I mean, they're the TLS certs are baked into the stdlib 'tls' package, not the compiler itself.
It's just an unfortunate unforced error that the go TLS package is bundled along with the compiler, in the same way Safari being bundled with iOS updates is an unforced error meaning a safari security bug requires a full OS update.
Oh, wow, that makes it even sillier. If I want to delete certs from my system certificate store, I can do that, the stdlib should not be making that choice if it's not even packaging the things.
Yeah, this is making me real glad that I know C well enough to stop being afraid of it.
Pinning certificates in a browser was a brilliant idea for Chrome because web browsers are not made for technical users.
But pinning certificates in a compiler? It's reminding me of that one time where the NSA handed out DES constants to use and said "just trust me, bro". I don't even care that the DES constants ultimately ended up being protections against differential-cryptanalysis SCA (which, btw, the NSA then undermined by arguing for shorter keylengths in "export-grade crypto").
Where your compiler is a root certificate authority. De facto.
I mean, they're the TLS certs are baked into the stdlib 'tls' package, not the compiler itself.
It's just an unfortunate unforced error that the go TLS package is bundled along with the compiler, in the same way Safari being bundled with iOS updates is an unforced error meaning a safari security bug requires a full OS update.
There are no certs baked into Go’s stdlib. This is about pkg x509 blacklisting certain certs that get loaded from elsewhere.
Oh, wow, that makes it even sillier. If I want to delete certs from my system certificate store, I can do that, the stdlib should not be making that choice if it's not even packaging the things.
2 replies →
Yeah, this is making me real glad that I know C well enough to stop being afraid of it.
Pinning certificates in a browser was a brilliant idea for Chrome because web browsers are not made for technical users.
But pinning certificates in a compiler? It's reminding me of that one time where the NSA handed out DES constants to use and said "just trust me, bro". I don't even care that the DES constants ultimately ended up being protections against differential-cryptanalysis SCA (which, btw, the NSA then undermined by arguing for shorter keylengths in "export-grade crypto").
Get off my lawn.