5 ms·

> Because they don't want to do business with a criminal. I don't either, most of the time. But verifying a certificate is the equivalent of checking someone'

> Because they don't want to do business with a criminal. I don't either, most of the time. But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. It doesn't tell me whether someone is a criminal, nor do I expect it to. If it's that important to me, I'll check their ID and then head to the county courthouse to check public records before agreeing to anything. Whether someone is a criminal, what kind of criminal, and how recently are both too much data and too perishable and uncertain to put on someone's ID card. Which is why that's not done in most (any?) jurisdictions.

ikeboy 11y ago
>But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. But CAs aren't government entities (well, some are, but that's besides the point). There's no right to get a cert. This is the equivalent of a private company issuing ID cards, and deciding that they'll stop issuing cards to anyone who uses the cards for illegal activities.
- jqm 11y ago
  You keep making it out like they suspended individual certs. That would have been bad enough but it isn't what happened. They revoked all certs including those they had previously sold (with certain implied expectations) to people (such as myself) who were not engaged in any illicit activity. They didn't even inform me before hand and I only found out when clients were unable to conduct their business through my app. I actually had to track the source of the problem down... because they were too lazy to inform me after being too lazy to only suspend offending certs in the first place and inconsiderate enough of their commitments and my business to honer the certs for the period they had taken money for rather than simply declining to further sell certs for this TLD. It caused me a good deal of hassle. Not enough of a hassle to sue, that isn't an option, but what they did is quite egregious and is, at very minimum laziness and bad business and up a level unethical and borderline scummy. They might, by some twisted definition, have a legal "right" to do this but they are still assholes and people should probably refrain from doing business with them.
  - ikeboy 11y ago
    When I say "this", I mean what I asked above: "If a site is blatantly criminal, should a CA revoke its cert?" That is the question I am debating. I agree that what was actually done is wrong. See https://news.ycombinator.com/item?id=10183619 https://news.ycombinator.com/item?id=10183619, my previous response along these lines.
- fredkbloggs 11y ago
  There are no illegal activities involved here, because none of these certificates have been revoked following a criminal conviction related to their use. Nearly all developed Western countries have judicial systems that presuppose innocence until proven otherwise in a competent criminal court following established procedures. It seems like your cultural background is very different from that, which is why we're not communicating well. In my culture, asserting that someone was doing something illegal means that the person has been convicted by a criminal court with respect to that act. In many systems, saying that someone was doing something illegal without either a conviction or bearing witness under oath to the allegedly criminal act is itself a crime, that of slander or libel. It seems that you are using a very different definition, one that I don't understand. While I know little of Palau's legal traditions, in this case both the CA and its customer had no ties to Palau, and their business relationship was not governed by its laws. So even if that country and its legal culture does not follow the same principles as mine, it's not relevant to this case. Perhaps that's the confusion here?
  - ikeboy 11y ago
    >Nearly all developed Western countries have judicial systems that presuppose innocence until proven otherwise in a competent criminal court following established procedures. It seems like your cultural background is very different from that, which is why we're not communicating well. This is a legal presumption of innocence. It doesn't mean the actions are legal. When I say "illegal", I mean "breaks a law". This has nothing to do with cultures as far as I know; I'm an American citizen. Whether you can tell if someone broke the law is a different question. Let me ask you directly: if someone were to rob a bank and never get caught, did they do something illegal? If not, how would you express the claim that they did something against the law?
    - fredkbloggs 11y ago
      > Let me ask you directly: if someone were to rob a bank and never get caught, did they do something illegal? No conviction, no crime. I could, however, state that the bank was most likely robbed based on nothing more than accounting information. There's a crucial difference between stating that something happened and accusing a specific person of a criminal act. > If not, how would you express the claim that they did something against the law? As a witness to an act, I would state the facts as I observed them, without passing judgment myself. This is exactly what's done in court. "At time X I was at location Y, and I saw a person with features Z enter the bank, pass a piece of paper to a teller, and run out of the bank shortly thereafter with what appeared to be cash. I believe that person to be the defendant, who is sitting there (points)." The testimony of non-expert witnesses is limited to facts, not opinions. Because for all I know, the note could have been a valid withdrawal slip, the customer may have been in a hurry, and the money was actually stolen by a teller and an accomplice who used the rushed customer's large withdrawal as a cover (was the customer an accomplice? I don't know!). If I were not a witness, I wouldn't make such a claim in the first place.
- Dylan16807 11y ago
  If they use a legitimate and accurate ID card that I issued while they committed a crime, I'm not sure why I would be upset about it. All the easier to track them down. It's an ID card, not a seal of approval. You can copy seal of approval gifs without anyone's help.
  - deleted 11y ago
    [deleted]
- bandrami 11y ago
  > But CAs aren't government entities All the more reason that they have no particular responsibility to revoke certificates of "criminals". We've absolutely got to get rid of the idea that a certificate is any sort of measure of probity. It isn't. It's simply a verification of identity.

