14 ms·
Why I stopped using StartSSL (Hint: it involves a Chinese company)
- prusswan 11y agoQihoo bought Opera too. CRAP :(
- Laforet 11y agoQihoo offers CDN and managed DNS services[1]. The choice is odd on StartSSL's part but may not be necessarily insidious. What more, not using their services does not enhance or harm your security in many meaningful way as long as they remain a trusted CA who can sign any domain they want to. If nation-state espionage is really a concern for you, take a few minutes of your time and purge the list of trust anchors installed on your OS[2]. [1]:https://cdn.cloud.360.cn/ https://cdn.cloud.360.cn/ [2]:https://github.com/chengr28/RevokeChinaCerts https://github.com/chengr28/RevokeChinaCerts
- bjacobel 11y agoThere's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.
- aftbit 11y agoWhen I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.
- xxpor 11y agoCert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.
- ars 11y agoI got downmodded before for saying this, but I still feel this way: Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. I don't consider this a positive thing. You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way. I have yet to hear any useful reason to rotate the key.
- profmonocle 11y agoHasn't this always been true for domain validated certificates? If you control the domain's content, you can get a cert. I don't see how LE makes that any worse.
- thesimon 11y ago>Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case. >I have yet to hear any useful reason to rotate the key. http://security.stackexchange.com/questions/85963/what-is-the-purpose-of-frequently-rotating-tls-certificates-without-changing-und http://security.stackexchange.com/questions/85963/what-is-th... Basically limiting damage in case of a compromise.
- Laforet 11y agoA short validity period also helps to keep the size of revocation lists manageable as they expire sooner.
- imaginenore 11y agoIf they hack your machine, they can generate new certificates whether you have LetsEncrypt installed or not. They can just install it.
- rakoo 11y ago
- imron 11y agoI just set up Let's Encrypt on a number of my sites. I'll take an automated process I run via cronjob and that requires no manual intervention, over a process that requires I touch it once a year. The decision (to me) is a no-brainer.
- imperalix 11y agoI use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.
- sandGorgon 11y agocan you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run <-> certificate needs nginx to run).
- kccqzy 11y agoYou can obtain a certificate by running let's encrypt's docker image, which seems to contain a python web server just to do the validation.
- sandGorgon 11y agocannot run a docker inside a docker. the problem is not running a webserver, the problem is the race condition which needs to be solved when docker starts up.
- imron 11y agoHow about storing the letsencrypt certificates in a data-container/locally on the host and mapping those files to the nginx container when you start it? For the very first time, you can use let's encrypt's manual verification process, but then have the let's encrypt client set up to renew certs automatically (possibly even from a separate container) using same data file mappings.
- sandGorgon 11y agowhich is why im preferring to spend 10$ on a certificate instead (or rather 85$ for a wildcard).
- vacri 11y ago
- veeti 11y agoI'm afraid you'll have to go through renewal every 3 months, but I'll still make a shameless plug of my client [1]. It uses DNS validation exclusively so you can generate certificates wherever you want. In addition, domain authorizations last for 10 months, so you don't have to go through the DNS verification each time: just renewing is sufficient. Run the issue command, drop new certs into configuration management, done. Couple minutes tops. Just set your calendar! [1] https://github.com/veeti/manuale https://github.com/veeti/manuale
- arantius 11y agoThanks! A hands-off (on?) manual client is what I always wanted. I've just finally used Let's Encrypt for the first time, with manuale.
- 0x0 11y agoLack of support for wildcard certificates is still an issue for Let's Encrypt. Rate limiting and SNI are two issues that means a wildcard certificate is still highly desirable.
- EwanToo 11y agoI'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?
- 0x0 11y agoWindows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.
- jhkaghjkga 11y agoThat's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.
- 0x0 11y agoThat's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.
- Tepix 11y agoWindows XP and Android 2.x both have big security problems. You should encourage your users to upgrade. Also I think with Firefox on Windows XP it should work.
