Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by accountrequired | Hacker News Reader

Full thread

accountrequired·

"Sir, this is a Wendy's" moment where my compiler thought it was a root certificate authority

View on HN

Where your compiler is a root certificate authority. De facto.

I mean, they're the TLS certs are baked into the stdlib 'tls' package, not the compiler itself.

It's just an unfortunate unforced error that the go TLS package is bundled along with the compiler, in the same way Safari being bundled with iOS updates is an unforced error meaning a safari security bug requires a full OS update.

There are no certs baked into Go’s stdlib. This is about pkg x509 blacklisting certain certs that get loaded from elsewhere.

Oh, wow, that makes it even sillier. If I want to delete certs from my system certificate store, I can do that, the stdlib should not be making that choice if it's not even packaging the things.

These are intermediate certificates, and the system certificate store on Linux provides no way to tell verifiers such as Go's crypto/x509 that an intermediate is revoked. So Go really has no other option here.

"There's no off-the-shelf option" is not a good reason to trash a preexisting component.

Build another one.

Yeah, this is making me real glad that I know C well enough to stop being afraid of it.

Pinning certificates in a browser was a brilliant idea for Chrome because web browsers are not made for technical users.

But pinning certificates in a compiler? It's reminding me of that one time where the NSA handed out DES constants to use and said "just trust me, bro". I don't even care that the DES constants ultimately ended up being protections against differential-cryptanalysis SCA (which, btw, the NSA then undermined by arguing for shorter keylengths in "export-grade crypto").

Get off my lawn.

Reply on news.ycombinator.com