3 ms·

If that's the only alternative to what's happening today, yes. It's not a practical solution, because there are many reasons a supplier might not want a partic

If that's the only alternative to what's happening today, yes. It's not a practical solution, because there are many reasons a supplier might not want a particular piece of business, some of which are not harmful (lack of resources, customer with dubious credit, etc). But the arrogance of prejudging the law is very dangerous to free expression, especially when the vendor is a monopolist or oligopolist, as is the case with CAs. That danger is multiplied further when the scope of the judgment is widened beyond whether the vendor's (always overly conservative) lawyers suggest the company might be liable as a criminal accomplice if it accepted the business. It's becoming quite common for corporations to refuse to serve any customer, or to employ any person, that is not 100% inoffensive to 100% of the population. The slightest hint of controversy or any public (or often, sadly, private) statement that falls outside the Overton Window will result in being cut off. If you ask a corporate lawyer whether serving a particular customer is risky, you will always be told yes, no matter who it is. So allowing their involvement in that decision is problematic, regardless of the nominal reason offered for turning away business. I don't know whether that's what happened here, because we don't have any kind of announcement, just an anecdote and some supposition. But I would be willing to take some pretty strong measures to make sure it can't. Extending common-carrier status to CAs would be a very modest and narrow place to start, but I would take this much farther, to the very outer edge of what's practical. The world is a horribly stifling place as it is; we don't need corporations contributing to the problem, especially since they are ill-equipped to determine whether something is illegal and will invariably default to the most conservative position.

ikeboy 11y ago
especially when the vendor is a monopolist or oligopolist, as is the case with CAs. There are hundreds of CAs. It's one of the least monopolist businesses in that regard. As to your other points, have you seen http://slatestarcodex.com/2015/07/22/freedom-on-the-centralized-web/ http://slatestarcodex.com/2015/07/22/freedom-on-the-centrali...? It makes a similar point IMO.
- fredkbloggs 11y ago
  I missed that article; thanks for the pointer. They mentioned several of the examples I had in mind as I was writing about this. In the future I'll just link to that. As for how many CAs there are, it's certainly true that there are zero barriers to entry. All you need is some open source software and a couple of shell scripts. But in order to be an effective CA, you need all the major browser and OS vendors (at a minimum) to ship your root certificate in a trusted-by-default configuration. Otherwise almost no one is going to have their certificates issued by you. Looking at the list of CAs trusted by Firefox and Apple, to name but two, there aren't really that many. A couple dozen, of which many are governmental entities that don't serve the general public. I'm sure if I looked at Microsoft's and Red Hat's and Google's I would find the intersection dwindling to the same old handful we've been stuck with for years. If it were really that simple to be an effective CA, there would be thousands of them, including many that might not even charge a fee as long as you're a member of a particular club, or that would be explicit about providing an authentication-only service. But there aren't, and that takes us back to the same problem.

ikeboy 11y ago

especially when the vendor is a monopolist or oligopolist, as is the case with CAs. There are hundreds of CAs. It's one of the least monopolist businesses in that regard. As to your other points, have you seen http://slatestarcodex.com/2015/07/22/freedom-on-the-centralized-web/ http://slatestarcodex.com/2015/07/22/freedom-on-the-centrali...? It makes a similar point IMO.

fredkbloggs 11y ago
I missed that article; thanks for the pointer. They mentioned several of the examples I had in mind as I was writing about this. In the future I'll just link to that. As for how many CAs there are, it's certainly true that there are zero barriers to entry. All you need is some open source software and a couple of shell scripts. But in order to be an effective CA, you need all the major browser and OS vendors (at a minimum) to ship your root certificate in a trusted-by-default configuration. Otherwise almost no one is going to have their certificates issued by you. Looking at the list of CAs trusted by Firefox and Apple, to name but two, there aren't really that many. A couple dozen, of which many are governmental entities that don't serve the general public. I'm sure if I looked at Microsoft's and Red Hat's and Google's I would find the intersection dwindling to the same old handful we've been stuck with for years. If it were really that simple to be an effective CA, there would be thousands of them, including many that might not even charge a fee as long as you're a member of a particular club, or that would be explicit about providing an authentication-only service. But there aren't, and that takes us back to the same problem.