- 0x0 11y agoThat doesn't help when you are targeting a market where Android 2.x is prevalent.
- ascorbic 11y agoStartSSL has some of the worst support I've ever encountered. Normally bad support means clueless or non-responsive. However StartSSL support is often actively hostile, treating customers as idiots or worse. I should point out that this isn't always the case, and I have used them in the past without trouble, but the times when it is bad are bad enough to write them off. Their site also looks like it was made in 1998, and while using client certificates is secure and everything, it's also seriously user-hostile. I have to remember which computer and browser I used a year ago to sign up? Yeah, I know I should back up client certificates, but seriously who does that?
- derFunk 11y agoI agree that their style in responding to questions is really bad (one liners etc). Yet I'm having the experience that they responded quickly and with helpful information if you had a question. I'm now just curious what happens to my data if they're sold to China. I mean, the amount of personal data they are asking for when acquiring a certificate is not really small.
- ascorbic 11y agoIt really varies. Sometimes you're right, and they respond quickly (if tersely) to questions. However other times they're rude and dismissive.
- Tepix 11y agoI've had good experiences lately, when they relaunched their website the option to create your own certificate for S/MIME had disappeared (on Mac - apparently it was still there when using Windows). I opened a ticket and the next day it was fixed. Now you can even upload your own CSR for S/MIME certificates which allows for 4096bit S/MIME keys. Previously they only had the in-browser key creation. Nice.
- josteink 11y ago> while using client certificates is secure and everything, it's also seriously user-hostile. I have to remember which computer and browser I used a year ago to sign up? Yeah, I know I should back up client certificates, but seriously who does that? So you want a secure website, and you agree that SSL is needed for things to be secure. But you're not willing to put in one inch of effort yourself to secure your own SSL keys. You can't even bother to back up the master key to your own certs, because it's too much work? Cognitive dissonance much? If you care about security, then do it properly. If you're going to do it half-assed, just don't bother at all. All you're doing then is contributing to security-theater, which is all the work and no real benefits.
- specialist 11y agoJust today, I'm setting up my first https by myself. Started with Let's Encrypt. Running Mac OS X. Failed. Guessed cause has something to do with macports vs homebrew and having the proper Python version active. Disabled macports. Now the app runs. But I got "Failed to connect to host for DVSNI challenge". Start googling, reading, messing around with this for a while. No joy. Bailed on Let's Encrypt, started over with StartSSL, because its the first source of free for not-for-profit certs I found. Happy to take recommendations for alternatives.
- raesene4 11y agohave you tried using something like https://gethttpsforfree.com/ https://gethttpsforfree.com/ as a front-end to the Lets encrypt process?
- Tepix 11y agoThe official Let's Encrypt client is bloated and wants to fiddle with your HTTP server configuration. Bad idea. Use something small like https://github.com/kuba/simp_le https://github.com/kuba/simp_le or https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny
- chmike 11y agoI use acme-tiny and confirm it is good. But there is still significant work to do to get a working certificate and the documentation is lacking significant details. I have my own recipe documentation that I should publish. Apart from this, this is the only script out there that did cut it for me. Note that the update process needs to be automated because let's encrypt certificates last only 3 months as I have read.
- tombrossman 11y agoMy recommendation is to look beyond the free alternatives and consider how inexpensive paid certificates have become. These can be issued for lengths up to three full years and cost well under $10USD/year. Multi-year discounts bring three year certificates price to under $20USD. Think about how much time it is going to take you to learn how to deploy and maintain your 'free' certificates and remember time is money. What do you make an hour? Is that more than the cost of a paid certificate? I have used these certificates - https://cheapsslsecurity.com/comodo/positivessl.html https://cheapsslsecurity.com/comodo/positivessl.html - on multiple sites and it is very fast and easy. Other vendors sell them too and are likely just as good. Gandi do them too (at a slightly higher cost) and are the fastest method for me, though this may be because I have all my domains there already: https://www.gandi.net/ssl/standard?currency=USD#single https://www.gandi.net/ssl/standard?currency=USD#single Don't waste hours chasing down free certificates when paid ones are so cheap now. Use Let's Encrypt only if you need lots of certificates and the paid options become prohibitively high.
