From owner-freebsd-security@FreeBSD.ORG  Thu Jul  3 01:48:09 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 4618BF90
 for <freebsd-security@freebsd.org>; Thu,  3 Jul 2014 01:48:09 +0000 (UTC)
Received: from mail-qa0-x235.google.com (mail-qa0-x235.google.com
 [IPv6:2607:f8b0:400d:c00::235])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 0133A2AF9
 for <freebsd-security@freebsd.org>; Thu,  3 Jul 2014 01:48:08 +0000 (UTC)
Received: by mail-qa0-f53.google.com with SMTP id j15so9819917qaq.12
 for <freebsd-security@freebsd.org>; Wed, 02 Jul 2014 18:48:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=eitanadler.com; s=0xdeadbeef;
 h=mime-version:in-reply-to:references:from:date:message-id:subject:to
 :cc:content-type;
 bh=LdqQ9vLWK3ZQUFQprmYsf5ECABeRtmNbiyQxSbRWAYc=;
 b=EqSOJzAFkY5bKHQlimLQDiSVHYuCJcPT7gwTRXwMyUG1B+xmjFSyHMPUaxfINo6jWK
 hy1XEpjYEQxviYx58QOmSDYH0SM+2jeUIzFC9GP9ZKYreI5hxHHLUrowIrXoUUJ/pou8
 XSySfr+OFvSFrU7V9EU0cRjSrolKF6hdG6eCk=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20130820;
 h=x-gm-message-state:mime-version:in-reply-to:references:from:date
 :message-id:subject:to:cc:content-type;
 bh=LdqQ9vLWK3ZQUFQprmYsf5ECABeRtmNbiyQxSbRWAYc=;
 b=Nq5O5mzdxcpKdsO2t3Eps5s5fO+v9grhGFP/NCWGkZh+GVqq5K54VmjHfP7aaWzz2K
 nk6e9opERyTvlSf6GOfGAKXdsm3GiEowf7hxbb4NsO6s+FIi5MuWJvhB84r93PE2c4OX
 wZqgRp4vy7FEtkqnG5q0paf4wMttfKvMdJ2eHH8NGnhN3QcjQTIaF55TmtpJ2Gir0tMA
 9jFXeAFNNbzWF3SE322zALAy/UDTimkekxwdyrbt/2j+pcQ7nUkvOFZgEuyQVjhnGkl8
 9zYHAAxWYuXMAzH2sOTCRzuB/zWUnNF+iz1lQJr5H0Evex+c6uiI9yCRKe3/82fCgLJM
 SdyQ==
X-Gm-Message-State: ALoCoQkFuW16D0b8Nf6delzINVN391rUSmgDBXdRw2WdB6vgeCkjJwUqJ34rtmTENNg6mEkoiK86
X-Received: by 10.224.171.195 with SMTP id i3mr2677128qaz.44.1404352087847;
 Wed, 02 Jul 2014 18:48:07 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.96.88.132 with HTTP; Wed, 2 Jul 2014 18:47:37 -0700 (PDT)
In-Reply-To: <53B4A337.3010907@obluda.cz>
References: <53B499B1.4090003@delphij.net> <53B4A337.3010907@obluda.cz>
From: Eitan Adler <lists@eitanadler.com>
Date: Wed, 2 Jul 2014 18:47:37 -0700
Message-ID: <CAF6rxgkhXtXCjWGpbcm0UU3Rr57dXJojQJ05Rqe-sQ_Nmyp8KQ@mail.gmail.com>
Subject: Re: RFC: Proposal: Install a /etc/ssl/cert.pem by default?
To: Dan Lukes <dan@obluda.cz>
Content-Type: text/plain; charset=UTF-8
Cc: freebsd-security@freebsd.org, d@delphij.net, gecko@freebsd.org
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Jul 2014 01:48:09 -0000

On 2 July 2014 17:26, Dan Lukes <dan@obluda.cz> wrote:
> On 07/03/14 01:45, Xin Li:
>
>> 1. Import a set of trusted root certificates
>
>
>
> Question is imminent ...
>
> Trusted by whom ?

IMHO, it is sane to follow the same policy that Mozilla follows and to
use their root store by default.

> If I consider a CA to be trustworthy, I will insert it's certificate to
> trusted store. No one is welcomed to make such decision in behalf of me.

So remove or edit the defaults.


As for #4: I'm not sure I like the port touching the base system (even
with an option) but I don't see a real alternative.


-- 
Eitan Adler