@mjg59 it feels like we _could_ have something similar if everything had proper OCSP support, but I know that might be a big "if"

@mjg59 isn't the main problem software that bundles their own roots?

I think there should be a couple of alternatives to FUSE anyway.

@mjg59 cc: @dalias xD

@mjg59 What do you gain with a daemon that serves an up-to-date file via FUSE, rather than a daemon that updates a regular file on disk?

@nicolas17 it lets you give a different view per application, if that's a thing you want

@tris @mjg59 It's cute but I don't see how it's any more convenient than just updating /etc/ssl. The problem is not that updating files is hard but that stuff that should not be bundling *user/administrator trust policy* into software is doing so.

@tris @mjg59 Like for fixing the Docker problem, the solution is not FUSE but bind-mounting the host /etc/ssl over the guest /etc/ssl. 🙃 I imagine there's a similar fix for python venvs, etc.

@dalias @tris it doesn't happen on distro update cadence

@mjg59 @tris There's no reason /etc/ssl should be updated by a distro update workflow. It's trust policy configuration, not code. You can have a system for the user to keep it updated from whatever upstream they trust, and have that update policy do things like only allow removal of trust not addition of trust except with the user or something major like a distro-upgrade signing off on it.

@dalias @tris you could, and that's not how distros do things, and it is easier to solve this social problem through technical means