4 ms·

A: Seems like they got it wrong here if that was indeed their reason. That alone is good enough to say no. B: Criminal for who? I certainly don't want Geotrust

A: Seems like they got it wrong here if that was indeed their reason. That alone is good enough to say no. B: Criminal for who? I certainly don't want Geotrust deciding what's allowed. Does that mean they can e.g. block sites donating to Wikileaks?

ikeboy 11y ago
B: criminal in that country. If donating to Wikileaks was declared illegal in the US (it hasn't), then I'd be fine with Geotrust revoking certs for websites blatantly violating that.
- meric 11y ago
  What if it is declared illegal by the DOJ and declared legal by one of the lower level courts, and there is an appeal by the DOJ? Is it legal or illegal then?
  - ikeboy 11y ago
    There's a reason I said "blatantly illegal". If there's a dispute, it's not blatant.
- thanksgiving 11y ago
  Does Geotrust then accept full legal responsibility of guaranteeing that the contents of a site is legal in the US? If we find cp on a site with a Geotrust SSL certificates, will we send the Geotrust board to prison for it? If the answer is no, then they cannot do what you said.
  - ikeboy 11y ago
    If the answer is no, then they cannot do what you said. Uh, no. Plenty of companies already censor certain content without accepting liability for parts that they miss. There is no law preventing a company from not hosting content they find problematic, whether it's illegal or for any other reason. That doesn't give up their protection under DMCA. (CAs wouldn't even need DMCA, because they aren't hosting content or redistributing it). Similarly, there is no law I know of that would disallow a CA from revoking a cert they issued. Maybe breach of contract, but generally their terms will prohibit illegal activities, so the other side will have breached contract first.
    - thanksgiving 11y ago
      Do you think it should be legal for a fictional company called Goober to pay the CA for its fictional competitor Drift so that the CA revokes certificates "in the interest of public safety while the CA expeditiously researches the issue" within 10 to 15 business days?
      - ikeboy 11y ago
        If the website did not do anything wrong, they can sue for breach of contract. I explicitly addressed this point in my above comment.
        thanksgiving 11y ago
        So maybe the CA should not proactively do anything but rather await a court order to disrupt their customer's service? I would be completely OK with disruption if service after a court order that requires it. I am not OK with proactive and speculative shutdown of service (even with "infallible" evidence, it still remains proactive and speculative until the clients are proven guilty of illegal activities in court). ikeboy 3 minutes ago > I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever. > If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to? I'd tell them that I'm not responsible for what my clients do or don't do. The CA root supply isn't big enough for the Free market to do is job by itself.
        ikeboy 11y ago
        I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever. If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to? >I'd tell them that I'm not responsible for what my clients do or don't do. Hm, I wonder how well the media will take that ...
- jqm 11y ago
  Maybe people shouldn't sell cell phones to drug dealers. But what Geotrust did was suspend all cell phones for a certain block of people. In my case, this caused me extra effort and is black mark on clients trust for me. This might be like disabling every minorities cell phone which they legitimately paid for because some minorities used the phones to arrange drug deals. It truly is ridiculous. How about phone sellers just sell phones? We have other agencies tasked with catching drug dealers. Never mind I was able to get a new cert from Commodo and was back in action anyway so at most they have annoyed and inconvenienced some folks.
  - ikeboy 11y ago
    I understand, and I'm not defending them. But the comment I originally replied to was going too far in the opposite direction, and saying CAs should never intercede. Maybe people shouldn't sell cell phones to drug dealers. There's no easy way to implement such a policy. There's an easy way to implement a policy of "revoke blatantly criminal websites that get reported to us".
    - deleted 11y ago
      [deleted]
    - MichaelGG 11y ago
      CAs should never intercede without a court order. That's how societies determine what is illegal: we let judges and courts sort it out. Otherwise you're making CAs ad-hoc courts which is a bad thing to do. It provides excuses to refuse to issue certificates based on how they feel. If a site is "blatantly criminal" then it should be an easy thing to get a court to agree and issue an action against them. I'm surprised that CA guidelines even allow CAs to take website content into issuing procedures.
      - ikeboy 11y ago
        >CAs should never intercede without a court order. Are you proposing a law to ban this? Would this apply to any company deciding not to do business with a customer for legal reasons? >It provides excuses to refuse to issue certificates based on how they feel. A CA is perfectly within its rights to do that, though! As far as I know, no law obligates CAs to serve everyone.

