15 ms·
Defending Our Brand
- scrollaway 10y agoI'm cancelling an order for a code-signing certificate with Comodo. This is disgusting behaviour on their part. Can someone recommend a good provider for code signing certs?
- vsl 10y agoDigiCert. After a year with Symantec (can't recommend) it was a joy to get one from DigiCert. Good site, good tools, reasonable prices, 3 yr option, painless validation process (I'm in a small EU country, which tends to complicate things on occasion). Can't recommend enough.
- scrollaway 10y agoThank you. I was already looking at digicert, this cements my choice :)
- l1n 10y agoTalk about an abuse of the trademark system.
- jordigh 10y agoHm? This seems to be the perfect use of this "intellectual property"[1]. Comodo is trying to deceive people, Let's Encrypt is trying to prevent it by enforcing their trademarks. This is how it's supposed to work. -- [1] I don't like the term "intellectual property" mostly because people forget or misunderstand what it refers to and how the many various things called "intellectual property" work individually and differently from each other.
- deleted 10y ago[deleted]
- dandelion_lover 10y ago>I don't like the term "intellectual property" and rightfully so, see https://www.eff.org/issues/intellectual-property/the-term https://www.eff.org/issues/intellectual-property/the-term
- l1n 10y agoThe fact that Comodo was able to get this far with infringing a trademark just because it wasn't registered is the abuse that I was talking about.
- intsunny 10y agoThis is disappointing, but not surprising given that Lets Encrypt threatens a large and out-dated revenue stream for Comodo. Thankfully Lets Encrypt is backed by Mozilla and the EFF, they have the resources to defend the brand. Good luck guys!
- Brybry 10y agoCouldn't this sort of behavior be against the Mozilla CA Inclusion Policy and thus grounds for no longer bundling Comodo CA certs? The same could possibly be said for Chromium's Root Certificate Policy. It doesn't break the specific trusted tasks but I would say it counts as generally operating in a non-trustworthy way. Seems dumb on Comodo's part.
- Karunamon 10y agoProbably, but Mozilla will never do it just because of the sheer amount of stuff that will stop working only on their browser. That threat is only valid if the other browser vendors do the same thing at the same time, otherwise it's a massive game of prisoner's dilemma.
- Fej 10y agoThe bullshit the CAs pull never ceases to amaze me.
- throwanem 10y agoComodo in particular has a long history of shady bullshit. Tarring all CAs with that brush strikes me as unduly harsh.
- hobs 10y agoWhile its fair to say that some CA's are not scum, so many of them have done shady things, and they are basically rent seekers for a product that they spend little on to verify things like identity etc. Most certs are just money printing machines for the orgs in charge of them and I am not surprised they would want to fight back against LE.
- JoshTriplett 10y agoSee also "Chromodo", the Chrome fork by Comodo that introduces such incredible security features as turning off the same-origin policy, completely breaking the Internet security model.
- vox_mollis 10y agoIndeed. Their PCI-DSS compliance scanning service is completely useless. Service version fingerprinting only, regardless of binary patch level or actual vulns. Yet somehow, the PCI SSC accepts their scan results as actionable for Level 1-3 compliance.
- throwanem 10y agoPCI verification is a rubber stamp all the way through, is how.
- Kadin 10y ago> Tarring all CAs with that brush strikes me as unduly harsh. While I'm sure there are CAs who aren't as egregiously bad as Comodo, it's hard to get around the fact that they basically shouldn't exist as a class, and any CA that isn't working to put itself out of business is sort of hurting the Internet ecosystem.
- josephb 10y agoYou can only imagine it's being done for malicious reasons. It doesn't seem like there is any good reason for Comodo to do this, other than try protect revenue loss.
- tomc1985 10y agoIf 'protect revenue loss' is an oblique way of justifying outright theft, then sure. These snakes are aggressive as hell. They monitor domain registrations and email-bomb anyone in DNS records. Their spam gets through filters and they'll call you up to sell you certs. Fuck them.
- egeozcan 10y agoIt looks like they have nothing left to lose. Acting in bad faith so openly lowers them to the levels of patent-trolls. I can't think of any company which respects its public image doing any new business with them after this news.
