. I trust source codes under it's control already, so I can trust it's own CA that's verify such code transfers. Of course, such CA is not considered trusted for others purposes. It is acceptable to use pre-installed CA for the purpose of system maintenance, but it must not be used by any generic system utility/library by default. I mean that maintenance tools like portmaster, pkg or so may "trust" such default CA, but generic system tools like fetch or ftp as well as system libraries like libfetch must not considered a CA trusted without explicit administrators/users decision. Dan
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53B56EC9.2020107>