5 ms·

While most of the doc focused on StartCom/WoSign, I thought this bit at the end was interesting: > no longer accept audits carried out by Ernst & Young (Hong K

by pquerna 10y ago

While most of the doc focused on StartCom/WoSign, I thought this bit at the end was interesting: > no longer accept audits carried out by Ernst & Young (Hong Kong). To reject audits from E&Y.... It makes me wonder about the transparency and trust we put in the auditors as being a key part of CA validation process.

chillydawg 10y ago
Auditors and ratings agencies and their ilk are a fundamentally broken service in our society. On the one hand they have to make money and on the other they have to be honest. The two are simply not compatible, seemingly. Eg: ratings agencies happily giving top tier ratings to mortgages back in pre 2008.
- pquerna 10y ago
  Completely Agree! When you think down this path, its why Certificate Transparency Logs make even more sense -- Yes, its still ideal that a CA operates in a "good" way, but using the Cert Logs you know everything they have signed, so a rouge actor has a limited ability to sign something they shouldn't, and as seen by Mozilla's document, they used the Cert Transparency logs as part of their evidence.
tomjen3 10y ago
Isn't that only E&Y Hong Kong, though? Really at this point I don't know why anybody in China, or any country known for its corruption, should be accepted as auditors.
- jrockway 10y ago
  You're painting 1 billion people with a rather broad brush.
  - rocqua 10y ago
    He's only painting the authorities of those people with a broad brush. If something was confirmed from a chinese authority (private or public) would you trust that more, less, or the same due to the 'chinese' specifier?
  - angry_octet 10y ago
    No, it is pretty well established that countries have corruption problems, and cultural attitudes can be at variance to what you would expect. Many practices we would find outragously corrupt are common in China, with no recourse through the legal system. https://www.transparency.org/country/#CHN https://www.transparency.org/country/#CHN
    - jdiez17 10y ago
      That's a tautology. "cultural attitudes can be at variance to what you would expect" anywhere.
      - angry_octet 10y ago
        Not really, you could refute it by showing that cultural attitudes are the same everywhere. It is simply stating that across 1.5B people there is no certainty that a cultural assumption (especially from an occidental viewpoint) should hold. I should perhaps backtrack to emphasize that HK generally has much greater transparency and adherence to law than mainland China, and I would have no hesitation is choosing a HK firm to do work. I just think they had inexperienced people and stuffed up. Great mainland Chinese concept to study: xiaojinku, little company slush funds for rewards, gifts, making and receiving bribes, and rainy days. All part of guanxi.

by pquerna 10y ago

chillydawg 10y ago

Auditors and ratings agencies and their ilk are a fundamentally broken service in our society. On the one hand they have to make money and on the other they have to be honest. The two are simply not compatible, seemingly. Eg: ratings agencies happily giving top tier ratings to mortgages back in pre 2008.

pquerna 10y ago
Completely Agree! When you think down this path, its why Certificate Transparency Logs make even more sense -- Yes, its still ideal that a CA operates in a "good" way, but using the Cert Logs you know everything they have signed, so a rouge actor has a limited ability to sign something they shouldn't, and as seen by Mozilla's document, they used the Cert Transparency logs as part of their evidence.

tomjen3 10y ago

Isn't that only E&Y Hong Kong, though? Really at this point I don't know why anybody in China, or any country known for its corruption, should be accepted as auditors.

jrockway 10y ago
You're painting 1 billion people with a rather broad brush.
- rocqua 10y ago
  He's only painting the authorities of those people with a broad brush. If something was confirmed from a chinese authority (private or public) would you trust that more, less, or the same due to the 'chinese' specifier?
- angry_octet 10y ago
  No, it is pretty well established that countries have corruption problems, and cultural attitudes can be at variance to what you would expect. Many practices we would find outragously corrupt are common in China, with no recourse through the legal system. https://www.transparency.org/country/#CHN https://www.transparency.org/country/#CHN
  - jdiez17 10y ago
    That's a tautology. "cultural attitudes can be at variance to what you would expect" anywhere.
    - angry_octet 10y ago
      Not really, you could refute it by showing that cultural attitudes are the same everywhere. It is simply stating that across 1.5B people there is no certainty that a cultural assumption (especially from an occidental viewpoint) should hold. I should perhaps backtrack to emphasize that HK generally has much greater transparency and adherence to law than mainland China, and I would have no hesitation is choosing a HK firm to do work. I just think they had inexperienced people and stuffed up. Great mainland Chinese concept to study: xiaojinku, little company slush funds for rewards, gifts, making and receiving bribes, and rainy days. All part of guanxi.