- vonklaus 10y ago> Acting in bad faith so openly lowers them to the levels of patent-trolls. You seem to imply there was a time in recent memory where comodo itself was at a level above patent trolls. At a high level, patent trolling is associated with rent collection behaviour and using coercion to profit. I see this as comodo's core business, so I guess I am just quibbling about timeframe.
- pcora 10y agoThe worst possible move by a competitor. Not cool Comodo.
- abraae 10y agoMaybe also one of the stupidest. Comodo are really raising up LetsEncrypt in the eyes of the community, as well as sullying their own brand, by being such dicks, and being so obviously in the wrong. And when they lose, as it sounds they will, they'll leave the LetsEncrypt brand all the more valuable than before.
- AngeloAnolin 10y agoNext thing we'll likely see is that Comodo getting hacked / breached and their data exposed, making them the least trusted computing security firm.
- NetStrikeForce 10y agoNext thing you say? http://www.cnet.com/news/fbi-probes-comodo-web-security-breach/# http://www.cnet.com/news/fbi-probes-comodo-web-security-brea...!
- ComodoHacker 10y agoI picked my nickname after that breach.
- RubenSandwich 10y agoIt is very disheartening that Comodo, a seller of SSL certs, is attempting to steal some of the attention of Let's Encrypt has put into making a more secure internet. Instead of trying to weasel their way in front of Let's Encrypt a better strategy, in my personal opinion, would be to offer services on top of SSL. (Installing and managing SSL certs is still something a lay person cannot do.)
- sievebrain 10y agoThey already do. LetsEncrypt does not offer EV SSL certs for example.
- CommanderData 10y agoLearning this, I will not renew my certs with Comodo. This is childish behaviour on Comodos part. If it helps I'll advise any companies I consult to do the same until this changes. Money is the only thing this company will understand.
- distances 10y agoI agree. I have an existing cert from Comodo for my personal site, as they were cheap and easy to get when I was looking for one. I will look for another provider when it's time to renew.
- nik736 10y agoWhy are you looking for another provider? Just use Lets Encrypt ;-)
- jakobegger 10y agoLets encrypt certs are only valid for 3 months. In many situations the auto-renewal stuff is inconvenient. Then its easier to just buy a commercial cert that's valid for a few years.
- _jomo 10y agoI always use acme-tiny [0] to set up LE certs. You can follow their README to set up everything, including automatic reneweal cronjob in a couple minutes. 0: https://github.com/diafygi/acme-tiny#readme https://github.com/diafygi/acme-tiny#readme
- bradleyjg 10y agoThat's not always an option. For example, when I was looking into it for google app engine, I came across these directions: http://blog.seafuj.com/lets-encrypt-on-google-app-engine http://blog.seafuj.com/lets-encrypt-on-google-app-engine and http://igorartamonov.com/2015/12/lets-encrypt-ssl-google-appengine/ http://igorartamonov.com/2015/12/lets-encrypt-ssl-google-app... That's not so bad if you have to do it once a year or better yet once every two years, but I'm not doing that every 3 months. There's an issue open to allow for the process to be automated, hopefully by the next time I need to renew it'll be available. But as it stands today I went with a paid certificate.
- chasb 10y agoWell done Comodo, this motivated me to donate to Let's Encrypt. https://letsencrypt.org/donate/ https://letsencrypt.org/donate/
- pi-rat 10y agoGood idea, your comment motivated me to do the same.
- calvers7 10y agojust signed up for a $20/month donation :)
- lomnakkus 10y agoLikewise
- pc86 10y agoI assume donations directly to Let's Encrypt are tax deductible like EFF donations are - does LE send out tax information for contributors?
- readams 10y agoLet's Encrypt is part of the Internet Security Research Group, which is an IRS 501(c)(3) public benefit corporation. Contributions are tax deductible in the US.
- Sir_Cmpwn 10y agoEh, I want to donate, but not via PayPal. If anyone relevant is reading this, consider adding more donation methods.
- happyslobro 10y agoYou would think that an organisation with that name would have wallets in a variety of digital currencies.
- endgame 10y ago
- misiti3780 10y agoI will never use a Comodo cert again.
- the_mitsuhiko 10y agoThere are also others trying to cash in on this. StartSSL recently started a "Start Encrypt" product which is based on similar ideas.
- creshal 10y agoThat was my first idea too. I'm surprised LE didn't target them too.
