Andrea Barisani wrote: > On Mon, Jan 09, 2006 at 11:08:38AM -0500, solar wrote: > >>On Mon, 2006-01-09 at 16:55 +0100, Andrea Barisani wrote: >> >>>Regarding the inclusion of ca-certificates as a PDEPEND (yeah a brief >>>exchange of emails already happened on -dev but since it's not so easy to >>>track it I'm lagging behind on this) I would like to express that I really >>>don't like the fact that we are "trusting" cacert.org certs (among others) >>>without providing it as a choice. >>> >>>Despite all the political views that we can throw in favour of a "cacert.org >>>are trying to make the SSL certs world less evil" argument this is some major >>>policy that we are supporting and it shouldn't be taken that lightly (I don't >>>remember such a major confrontation about this) and I really don't think this >>>should be a default policy but rather user's choice. Technically cacert.org >>>is not a recognized CA in the "proper" way (and don't point that a proper CA >>>is a lame concept and a snake oil thing..this is not the point). >> >>>[CCing [EMAIL PROTECTED] because this concerns the team as well imho.] >>> >>>Just my 2 eurocent. >>> >>>P.S. >>>I know that firefox doesn't trust /etc/ssl/certs by default, dunno about >>>konqueror. The point is still relevant though. >> >> >>Do you think the PDEPEND of the ca-certs should be tied to a USE= flag? >>If so should it be a 'no*certs' flag or a USE=cacerts ? > > > USE=cacerts sounds the proper course of action to me.
I was just `emerge world -vDatu --newuse` on some ~x86 boxen and I saw the new (at least to me) cacert ebuild getting pulled. Although, I support cacert.org and use it occasionally, I also think making it the default is a bit too quick for now. Making it a useflag might be better. Are there any other packages like cacert now? Didn't see any, but time will tell. Might be a better solution to have a more general ebuild that installs CA certs and it will have different (local) useflags. Just my 2 non-dev Japanese yen :-) Kalin. -- |[ ~~~~~~~~~~~~~~~~~~~~~~ ]| +-> http://ThinRope.net/ <-+ |[ ______________________ ]| -- [email protected] mailing list
