5 ms·

Mozilla is killing StartCom. Chrome has not announced a decision yet, although I predict that they will also distrust.

• gcp 10y ago
  It's pertinent in this matter that one of the authors of the report works on the Chromium TLS stack. But it's not clear to me whether Chrome has an independent CA program. They use the Microsoft CA store on Windows, and at some point were using NSS (and hence the Mozilla certs) on Unixes. I presume they can always just additionally block this CA in Chrome, though.
  • agwa 10y ago
    Ryan Sleevi authored the report in his capacity as a peer of the Mozilla CA Certificates Module, not as a Chrome/Google employee. See https://wiki.mozilla.org/CA:Policy_Participants https://wiki.mozilla.org/CA:Policy_Participants Chrome does indeed use the platform CA store, but they can and do impose additional logic on top of it, such as requiring CT for Symantec, distrusting new CNNIC certs, or name-constraining ANSSI and India CCA.
    • gcp 10y ago
      Yes, but it begs the question why a Google employee working on Chromium is a peer of that module in the first place. It's because Google is a user, right?
      • Osmose 10y ago
        It's not because Google is a user, but rather because he has contributed a significant amount to the part of the Mozilla project that that module covers. That's generally how module peers and owners are nominated / chosen. Now the fact that he is an employee working on Chromium may be the reason why he ended up contributing to that part of Mozilla a bunch, but it's not supposed to be "Google gets a peer on the CA module".
      • agwa 10y ago
        The decision by Mozilla has absolutely no bearing on Chromium. Although Chromium indirectly uses the NSS root store when run on a Linux distro that uses the NSS root store, the logic proposed by Mozilla will be implemented at a higher layer than the root store, meaning Chromium won't be affected by it.
      • gsnedders 10y ago
        It's worthwhile pointing out that many of the original Chromium developers were previously employed by Google to work on Firefox. Now, I don't know whether this is true in Ryan's case, but it doesn't seem that surprising at the end of the day. Equally, Google ultimately has an interest in the security of the web platform (as well as its interoperability), as their entire business is built on it. They'd have a far harder time selling some of their products if people believed it to be insecure.
  • Angostura 10y ago
    Pertinent, rather than poignant?
    • gcp 10y ago
      Yes, thanks.