- pcora 10y agoWhile the naming might be similar, they are actually providing a free ssl cert, right? similar to LE. If that is the case, then its a good thing (IMHO)
- schlowmo 10y agoThey always provided free "personal" certifcates with a validity of one year. But they market the "Start Encrypt" thing like you now get wildcard and EV certificates for free (which isn't true). Talking about scummy practices...
- creshal 10y agoWhen hasn't StartCom been scummy?
- puddintane 10y agoNever I'm pretty sure - we run a ticket reselling website thru an exchange and tried to use the service to get developer certs for our testing site. The web site had a black banner with white text on the top that stated in high contrast that it was the developer site and no actual transactions would run and tickets could not be purchased if a transaction was attempted here. (even was using a test domain while clearly the live site's domain was in the header) They still required us to purchase some package to use the certificates on that site. When LE came up we were more then thrilled that we didn't have to fork out extra cash for developing on sites that don't get traffic at all and clearly stated this fact. I will never go back to StartCom considering how they treated us that day. It seems more like to that the approval process is strictly to whomever is approving requests at the time because I've also seen several friends get certificates for e-commerce sites that were clearly labeled as the production server and have yet to be revoked after several years of running and becoming successful. I don't know how StartCom run's the actual process and I could have just been caught on a bad person that day but honestly when you have one bad experience humans tend to avoid going through that again since we are programmed since birth to do this. Of course Let's Encrypt has been more then what we expected and will continue to use them until such time we are required to stop using them! Go Let's Encrypt - You got this companies support and I'm sure that of many others so don't ever stop fighting!
- AdmiralAsshat 10y agoI'd love to see Comodo's defense of this. By "defense" I mean their PR spin, of course. I doubt they'll actually come right out and say "Let's Encrypt is a threat to our revenue and we're attempting to trademark the name under-the-radar so that we can sue them out of existence."
- Jamieee 10y agoWhat a scummy business practice. I will not be renewing my remaining Comodo certs.
- dtemp 10y agoAh, the death throes of a big company that suddenly had its business model invalidated. Well, not entirely; there are market niches that Let's Encrypt doesn't cover: org-validated and extended validation certs, wildcard certs, anyone who needs a cert that expires in years, ECDSA certs (for the time being)... But theres no doubt that their revenue will be significantly cut, they'll lose shareholder value and need layoffs. Their industry did it to themselves; a TLS cert company should have 5 engineers, 5 customer support people, and 2 managers, and should charge about 10% of what they do.
- withinrafael 10y agoAnd code signing certs, especially those for Windows kernel driver development.
- pi-rat 10y ago[x] First they ignore you, [x] then they laugh at you, [x] then they fight you, [ ] then you win. - Mahatma Gandhi
- rakoo 10y ago[ ] then you ignore them http://www.smbc-comics.com/?id=3246 http://www.smbc-comics.com/?id=3246
- ddlatham 10y agoThe path to winning often goes through such steps. But just because you've reached one step doesn't mean you will reach the next.
- vitd 10y agoGandhi never said that [0]. [0] https://en.wikiquote.org/wiki/Mahatma_Gandhi#Misattributed https://en.wikiquote.org/wiki/Mahatma_Gandhi#Misattributed
- jagger27 10y agoDidn't LE announce they were going to do a name change a few months ago?
- pietroalbini 10y agoThat was for the official client, which was renamed to certbot. The CA name was never meant to be changed. https://github.com/certbot/certbot https://github.com/certbot/certbot
- beardicus 10y agoNo. The "official" client changed names when maintainership was moved to the EFF.
- chrisked 10y agowill switch all my comodo certs once they expire.
- edoceo 10y agoI've been using LE for all the certs. Free, easy, secure. Hooray! Cheers to LE for standing tall. Please donate to LE, EFF.
- pr0ph3t 10y agoYour motivation motivated me to donate
- 4h53n 10y agoYour comment motivated me to think about doing the same.
- mwambua 10y agoI'm donating to keep this nested motivation going. :-)
- hathym 10y agoI am donating now...
- smoyer 10y agoI also just donated
- HalcyonicStorm 10y agoi donated toooooo
- nickpsecurity 10y agoSo, "Pay it Forward" is playing out for real on Hacker News to fight mass or criminal surveillance? Hell, I'm in! Threw them some dough. :)
- Raed667 10y agoIs there an easy way to switch from CloudFlare's COMODO to Let's Encrypt? If so I'm in !
