4 ms·

Ryan Sleevi authored the report in his capacity as a peer of the Mozilla CA Certificates Module, not as a Chrome/Google employee. See https://wiki.mozilla.org/

by agwa 10y ago

Ryan Sleevi authored the report in his capacity as a peer of the Mozilla CA Certificates Module, not as a Chrome/Google employee. See https://wiki.mozilla.org/CA:Policy_Participants https://wiki.mozilla.org/CA:Policy_Participants Chrome does indeed use the platform CA store, but they can and do impose additional logic on top of it, such as requiring CT for Symantec, distrusting new CNNIC certs, or name-constraining ANSSI and India CCA.

gcp 10y ago
Yes, but it begs the question why a Google employee working on Chromium is a peer of that module in the first place. It's because Google is a user, right?
- Osmose 10y ago
  It's not because Google is a user, but rather because he has contributed a significant amount to the part of the Mozilla project that that module covers. That's generally how module peers and owners are nominated / chosen. Now the fact that he is an employee working on Chromium may be the reason why he ended up contributing to that part of Mozilla a bunch, but it's not supposed to be "Google gets a peer on the CA module".
- agwa 10y ago
  The decision by Mozilla has absolutely no bearing on Chromium. Although Chromium indirectly uses the NSS root store when run on a Linux distro that uses the NSS root store, the logic proposed by Mozilla will be implemented at a higher layer than the root store, meaning Chromium won't be affected by it.
- gsnedders 10y ago
  It's worthwhile pointing out that many of the original Chromium developers were previously employed by Google to work on Firefox. Now, I don't know whether this is true in Ryan's case, but it doesn't seem that surprising at the end of the day. Equally, Google ultimately has an interest in the security of the web platform (as well as its interoperability), as their entire business is built on it. They'd have a far harder time selling some of their products if people believed it to be insecure.

by agwa 10y ago

gcp 10y ago

Yes, but it begs the question why a Google employee working on Chromium is a peer of that module in the first place. It's because Google is a user, right?

Osmose 10y ago
It's not because Google is a user, but rather because he has contributed a significant amount to the part of the Mozilla project that that module covers. That's generally how module peers and owners are nominated / chosen. Now the fact that he is an employee working on Chromium may be the reason why he ended up contributing to that part of Mozilla a bunch, but it's not supposed to be "Google gets a peer on the CA module".
agwa 10y ago
The decision by Mozilla has absolutely no bearing on Chromium. Although Chromium indirectly uses the NSS root store when run on a Linux distro that uses the NSS root store, the logic proposed by Mozilla will be implemented at a higher layer than the root store, meaning Chromium won't be affected by it.
gsnedders 10y ago
It's worthwhile pointing out that many of the original Chromium developers were previously employed by Google to work on Firefox. Now, I don't know whether this is true in Ryan's case, but it doesn't seem that surprising at the end of the day. Equally, Google ultimately has an interest in the security of the web platform (as well as its interoperability), as their entire business is built on it. They'd have a far harder time selling some of their products if people believed it to be insecure.