ikeboy 11y ago

>But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. But CAs aren't government entities (well, some are, but that's besides the point). There's no right to get a cert. This is the equivalent of a private company issuing ID cards, and deciding that they'll stop issuing cards to anyone who uses the cards for illegal activities.

jqm 11y ago
You keep making it out like they suspended individual certs. That would have been bad enough but it isn't what happened. They revoked all certs including those they had previously sold (with certain implied expectations) to people (such as myself) who were not engaged in any illicit activity. They didn't even inform me before hand and I only found out when clients were unable to conduct their business through my app. I actually had to track the source of the problem down... because they were too lazy to inform me after being too lazy to only suspend offending certs in the first place and inconsiderate enough of their commitments and my business to honer the certs for the period they had taken money for rather than simply declining to further sell certs for this TLD. It caused me a good deal of hassle. Not enough of a hassle to sue, that isn't an option, but what they did is quite egregious and is, at very minimum laziness and bad business and up a level unethical and borderline scummy. They might, by some twisted definition, have a legal "right" to do this but they are still assholes and people should probably refrain from doing business with them.
- ikeboy 11y ago
  When I say "this", I mean what I asked above: "If a site is blatantly criminal, should a CA revoke its cert?" That is the question I am debating. I agree that what was actually done is wrong. See https://news.ycombinator.com/item?id=10183619 https://news.ycombinator.com/item?id=10183619, my previous response along these lines.
fredkbloggs 11y ago
There are no illegal activities involved here, because none of these certificates have been revoked following a criminal conviction related to their use. Nearly all developed Western countries have judicial systems that presuppose innocence until proven otherwise in a competent criminal court following established procedures. It seems like your cultural background is very different from that, which is why we're not communicating well. In my culture, asserting that someone was doing something illegal means that the person has been convicted by a criminal court with respect to that act. In many systems, saying that someone was doing something illegal without either a conviction or bearing witness under oath to the allegedly criminal act is itself a crime, that of slander or libel. It seems that you are using a very different definition, one that I don't understand. While I know little of Palau's legal traditions, in this case both the CA and its customer had no ties to Palau, and their business relationship was not governed by its laws. So even if that country and its legal culture does not follow the same principles as mine, it's not relevant to this case. Perhaps that's the confusion here?
- ikeboy 11y ago
  >Nearly all developed Western countries have judicial systems that presuppose innocence until proven otherwise in a competent criminal court following established procedures. It seems like your cultural background is very different from that, which is why we're not communicating well. This is a legal presumption of innocence. It doesn't mean the actions are legal. When I say "illegal", I mean "breaks a law". This has nothing to do with cultures as far as I know; I'm an American citizen. Whether you can tell if someone broke the law is a different question. Let me ask you directly: if someone were to rob a bank and never get caught, did they do something illegal? If not, how would you express the claim that they did something against the law?
  - fredkbloggs 11y ago
    > Let me ask you directly: if someone were to rob a bank and never get caught, did they do something illegal? No conviction, no crime. I could, however, state that the bank was most likely robbed based on nothing more than accounting information. There's a crucial difference between stating that something happened and accusing a specific person of a criminal act. > If not, how would you express the claim that they did something against the law? As a witness to an act, I would state the facts as I observed them, without passing judgment myself. This is exactly what's done in court. "At time X I was at location Y, and I saw a person with features Z enter the bank, pass a piece of paper to a teller, and run out of the bank shortly thereafter with what appeared to be cash. I believe that person to be the defendant, who is sitting there (points)." The testimony of non-expert witnesses is limited to facts, not opinions. Because for all I know, the note could have been a valid withdrawal slip, the customer may have been in a hurry, and the money was actually stolen by a teller and an accomplice who used the rushed customer's large withdrawal as a cover (was the customer an accomplice? I don't know!). If I were not a witness, I wouldn't make such a claim in the first place.
Dylan16807 11y ago
If they use a legitimate and accurate ID card that I issued while they committed a crime, I'm not sure why I would be upset about it. All the easier to track them down. It's an ID card, not a seal of approval. You can copy seal of approval gifs without anyone's help.
- deleted 11y ago
  [deleted]
bandrami 11y ago
> But CAs aren't government entities All the more reason that they have no particular responsibility to revoke certificates of "criminals". We've absolutely got to get rid of the idea that a certificate is any sort of measure of probity. It isn't. It's simply a verification of identity.