- 10y ago
- natch 10y agoI'm pretty sure the lawyer would have known about letsencrypt.org and their Let's Encrypt project before filing this. So that being said, reading the fine print of what the lawyer had to sign in order to submit the application, shouldn't the lawyer be vulnerable to perjury charges? Excerpt from http://tsdr.uspto.gov/documentviewer?caseId=sn86790719&docId=RFA20151020074647#docIndex=3&page=1 http://tsdr.uspto.gov/documentviewer?caseId=sn86790719&docId... : The signatory believes that: if the applicant is filing the application under 15 U.S.C. § 1051(a), the applicant is the owner of the trademark/service mark sought to be registered; the applicant is using the mark in commerce on or in connection with the goods/services in the application; the specimen(s) shows the mark as used on or in connection with the goods/services in the application; and/or if the applicant filed an application under 15 U.S.C. § 1051(b), § 1126(d), and/or § 1126(e), the applicant is entitled to use the mark in commerce; the applicant has a bona fide intention, and is entitled, to use the mark in commerce on or in connection with the goods/services in the application. The signatory believes that to the best of the signatory's knowledge and belief, no other persons, except, if applicable, concurrent users, have the right to use the mark in commerce, either in the identical form or in such near resemblance as to be likely, when used on or in connection with the goods/services of such other persons, to cause confusion or mistake, or to deceive. The signatory being warned that willful false statements and the like are punishable by fine or imprisonment, or both, under 18 U.S.C. § 1001, and that such willful false statements and the like may jeopardize the validity of the application or any registration resulting therefrom, declares that all statements made of his/her own knowledge are true and all statements made on information and belief are believed to be true.
- rhizome 10y agoshouldn't the lawyer be vulnerable to perjury charges? 18 U.S.C. § 1001 isn't perjury, it's false statements, the same charge as lying to the FBI (Scooter Libby, Rod Blagojevich, Bernie Madoff, etc.). It can still result in prison, though!
- brian_cloutier 10y agoYou would have to prove the lawyer knew. It sounds difficult to prove short of an email exchange and I have no idea how the courts work but hopefully you can't get access to a company's emails just by filing a suit based on "I'm pretty sure"
- yeldarb 10y agoWhy did Lets Encrypt not previously register a trademark of their own?
- axg 10y agoWe should remove Comodo from our trusted CAs
- ktdrv 10y agoAaaand the Controversies section of Comodo's Wikipedia page gained another entry.
- markbao 10y agoThis is why people hate CAs.
- greenspot 10y agoOut of curiosity: Why didn't Letsencrypt applied for a trademark right at the start? That this happens was quite foreseeable and occurs quite often if people forget to secure trademarks (I know this won't be a popular opinion because most as I like Letsencrypt and their outstanding service)
- icebraining 10y agoIt's a fair question, though you don't actually need to register your trademark to "own" it, it just provides some advantages and of course reduces the danger that someone will do what Comodo did.
- greenspot 10y agoIf Comodo would have actively used "Letsencrypt" as a brand paired with Comodo's registration this case would be crystal clear: Letsencrypt wouldn't own anything. With the situation now, it's debatable but saying that a trademark 'just provides some advantages' is a bit of an understatement.
- seandougall 10y agoThat's a bit oversimplified. If LE had used the mark first, and had taken the measure of asking Comodo to stop using it, that would show them protecting their trademark, which would give them a case. The PTO is quite clear that registration is not required for a trademark to be enforceable.
- Kadin 10y agoIt costs $375 (plus lawyers fees, usually) and I suspect that they just didn't think it was necessary. Lots of organizations haven't and don't bother registering, unless they expect a problem. Lots of volunteer-run software projects have better things to spend money on and just never get around to registering their name as a trademark until someone else tries to steal it out from under them.
- 10y ago
- ceocoder 10y agoComodo - if you are reading this, you lost about 3000 USD worth of business from me. And someone else is going to gain the same. Drop this nonsense. It helps no one.
- robrenaud 10y agoWhy not send them an short and direct email?
- tomcorrigan 10y agoI would love to see Mozilla (a big backer of Let's Encrypt) drop the Comodo root certs from their alpha and beta Firefox builds for a couple of days to show them how ugly things get when both sides play nasty.