ikeboy 11y ago

B: criminal in that country. If donating to Wikileaks was declared illegal in the US (it hasn't), then I'd be fine with Geotrust revoking certs for websites blatantly violating that.

meric 11y ago
What if it is declared illegal by the DOJ and declared legal by one of the lower level courts, and there is an appeal by the DOJ? Is it legal or illegal then?
- ikeboy 11y ago
  There's a reason I said "blatantly illegal". If there's a dispute, it's not blatant.
thanksgiving 11y ago
Does Geotrust then accept full legal responsibility of guaranteeing that the contents of a site is legal in the US? If we find cp on a site with a Geotrust SSL certificates, will we send the Geotrust board to prison for it? If the answer is no, then they cannot do what you said.
- ikeboy 11y ago
  If the answer is no, then they cannot do what you said. Uh, no. Plenty of companies already censor certain content without accepting liability for parts that they miss. There is no law preventing a company from not hosting content they find problematic, whether it's illegal or for any other reason. That doesn't give up their protection under DMCA. (CAs wouldn't even need DMCA, because they aren't hosting content or redistributing it). Similarly, there is no law I know of that would disallow a CA from revoking a cert they issued. Maybe breach of contract, but generally their terms will prohibit illegal activities, so the other side will have breached contract first.
  - thanksgiving 11y ago
    Do you think it should be legal for a fictional company called Goober to pay the CA for its fictional competitor Drift so that the CA revokes certificates "in the interest of public safety while the CA expeditiously researches the issue" within 10 to 15 business days?
    - ikeboy 11y ago
      If the website did not do anything wrong, they can sue for breach of contract. I explicitly addressed this point in my above comment.
      - thanksgiving 11y ago
        So maybe the CA should not proactively do anything but rather await a court order to disrupt their customer's service? I would be completely OK with disruption if service after a court order that requires it. I am not OK with proactive and speculative shutdown of service (even with "infallible" evidence, it still remains proactive and speculative until the clients are proven guilty of illegal activities in court). ikeboy 3 minutes ago > I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever. > If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to? I'd tell them that I'm not responsible for what my clients do or don't do. The CA root supply isn't big enough for the Free market to do is job by itself.
        ikeboy 11y ago
        I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever. If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to? >I'd tell them that I'm not responsible for what my clients do or don't do. Hm, I wonder how well the media will take that ...
jqm 11y ago
Maybe people shouldn't sell cell phones to drug dealers. But what Geotrust did was suspend all cell phones for a certain block of people. In my case, this caused me extra effort and is black mark on clients trust for me. This might be like disabling every minorities cell phone which they legitimately paid for because some minorities used the phones to arrange drug deals. It truly is ridiculous. How about phone sellers just sell phones? We have other agencies tasked with catching drug dealers. Never mind I was able to get a new cert from Commodo and was back in action anyway so at most they have annoyed and inconvenienced some folks.
- ikeboy 11y ago
  I understand, and I'm not defending them. But the comment I originally replied to was going too far in the opposite direction, and saying CAs should never intercede. Maybe people shouldn't sell cell phones to drug dealers. There's no easy way to implement such a policy. There's an easy way to implement a policy of "revoke blatantly criminal websites that get reported to us".
  - deleted 11y ago
    [deleted]
  - MichaelGG 11y ago
    CAs should never intercede without a court order. That's how societies determine what is illegal: we let judges and courts sort it out. Otherwise you're making CAs ad-hoc courts which is a bad thing to do. It provides excuses to refuse to issue certificates based on how they feel. If a site is "blatantly criminal" then it should be an easy thing to get a court to agree and issue an action against them. I'm surprised that CA guidelines even allow CAs to take website content into issuing procedures.
    - ikeboy 11y ago
      >CAs should never intercede without a court order. Are you proposing a law to ban this? Would this apply to any company deciding not to do business with a customer for legal reasons? >It provides excuses to refuse to issue certificates based on how they feel. A CA is perfectly within its rights to do that, though! As far as I know, no law obligates CAs to serve everyone.