- cm2187 11y agoI will wait for IIS integration before using let's encrypt. Everything I have seen so far doesn't suggest simplicity.
- Laforet 11y agohttps://github.com/Lone-Coder/letsencrypt-win-simple/wiki https://github.com/Lone-Coder/letsencrypt-win-simple/wiki Not perfect but seems to work fine.
- Tepix 11y agoThese alternatives don't offer S/MIME certificates, do they?
- josteink 11y ago> There's really not much reason to use StartSSL now that Let's Encrypt Have you tried using it? On every domain I've tried to obtain a cert it has failed. For me StartSSL may be suboptimal, but at least it works, which is more than I can say for Letsencrypt in its current state.
- icebraining 11y agoWhat client did you use? acme-tiny has been flawless for me, though it's more manual than the main client. https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny
- marcosdumay 11y agoWell, if you are some kind of openssl master, acme-tiny is flawless. In practice, for most people, reserve a few hours for your first deployment. After you got a script that calls openssl right, it's fast to adapt for other domains, but the first time is hard.
- icebraining 11y agoWhy do you have to be a master? Just copy-paste the commands given in the README of the repo, replacing the domain for your own.
- marcosdumay 11y agoWell, at least on my computer, they were mostly broken.
- garblegarble 11y agoI use https://github.com/lukas2511/letsencrypt.sh https://github.com/lukas2511/letsencrypt.sh and it handles all the openssl stuff for you, I've found it to be really nice and light-weight. You just give it a directory to put the ACME challenge files in and a list of your domains
- pluma 11y agoExcept for third-party services you need to provide your own SSL certificates for. AFAIK there's no way to automate renewing the certificate you use for GitHost (with a custom domain), for example.
- larrymcp 11y agoThe author doesn't say why this is worrisome. He just says he's worried "that the PKI front-end (auth.startssl.com) is now hosted within a Chinese Antivirus Company, who uses a Chinese ISP for 2 months and that there hasn't been any news around". The article could certainly use a bit more connecting-the-dots to show how he gets from "they're hosted in China" to "I won't use them anymore".
- taneq 11y agoI think the implication is that the Chinese government exerts a lot of control over the internet there, and are openly monitoring/intercepting internet traffic. As such, they shouldn't be considered a trusted authority for security related purposes.
- Laforet 11y agoYour concern is well placed but the linked post really missed the point. Signing authorities in X509 don't have access to private keys and they don't really need domain owner's input to sign a MITM cert. Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromised in a sense) http://slashdot.org/story/266739 http://slashdot.org/story/266739
- Lanari 11y ago>Hint: it involves a Chinese company Isn't saying that a bit wrong? at least point on the hint that it is having connections with a state-owned company.
- mchahn 11y agoI personally have a serious problem dealing with the state of china's telecommunications. It's about as close to evil as you can get. I'm not saying other state actors are much better but, I'm just saying ...
- mfjordvald 11y agoWhy anything to do with Qihoo is worrying: https://en.greatfire.org/blog/2014/oct/china-collecting-apple-icloud-data-attack-coincides-launch-new-iphone https://en.greatfire.org/blog/2014/oct/china-collecting-appl... It's proven in the past that they're not a security company for anything that deals with protecting yourself against snooping by the Chinese state and will negatively affect your security. Seeing this in relation to free SSL intended to be deployed all over the internet. Yeah, that is worrying.
- StavrosK 11y agoLooks like we can't win, since most companies are being snooped by someone. There's hardly a service I use that's not within the NSA's reach, for example, and China is probably less dangerous to me than the US.
- nly 11y agoFine, stop using them. You still trust them. Your visitors browsers still trust them. Being paranoid wrt a Chinese CA really makes no sense. They have as much incentive as a western CA to behave wrt keeping their signing keys secure, and their revocation list sensible, which is all that really matters.