- andrewflnr 10y agoGiven a year's warning or so, I would love to see all the browser vendors just drop Comodo permanently.
- dordoka 10y agoWell, there you have it Comodo. Issued new certificates for my humble domains even thought they're not yet expired. And there you have it Let's Encrypt, I've donated https://letsencrypt.org/donate/ https://letsencrypt.org/donate/
- Nilzzon 10y agoThat's it, I've cancelled all our Comodo certificates!
- Nilzzon 10y agoThat's it! I've just replaced all our Comodo certificates.
- ionised 10y agoGod damnit, I really need to find a decent alternative to Comodo Firewall and HIPS, something that offers similar granular control. They're far too shady these days.
- markonen 10y agoCloudFlare uses Comodo certificates–millions of them, I imagine–and that probably makes them a commercially significant Comodo customer. As a CloudFlare customer with a Comodo-issued certificate, I hope they’ll try to convince Comodo of the value of doing the right thing.
- aroch 10y agoComodo is just cross-signing CF certs[1] because the CF Origin CA is not yet in browser trust stores. GlobalSign and Digicert also cross-sign CF certs. [1] https://blog.cloudflare.com/universal-ssl-encryption-all-the-way-to-the-origin-for-free/ https://blog.cloudflare.com/universal-ssl-encryption-all-the...
- pfg 10y agoCloudFlare's Origin CA was created exclusively for communication between CloudFlare and backend servers. I haven't seen any kind of announcement mentioning that CloudFlare has plans to operate a public CA and apply to root programs.
- diegorbaquero 10y agoNever again comodo, donating to LE
- symfoniq 10y agoThe organization I work for has used Comodo certs in the past, but antics like this ensure they'll never receive another dime from us.
- impostervt 10y agoThis post made me hover over the green lock icon for this page: "Verified by: COMODO CA Limited"
- privong 10y agoWhen I hover over the green lock it says: "Verified by: IdenTrust".
- nacs 10y agoParent post is correct, HN/YCombinator is using Comodo: https://thumbsnap.com/i/5ZkbUd6F.png?0623 https://thumbsnap.com/i/5ZkbUd6F.png?0623
- yvesmh 10y agoHe probably meant Hacker News, just checked and HN is verified by Comodo and LetsEncrypt by IdenTrust.
- privong 10y ago> He probably meant Hacker News, just checked and HN is verified by Comodo and LetsEncrypt by IdenTrust. Gotcha. Yeah, I thought they meant the LetsEncrypt page.
- deltaprotocol 10y agoThis community is clearly on Let's Encrypt's side so maybe HN should be our voice and drop business with COMODO as an answer? I say yes!
- davidgerard 10y agoFWIW, at $DAYJOB we've been actively getting rid of our Comodo certs and replacing them with Let's Encrypt certs, because the Comodo certs don't work with certain older Android versions that we have to support - but Let's Encrypt's all just work. If others are doing the same, this would be motivation for Comodo.
- eeeeeeeeeeeee 10y agoI would expect no less from Comodo. Terrible company and product.
- nacs 10y agoSeems HN/YCombinator is using Comodo: https://thumbsnap.com/i/5ZkbUd6F.png?0623 https://thumbsnap.com/i/5ZkbUd6F.png?0623
- NelsonMinar 10y agoComodo is not a trustworthy security company. Their browser extensions break browser security: https://news.ycombinator.com/item?id=11021633 https://news.ycombinator.com/item?id=11021633 https://news.ycombinator.com/item?id=9091917 https://news.ycombinator.com/item?id=9091917 They issued fraudulent SSL certificates in 2011: https://www.schneier.com/blog/archives/2011/03/comodo_group_is.html https://www.schneier.com/blog/archives/2011/03/comodo_group_...
- csense 10y agoIf they're not trustworthy, let's remove them from the trusted CA lists of major FOSS browsers / distros. Anyone know the proper mailing list / bugtracker this should be filed on in the case of Firefox?
- zymhan 10y agoWhile a worthy cause, Firefox would be utterly broken if Comodo was no longer a trusted CA.
- giancarlostoro 10y agoJust how many use Comodo, and why isn't there some sort of movement pushing against Comodo? Hopefully if they lose business or start to they will think twice and attempt to restructure everything.
