<story><title>Changes to Trusted Certificate Authorities in Android Nougat</title><url>https://android-developers.blogspot.com/2016/07/changes-to-trusted-certificate.html</url></story><parent_chain></parent_chain><comment><author>userbinator</author><text>...and so it begins...&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=9078741&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=9078741&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=9078762&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=9078762&lt;/a&gt;&lt;p&gt;I am not exactly surprised, but it is very sad to see, because what happens on locked-down mobile platforms, desktops seem to follow sooner or later. You can argue that power users and developers will always find ways around it, but what this does is effectively remove one more little bit of that freedom which lets users discover what their devices are actually doing, and I think that is a &lt;i&gt;very&lt;/i&gt; bad thing in the long term.&lt;p&gt;Much of my knowledge about how computers work in various ways has been gained through exploring creatively and inspecting what things do. I use a MITM proxy on my PC that blocks ads, tracking, and rewrites webpages to my preference. I learned a lot of HTTP, HTML, and CSS just from doing that. But maybe that is exactly what those in power do not want --- users who can think and investigate things for themselves --- because such users are not easy to control.</text></comment>
<story><title>Changes to Trusted Certificate Authorities in Android Nougat</title><url>https://android-developers.blogspot.com/2016/07/changes-to-trusted-certificate.html</url></story><parent_chain></parent_chain><comment><author>pdkl95</author><text>Taking away the user&amp;#x27;s ability to manage their own security should bring with it the responsibility - and &lt;i&gt;liability&lt;/i&gt; - for any problems that derive from the imposed settings.&lt;p&gt;The paternalistic attitude that users are &lt;i&gt;and always will be&lt;/i&gt; ignorant is not only offensive. it is counterproductive. Security is not a product, and keeping people ignorant of the trust models they are relying on is a recipe for disaster in the long-term.&lt;p&gt;Instead of pretending that users are always going to be ignorant of security and incapable of learning, the UI should be extended to make the chain-of-trust more visible in a way that helps the users understand their security situation.&lt;p&gt;Instead of pretending that one security model fits all situations, &lt;i&gt;more&lt;/i&gt; control needs to be given &lt;i&gt;and taught&lt;/i&gt; to the user, in a way that actually allows them to make decisions about their security situation.</text></comment>