- ctz 11y agoPeople need to read this. There are many things to take into account when choosing a CA to use for your site. But security, jurisdiction and any history of mis-issuance are not relevant to you; only reliers. And no relier has any choice in the matter anyway, or any economic relationship they can terminate. (Things change if you start to use HPKP and pin to a particular root; nobody does that though because it's an availability and economic nightmare.)
- steve371 11y agoChinese company is not a red flag. but Qihoo is. The company has known bad reputation. a. they labeled their own browser as a Microsoft security update, which triggered MS investigation b. they cheated on the anti-virus lab testing and got banned. ....etc.
- kccqzy 11y agoThey also used to bundle a cracked version of Sandboxie in their own browser for sandboxing.
- dujiulun2006 11y agoFor Chinese people working in IT industry, Qihoo is an awful company for the reasons mentioned above, but also for allegedly assisting government Internet censorship. Now let's make their awful name worldwide. ;)
- Laforet 11y agoLike it or not, they do have a crack team of engineers. 90%+ of the Windows kernel hackers in China have worked, or still is with Qihoo.
- roddux 11y agoSource?
- Laforet 11y agoThis is pretty anecdotal and I doubt there will be a list of names written down somewhere. However have a look at the number of acknowledgements in Microsoft's security bulletins from last year: Palo Alto Networks - 34 Qihoo/360 - 27 FireEye - 14 Tencent - 14 Trend Micro - 12 Fortinet - 7 McAfee - 2 VMware - 2 Kaspersky - 1 They are a pretty unsavory company but they really know what they are doing. Source: https://technet.microsoft.com/library/security/dn903755.aspx https://technet.microsoft.com/library/security/dn903755.aspx
- daryltucker 11y agoWere you letting them generate your keys for you? What's the big hub-ub about?
- mmaunder 11y agoOn a related note, Cloudflare use Baidu servers in China operated by Baidu staff. My understanding is that this means private SSL keys given to Cloudflare live on Baidu owned and operated servers. http://www.cnbc.com/2015/09/14/chinas-baidu-and-cloudflare-in-partnership-to-boost-website-speeds.html http://www.cnbc.com/2015/09/14/chinas-baidu-and-cloudflare-i... They offer "keyless" ssl which puts the private key back in the data center but this adds complexity and latency on the initial connect so I suspect most don't use it.
- dujiulun2006 11y agohttps://www.cloudflare.com/china/ https://www.cloudflare.com/china/ [quote]For the moment the China network does not support HTTPS traffic (HTTP only). Support for SSL/TLS will be made available in the coming months.[/quote] As long as you don't sign in to China servers, they won't put you there. Even if you want to, first you need valid ICP certificate issued by Chinese govt.
- baby 11y agoBaidu is like Google but in China. They must already have a certificate in any browser's trust store. And also, think about all the keys contained in AWS servers, and AWS is in America...
- profmonocle 11y agoUsing a local CA seems like a bad way for a government to compromise HTTPS. If they got caught, that CA would get demolished practically overnight when the browser makers remove it from the trust stores. Compromising a foreign CA seems like a much better strategy. (Although not nearly as simple)
- jgrahamc 11y agoNope. Your "understanding" is completely wrong. CloudFlare's network in China does not contain configuration, settings, SSL certificates etc. from non-China CloudFlare customers. We run separate infrastructure there and only if you go through the hoops to expose your web site on our network inside China do we send information about your web site there. Source: me (I'm CloudFlare's CTO)
- happywolf 11y agoI had a bad experience with StartSSL using their free SSL cert. Basically they just treat you like a thief or scumbag trying to take advantage of their freebie. Eventually I found a company selling $10/year cert which I am happily paying. Now this adds another excuse for me to avoid StartSSL even more.
- hoodoof 11y agoSo is that point that we can't trust the Chinese government and by implication we can trust the U.S. and other governments?