- pfg 10y agoCloudFlare uses them for Universal SSL, so that's roughly 5% of all websites[1]. Their overall market share (in the CA business) appears to be around 40%[2]. [1]: https://w3techs.com/technologies/details/cn-cloudflare/all/all https://w3techs.com/technologies/details/cn-cloudflare/all/a... [2]: https://w3techs.com/technologies/overview/ssl_certificate/all https://w3techs.com/technologies/overview/ssl_certificate/al...
- 10y ago
- drumttocs8 10y agoI'm not sure what happened with Comodo in the past couple of years. I used to love their firewall and "secure" browser products- but then they stripped features from their free firewall option, and added sponsored links to the address bar autocomplete results! Literally a complete 180 from impressions of privacy and security I originally had of the company.
- jrockway 10y agoAs part of my branding consulting services, I could totally come up with some non-trademarked-but-like-totally-better names. For instance: 1) We gonna encrypt u 2) Allow us to encrypt! 3) I CAN HAZ NCRYPTON?
- kevindeasis 10y agoWho do you guys trust for your wildcards needs? Assuming you were to build a super cheap side project on the weekends and you needed subject alternative names for your first-level subdomains.
- 24gttghh 10y agoWell, good thing members of the EFF are on the Technical Advisory Board at Let's Encrypt, and the board of Directors at ISRG.
- lighttower 10y agoComodo's behavior is shameful. How can we punish them? Is there a way to move away from using their services?
- grellas 10y agoThe points made by ISRG seem well-taken and, if there is a formal fight over this, it should prevail given the facts as it recites them. There is a general lesson here for startups as well. If you have an important mark, do consider doing an intent-to-use (ITU) application earlier rather than later to prevent poaching of the mark by others. If you haven't actually used the mark in commerce (e.g., if you are in pure development phase), anybody can go out and file an ITU application for your mark and thereby effectively poach it - even if the person doing it is just trying to extort you (of course, they won't say this is their motive). During this phase, you are vulnerable to such poaching risks. For the vast majority of startups, it probably doesn't matter because no one cares about the typical mark or marks they plan to use when there is nothing yet noteworthy about them. But it can and does happen. Autocad got poached in this fashion when it first started. I had a client that had the domain name gmail.net, planning to use if for "graphics mail" back in the day and they could have blocked Google had they filed a "Gmail" ITU application (they didn't). Particularly if your mark is distinctive and fanciful, and tied to a credible venture, you should not be lax on this issue. At least give it some careful thought even if your decision is to take the poaching risk to avoid what you see as unnecessary up-front costs on legal items. Remember: an ITU application gives priority over someone who has not yet used a mark and it gives it to anyone and his uncle who happens to file it even if they have done nothing yet in your field. Once you begin to use a mark in interstate commerce, then you get common law protections by which the person who is first to use a mark in a given geographical area automatically gets priority to the mark with that area. This happened with an outfit called Amazon Books in the Minneapolis area at the time Amazon.com launched and they eventually got a settlement payout from Amazon for infringement of their common law trademark rights in that area by the bigger organization. Thus, if you are indeed using a mark in this way, and someone comes along and tries to register a mark (whether ITU or otherwise), you keep your priority over the late arrival and can sometimes even block them from getting the registration (or have it set aside through a formal legal fight). But this is a path with many potential pitfalls. Unless your actual use was open, prominent, and notorious, you may have proof issues to establish it or to establish its extent. Even if you can prove first use and broad extent, you still may have to fight the latecomer and incur large legal expenses in the process. Moreover, if you have not registered your mark, you do not get a "presumption of validity" for it and this leaves it more vulnerable to a legal argument that the mark is not protectible at all (meaning that many people can use it without infringing on others' rights). Or it can be argued that it is at most entitled to weak protection so that a use by another is a slightly unrelated field will not cause customer confusion and hence not infringe even if the mark is protectible. And so on and so on. The situation is just not clean in this scenario or at least can more readily be gummed up by a determined adversary who has "lawyered up." As someone who has worked for years with early-stage startups, I would be the last to say "go out right away and spend away on legal things" to cover a bunch of theoretical risks. This poaching risk, for most startups, remains primarily theoretical and should not cause you to have to run out and spend a bunch of money on trademark filings before you know if you even have a viable venture. But, for the right cases (good mark, credible venture), it usually pays to be attentive to this issue up front and eliminate the risk through some proactive action. ISRG is non-profit and its use of this mark was open and widespread. So I can see why they did not go out and incur trademark filing costs to protect a mark that I assume they believed no one could in good faith possibly challenge. This was probably the right judgment to make for their situation. Yet, in hindsight, we can see that the failure to do their own filing has left them vulnerable - not to poaching (as I said, they likely will win) but to having to go through an otherwise unnecessary legal fight to defend what is legitimately theirs. It is unfortunate and I hope people will give support as needed. In all too many cases, underfunded people or organizations who are in the right do wind up getting overwhelmed by people who simply have more resources and who are determined to make life difficult. Even with a likely winning legal position, someone in this position can wind up having to do some compromise (such as a trademark co-existence agreement) giving the other party significant rights just to resolve the fight. Better to avoid that pressure here if it means enough to the relevant community.
