Please note, I am not accusing any specific person of being a government spook
intent on weakening security, but I can’t help notice the parallels in this
situation with what is known about how Internet standards get compromised
Except that's exactly what the author is doing. Otherwise why did I have to wade through the first 50% of this blog post? Palmer's blog on the subject [1] is well-reasoned and makes the motivations for the decision clear. Slepak may not like those reasons, but adding a veiled accusation of stoogery to an otherwise weak rebuttal just makes you look like an asshole.I'll requote Palmer's fundamental assertion:
However, it is not possible for a low-privilege application to defend against
the platform it runs on, if the platform is intent on undermining the
application’s expectations. To try would be futile, and would necessarily
also violate a crucial digital rights principle: The computer’s owner should
get to decide how the computer behaves. Dell and Lenovo let their customers
down in that way, but for better and for worse, it’s not something that a web
browser can fix.
I can appreciate this argument. Today it's pre-installed certificates, but tomorrow it'll be some malware that hijacks the owner's machine in some other way. If Chrome's responsibilities expand to include the security of the entire system, it would place an impossible burden on its engineers.