- deleted 11y ago[deleted]
- derFunk 11y agoReading this I'm more worried about the personal data StartSSL has about me. I never felt good giving away so much personal data to CAs when acquiring certificates to identify myself. Do we know how StartSSL handles this? Do the Chinese now have a copy of my passport, electricity bill et cetera? (well, I've been to China already, so the state already got my passport, but not necessarily a "private" company).
- testerooooooo 11y agoIf the Chinese don't have it, the Mossad does. The fear is real. Maybe StartSSL was only a Mossad front to collect valid/real identities from around the world to use on covert ops.
- Tepix 11y agoQuote from the article: "StartSSL already refused to revoke certificates affected by the HeartBleed vulnerability and accused the user from negligence." That's wrong. They did charge a $25 fee for the revocation, however. I think it's reasonable since there is probably some manual process involved and the certificate was already free. They have to earn money somehow.
- tombrossman 11y agoExactly, they've automated the issuance of free certs and revoking takes extra work. $25 sounds high (sub-$10/year certs with unlimited free revocation & re-issuance are easy to find) so it is a money maker for them but so what? People think nothing of using the freemium model which gives you a basic product for free, and charges you for extra features. It's exactly what StartSSL are doing here. I don't particularly like or use StartSSL, but much of the criticism of them sounds totally invalid to me. Paid DV certs are dirt cheap people, shop around!
- malka 11y agoExcept that it causes that a startSSL certificate had a higher chance of being unrevoked if compromised. Therefore, I remove them from the truststore on my computers.
- Tepix 11y agoIs there any alternative to StartSSL for free S/MIME certificates that are trusted by the popular mail clients?
- Kovah 11y agoWould like to know that too. For websites there's Let's Encrypt but I haven't found any suitable solution for S/MIME...
- elgaton 11y agoCOMODO still appears to offer a free e-mail certificate: https://www.comodo.com/home/email-security/free-email-certificate.php https://www.comodo.com/home/email-security/free-email-certif...
- hannob 11y agoThe author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work. Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pin leaf certificates - it still doesn't matter which CA you choose. Every text that indicates "I don't trust CA X for reason Y, therefore I don't use them" is based on a misunderstanding of how certificates work. (And yes - I know that there is the issue that you can let StartSSL create the private key for you. Just don't do this ever, no matter which CA you use.)
- blfr 11y agoWell, you could pin your CA's certificate so at the very least your repeat users won't be at risk but fundamentally you're right and it is a common misconception.
- maggit 11y agoCan you pin leaf certificates? Quoting https://developer.mozilla.org/en/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en/docs/Web/Security/Public_Ke...: > Firefox (and Chrome) disable Pin Validation for Pinned Hosts whose validated certificate chain terminates at a user-defined trust anchor (rather than a built-in trust anchor). I understand this as "when using HPKP, you have to pin a CA certificate, not your site's leaf certificate". If this understanding is correct, I think your comment about HPKP is wrong and it is in fact a good idea to use a CA you find trustworthy and pin its certificate. Agree?
- ck2 11y agoI really wish SSL had separated encryption from the authority. Then you could have a choice of multiple authorities verifying each other, independent and commercial.
- ryanqian 11y agoChinese Company is OK, but Qihoo is not, This is an awful Company.
- KaiserPro 11y agobut this is how PKI/SSL/CA works. You are borrowing someone else's trust. You are hoping that the company you get a cert from won't pretend to be you. There is no technical mechanism to stop this, no matter where the parent company is based. Also the other thing to note is that virtually all communications companies have some sort of government involvement regardless of where they are based.
- icebraining 11y agoYou are hoping that the company you get a cert from won't pretend to be you. Actually, any company can pretend to be you, whether you got the cert from them or not.
