Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Certificate Manager does not display the complete trust list

hexatomium.github.io

Post reply on HN
Print view View original

71–80 of 103 posts

Re: Windows Certificate Manager does not display the complete trust list

#71

Post by TazeTSchnitzel »

nailer wrote: post #63
TazeTSchnitzel wrote: post #6

Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected. This is just a UI failure.

So roots are dynamically fetched and this is the list of previously fetched roots? Or is it a revocation check before first use? Do you have a link?

> So roots are dynamically fetched and this is the list of previously fetched roots?

Precisely. Windows comes with a small number of roots pre-installed. I can't remember which they are, I assume it's probably just Microsoft's own, one of which is presumably used to check roots fetched later. When you browse the web with a browser that uses Windows's certificate store, it'll fetch other roots as needed.

Interestingly, this might be a security benefit. If you'd never visited a site using a revoked root, you never had the root in the first place.

Re: Windows Certificate Manager does not display the complete trust list

#73

Post by cryptophreak »

chc wrote: post #69
KC8ZKF wrote: post #64

Earlier quoted context omitted.

In English, nouns can be used as adjectives. e.g. School bus, ticket office, computer mouse, apologist answer. "Apologetic" has connotations of regret. I think this confusion might lead some people to take "apologist" as a derogatory or inflammatory word, when it shouldn't be. https://en.wikipedia.org/wiki/Christian_apologetics https://en.wikipedia.org/wiki/Apologia

When you use a noun referring to a person to modify another noun, it will generally be taken to mean "belonging or related to such a person." For example, "school teacher salaries" means salaries belonging to school teachers. Similarly, the phrase "apologist comment" naturally reads as "a comment belonging to an apologist." And I don't think it's the connotations of regret that lend the term "apologist" its negative…

This is the least useful conversation I have seen all day.

Re: Windows Certificate Manager does not display the complete trust list

#74

Post by brazzledazzle »

mattkrea wrote: post #70
skrebbel wrote: post #68

Earlier quoted context omitted.

Hmm, I think it's a very elegant design, probably built to precisely address the problem you asked about. Update server manages whitelist, user/admin manages blacklist, which wins. Nice!

I prefer the situation on Linux where I don't have the certificate at all rather than getting the certificate and having to mark it untrusted. Edit: I'm referring to configuring the package as ca-certificates is installed or via dpkg-reconfigure

Correct me if I'm wrong, but don't several distros come with pre-packaged root CAs?

Re: Windows Certificate Manager does not display the complete trust list

#75

Post by brazzledazzle »

tptacek wrote: post #37
UnoriginalGuy wrote: post #32

Earlier quoted context omitted.

The problem with your argument is that this is an administrative GUI that isn't even normally presented to end users unless you search for it or know how MMC snap-ins work. It is a power-user interface by all measure. And while Microsoft does simplify UIs for end users, they don't typically do the same for administrative content (just look at anything in the Admin Tools, or MMC snap-ins, no sugar coating there). Your…

Please don't call commenters "apologists" on HN.

I flagged it for what it's worth.

Re: Windows Certificate Manager does not display the complete trust list

#76

Post by brazzledazzle »

TillE wrote: post #39
tptacek wrote: post #37

Earlier quoted context omitted.

Please don't call commenters "apologists" on HN.

It's an objective term (a defender of something controversial), unlike "linkbait" or "bashing" for example.

It may have an objective definition but I don't think I've ever heard it used in a way that didn't have a connotation like this from chc:

"The negative connotation of that word is the implication that you are bound and determined to defend some position and will not be moved — stemming from its roots of defending literal dogma. People take it to mean a sort of closed-minded, blind tribalism."

Re: Windows Certificate Manager does not display the complete trust list

#77

Post by uxp »

brazzledazzle wrote: post #74
mattkrea wrote: post #70

Earlier quoted context omitted.

I prefer the situation on Linux where I don't have the certificate at all rather than getting the certificate and having to mark it untrusted. Edit: I'm referring to configuring the package as ca-certificates is installed or via dpkg-reconfigure

Correct me if I'm wrong, but don't several distros come with pre-packaged root CAs?

I think the idea the parent is trying to express is that if the Linux distro (and OS X in this situation) comes with the root certificate trusted by default via ca_root_nss/ca-bundle or whatever the packager decides to name it they can disable it before even connecting to the internet, and if the certificate is not trusted by default then they don't need to worry about it magically getting trusted in the future outside of the simple fact of updating the root certificate store blindly without inspecting it.

Microsoft's approach means that the user would have to go find the certificate on the internet and blacklist it explicitly, which allows a small window where the computer is vulnerable to some kind of attack involving a certificate signed by the unwanted authority.

Re: Windows Certificate Manager does not display the complete trust list

#78

Post by merb »

philliphaydon wrote: post #5
philtar wrote: post #3

Earlier quoted context omitted.

1) Because MSFT provides great corporate support for desktops. Keyword: great. Not good. Great. 2) Because people are used to it. 3) Because Office products are the de facto standard, and they run best on windows. I could go on, but you get the point.

Everyone talks about how great the alternatives for office are. Buy they are good. Not great. Even office word online is better than Google docs.

Comparing Google Docs to MS Office oh god. I mean i always found Google Docs and Word Online aweful, mostly I need Docs Offline. There aren't many times where I need them only or need Collaboration and even for that there would be lots of Toolings. Libre Office should be compared and if you are a Office 2003 User you wouldn't have a hard time to go to LibreOfice. Also on Mac LibreOffice is really really lightweight compared to MS Office. Okai there are two things missing, which are used a lot. One is Excels preinstalled Table formats (on LibreOffice you need to define all of them by yourself, so no quick design). And second you can't easily migrate Mail Merge Docs from Office to LibreOffice.

Re: Windows Certificate Manager does not display the complete trust list

#79

Post by cm2187 »

UnoriginalGuy wrote: post #32
brudgers wrote: post #17

One feature of Windows is defaulting to not showing messy complexity to the user. The other feature is defaulting to backward compatibility. Combined, this means that Windows often has more than two data stores for some aggregate feature [e.g. web browser security, software configuration etc.] as new versions of Windows implement these features in more robust ways. So yeah there are two or more places where certifica…

The problem with your argument is that this is an administrative GUI that isn't even normally presented to end users unless you search for it or know how MMC snap-ins work. It is a power-user interface by all measure. And while Microsoft does simplify UIs for end users, they don't typically do the same for administrative content (just look at anything in the Admin Tools, or MMC snap-ins, no sugar coating there). Your…

How is a partial list of root certificates less messy than a full list?

Re: Windows Certificate Manager does not display the complete trust list

#80

Post by deathanatos »

zxcvcxz wrote: post #8
philliphaydon wrote: post #5

Earlier quoted context omitted.

Everyone talks about how great the alternatives for office are. Buy they are good. Not great. Even office word online is better than Google docs.

What is "better" about MS word than google docs? The only reason I see to use word is if you're using files from 1999 that don't work anywhere else. Google docs is a much simpler system, especially for places like schools because of the "cloud" nature of it. Google docs has all the features the average person needs. MSWord is for specialty cases, google docs and the open alternatives are for everyone else. I'm about…

Any sort of styling control: if there's a particular style I want applied to certain portions, I have to recreate it at each use. God help me if I decide to change it halfway through the document.

Orphaning of content: GDocs will very happily strand a section header at the bottom of a page, dropping a page break right between the header and the content.

The cursor will occasionally just go where it pleases.

Revision history (compared to diffing git commits) is incredibly frustrating. Click on a revision, read the whole doc, repeat…

As a sibling says,

> Oh and typography.

Post reply on HN