Re:OpenBSD won't update Firefox, advises users to switch to ESR
by tialaramex on Sunday January 12, 2020 @10:35AM
(#22026712)
I ran into Pale Moon years ago when Let's Encrypt was started and that experience gives an adequate flavour of their approach to security.
The up shot is Pale Moon's maintainers decided they don't trust Let's Encrypt for spurious reasons. But if you use Pale Moon you've probably never noticed this because Let's Encrypt is cross-signed, and so even though Pale Moon claims not to trust them, the cross-signature makes everything still work because they didn't intervene.
So that's a bad decision, combined with total incompetence to produce the appearance where everything looks fine.
That's exactly the sort of thing in a browser that should make people run away screaming.
In the years that followed Pale Moon wanted to keep StartSSL (the outfit which straight up lied to us about issuing clearly bogus certificates for money, Pale Moon's maintainers apparently feel that this shows "integrity") and described Mozilla's distrust decision as a "foot gun". How did that work out? Oh right, it turns out that everybody else doesn't trust liars either and so Pale Moon eventually went along with this because as others explained in practice they're mostly just applying patches blind to core Firefox subsystems like NSS.
The up shot is Pale Moon's maintainers decided they don't trust Let's Encrypt for spurious reasons. But if you use Pale Moon you've probably never noticed this because Let's Encrypt is cross-signed, and so even though Pale Moon claims not to trust them, the cross-signature makes everything still work because they didn't intervene.
So that's a bad decision, combined with total incompetence to produce the appearance where everything looks fine.
That's exactly the sort of thing in a browser that should make people run away screaming.
In the years that followed Pale Moon wanted to keep StartSSL (the outfit which straight up lied to us about issuing clearly bogus certificates for money, Pale Moon's maintainers apparently feel that this shows "integrity") and described Mozilla's distrust decision as a "foot gun". How did that work out? Oh right, it turns out that everybody else doesn't trust liars either and so Pale Moon eventually went along with this because as others explained in practice they're mostly just applying patches blind to core Firefox subsystems like NSS.