- nbevans 11y agoWestern CA's and ISPs are just as "state encumbered" as Chinese ones. We just turn a blind eye, for some reason. It would be so easy for NSA/GCHQ to recruit or place an "agent" inside of any Western CA or ISP they wanted. There is even evidence in recent years that this has been happening. http://www.theregister.co.uk/2015/09/21/symantec_fires_workers_over_rogue_certs/ http://www.theregister.co.uk/2015/09/21/symantec_fires_worke... This was merely the most recent incident. Yes Symantec covered it up quite nicely and framed it as a test that went wrong (the Russian's used that excuse with Chernobyl) but there is no evidence those "rogue employees" were not acting for the state i.e. the USA. There was also the recent incident with Juniper networks and the state-sponsored backdoor that had been present in much of their network gear for a few years. See: http://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-nsas-fault/ http://www.wired.com/2015/12/researchers-solve-the-juniper-m... Still think the West CA's and ISPs are better than Chinese ones? The only question you need to ask yourself is: Which government would you rather have eyes on your data? One might surmise that if you have something to hide from Western eyes then use a Chinese provider. And if you have something to hide from Chinese eyes then use a Western provider. The balance of probabilities, I believe, backs this up.
- alvarosm 11y agoPathetic let'sencrypt promotion. Now I'm gonna give you a few reasons not to use let's encrypt: it forces you to keep a piece of software that can generate keys in your server. It forces you to reload your web server config every two months, unattended (they won't issue certs valid for more than 90 days). The alernative would be to do the process manually every two months(wtf?). Also, its certificates are not trusted in Windows XP. Now, as part of these piss-poor authoritarian decisions and attitude, someone is trying to trick startssl users into using let's encrypt posting this crap with circumstantial evidence about China and Startssl. I hope you fail miserably. No, I have no ties to Startssl whatsoever. And it's been ages since I last used their service.
- blfr 11y agoIt does not force you to use any particular software. You can even write your own client. Shorter validity time makes your users safer. If you lose the private key, it will only be a problem for three monts or less. Reloading your webserver should be a complete non-issue.
- alvarosm 11y agoBecause everyone should love to waste their time writing their own client. And running let'sencrypt scripts as root. And risking their security. And/or renewing certificates every now and then instead of focusing on stuff that matters. And anyone who disagreees should be downvoted to oblivion. YEAH!
- blfr 11y agoI'm quite happy with simp_le[1] which doesn't require root. Renewals can happen automatically. All you need to do is monitor your certificates as you would anyway. [1] https://github.com/kuba/simp_le https://github.com/kuba/simp_le
- pfg 11y agoYou don't have to run anything as root if you don't want to. There are tons of clients out there without that requirement. Your argument is basically that Let's Encrypt should have put more focus on working like other CAs do, while they decided to focus on better security and automation. Luckily, there are plenty of other CAs out there, and it's quite likely that more of them will start offering free DV certs soon, so it's not like Let's Encrypt is forcing you to do anything you don't want to.
- skrowl 11y agoI'm all for jumping over to Let's Encrypt... as soon as they offer certs I don't have to renew every 3 months
- theandrewbailey 11y agoA certificate that expires every 3 months with an interface that is usable is better than none at all. Write a script and add to cron.
- jrochkind1 11y agoI'd be suspicious an Israel company was cooperating with US national security agencies in the first place.
- mwcampbell 11y agoWhy does the nationality of the company matter? Mentioning it so prominently just plays to our natural xenophobia.
- DyslexicAtheist 11y agoindeed by that logic we shouldn't be using anything that is built or hosted in the US either. It is stupid nationalist fear mongering.
- vidoc 11y agoFunny how 'China' has replaced 'Russia' in being the SingleAndUltimateEvilEnemyOfTheFreeWorld in the poorly informed mind of some.
- dragonwriter 11y agoI thought that role had been taken by al-Qaeda, and recently succeeded by "ISIS".
- vidoc 11y agoIt's true, but they aren't usually portrayed as being smart, just crazy/ugly/stupid. Whereas Chinese and Russians are portrayed as being extremely smart and cold hearted.
- vidoc 11y agoOf course never as smart since as Marco Rubio says "it is the greatest nation in the history of Mankind" no less ..
- deleted 11y ago[deleted]