>Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates
https://arstechnica.com/security/2014/07/emergency-windows-u...
They revoked certs like this silently in the past which makes it even worse.
I'm not a Windows user, haven't been a Windows user since 2001, my AV experience has been with the PCs of my family, whom I'm trying to keep safe.
But even if I were a Windows user, if you can't trust Microsoft, you can't trust their OS, at which point it would be better to use something else because security really depends on how trustworthy that OS and its vendor are. I do trust Microsoft more than I trust an AV vendor though.
>As far as I've seen, there was nothing sinister in default Windows root CA list.
Are you in any way related to MS or is your memory just very short?
>Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates
https://arstechnica.com/security/2014/07/emergency-windows-u...
I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).