- juandazapata 10y agoSad. This reminds me of high school where I was constantly being bullied by the big guys. - Oh, I like that what you have. You know what? I WANT it. And I'm going to take it just because I'm bigger than you. They can go to hell. I'm not renewing my certs with those twats. Bullying is not fine just because is a company instead of a person doing it. Let's encrypt, the community is with you. I just donated to your cause.
- tszming 10y agoDear Comodo: your competitor is GoDaddy, not Let's Encrypt :)
- simbalion 10y agoThose bastards. I tried emailing sales@comodo.com but their mailing server falsely bounced my message saying there was a virus attached (I use anti-virus on my mail server.) I called them and told their tech support guy about their broken mail server, and told him to check out letsencrypt.org and see how his company is trying to infringe on trademarks to bully their open-source competition, and that he should find a better employer.
- dkarapetyan 10y agoFuck comodo and their sleazebag tactics.
- artursapek 10y agoThat is a hilariously weak move
- Titanous 10y agoComodo's CEO has responded on their forums: https://forums.comodo.com/general-discussion-off-topic-anything-and-everything/shame-on-you-comodo-t115958.0.html https://forums.comodo.com/general-discussion-off-topic-anyth...
- pfg 10y agoFrom the post: > One a separate note, since we are talking about protecting intellectual property, there is no law protecting business models. When Lets Encrypt copied Comodo's 90 day free ssl business model, we could not protect it. Lets encrypt could have chosen 57 days, 30 days or any other number for the lifetime of their certificates. But they chose to use Comodo's 90 day Free SSL model that we established in the market place for over 9 years!!! We invented the 90 day free ssl. Why are they copying our business model of 90 day free ssl is the question! Comodo has provided and built a Free SSL model that give SSL for free for 90 days since 2007! Trying to piggy back on our business model and copying our model of giving certificates for 90 days for free is not ethical. They clearly wanted to leverage the market of Free SSL users we had helped create and establish and that's why they created exactly same 90 day free ssl offering. So why did they choose 90 day? That is the question! I'm not sure if he's delusional, or if he honestly thinks this is a "business model". Following that logic, all CAs are copying each other's business model when they offer one-year certificates. I don't have words for this.
- empressplay 10y ago"How can you prove it was them who made it up? Isn't this why we have Trademark laws and courts? If they have right to it then more than happy to comply. But these kind of Intellectual copyrights can't be decided over a forum post or twitter account or trying to get your loyal but "blind" followers to bully another enterprise via their tweets. It won't work! This is not wild west and there are legal framework and courts for these kind of disputes. So lets all stop being the judge and jury and follow the law! One a separate note, since we are talking about protecting intellectual property, there is no law protecting business models. When Lets Encrypt copied Comodo's 90 day free ssl business model, we could not protect it. Lets encrypt could have chosen 57 days, 30 days or any other number for the lifetime of their certificates. But they chose to use Comodo's 90 day Free SSL model that we established in the market place for over 9 years!!! We invented the 90 day free ssl. Why are they copying our business model of 90 day free ssl is the question! Comodo has provided and built a Free SSL model that give SSL for free for 90 days since 2007! Trying to piggy back on our business model and copying our model of giving certificates for 90 days for free is not ethical. They clearly wanted to leverage the market of Free SSL users we had helped create and establish and that's why they created exactly same 90 day free ssl offering. So why did they choose 90 day????? That is the question! What they have is nothing new. We have been giving 90 day free certificates since 2007. Unlike them, our certificates are managed, even the free ones, so that consumers are protected. If a certificate is being used maliciously we revoke it. They don't! How is that making internet safer??? Actually consumer are less safe with their certificate because if it is used maliciously they don't revoke (Unmanaged)! Lets get the facts right guys! We are the good guys that have been giving free SSL certificates since 2007 and managing them!"
- alanh 10y agoThe CEO of Comodo has apparently replied on a Comodo forum, and boy, it's a doozy. https://forums.comodo.com/general-discussion-off-topic-anything-and-everything/shame-on-you-comodo-t115958.0.html;msg837411#msg837411 https://forums.comodo.com/general-discussion-off-topic-anyth... > Isn't this why we have Trademark laws and courts? If they have right to it then more than happy to comply. But these kind of Intellectual copyrights can't be decided over a forum post or twitter account or trying to get your loyal but "blind" followers to bully another enterprise via their tweets. It won't work! This is not wild west and there are legal framework and courts for these kind of disputes. So lets all stop being the judge and jury and follow the law! > One a separate note, since we are talking about protecting intellectual property, there is no law protecting business models. When Lets Encrypt copied Comodo's 90 day free ssl business model, we could not protect it. Lets encrypt could have chosen 57 days, 30 days or any other number for the lifetime of their certificates. But they chose to use Comodo's 90 day Free SSL model that we established in the market place for over 9 years!!! We invented the 90 day free ssl. Why are they copying our business model of 90 day free ssl is the question! Comodo has provided and built a Free SSL model that give SSL for free for 90 days since 2007! Trying to piggy back on our business model and copying our model of giving certificates for 90 days for free is not ethical. They clearly wanted to leverage the market of Free SSL users we had helped create and establish and that's why they created exactly same 90 day free ssl offering. So why did they choose 90 day????? That is the question! > What they have is nothing new. We have been giving 90 day free certificates since 2007. Unlike them, our certificates are managed, even the free ones, so that consumers are protected. If a certificate is being used maliciously we revoke it. They don't! How is that making internet safer??? Actually consumer are less safe with their certificate because if it is used maliciously they don't revoke (Unmanaged)! > Lets get the facts right guys! We are the good guys that have been giving free SSL certificates since 2007 and managing them!
- Animats 10y agoUS trademarks are easy to register.[1] The whole process is online and starts at $225. I hold several. You don't need a lawyer unless you're in some crowded area ("AAAAA Plumbing" would be a crowded area) or confusingly similar to an existing trademark. There's no reason for a startup to not register a trademark. [1] http://www.uspto.gov/trademarks-application-process/filing-online http://www.uspto.gov/trademarks-application-process/filing-o...
- deleted 10y ago[deleted]
- kefka_p 10y agoI've uninstalled some software I've paid good money for as a result of this behavior. Further Comodo will net exactly zero recommendations from me until this behavior is rectified. Utterly intolerable.
- rsspbrry 10y agoSounds like Comodo should get the GoDaddy treatment: http://arstechnica.com/tech-policy/2011/12/victory-boycott-forces-godaddy-to-drop-its-support-for-sopa/ http://arstechnica.com/tech-policy/2011/12/victory-boycott-f...
- 86646 10y agoLol. Free publicity for LE. Good job Comodo.
- deleted 10y ago[deleted]
- MasterYoda 10y agoThis behaviour really piss me off. Someone having a proper email to comodo so it is possible complain directly to them? (1) I really hope alot of people will complain directly to them so they see this is not ok in no ways and they doing the right thing. (1) “contact us" on there homepage is just emty for me on my mobile for some reason. Therefore the question.
- tripzilch 10y agoSeems a pretty clear case that Let's Encrypt will win easily. The crazy part is the legal system with the pay-wall before justice.
- mcms 10y agoUpdated original post: Update, June 24 2016 We have confirmed that Comodo submitted Requests for Express Abandonment for all three trademark registration applications in question. We’re happy to see this positive step towards resolution, and will continue to monitor the requests as they make their way through the system. We’d like to thank our community for their support.
- dellaburns 10y agomy friend needed to fill out TX Travis County Form 14-317 last month and found a great service that has 6 million forms . If others are searching for TX Travis County Form 14-317 also , here's a http://pdf.ac/2pSYFo http://pdf.ac/2pSYFo
- deleted 10y ago[deleted]