3 ms·

Wow, this would be devastating if they actually went through with revoking their root certificate. StartCom is (well, was) the only competition to Let's Encryp

by byuu 10y ago

Wow, this would be devastating if they actually went through with revoking their root certificate. StartCom is (well, was) the only competition to Let's Encrypt in the free certificate space. It is far and away the cheapest direct provider of wildcard certificates (which are impossible to get for free), unless you move into reseller territory. And even their free certificates last four times as long, and don't require the use of certbot. Certainly, Let's Encrypt works great for a lot of peoples' needs. But for those it doesn't (and there's more of them than you might think), this is seriously bad news. It's easy to get onboard wanting to punish WoSign/StartCom here, but keep in mind that this has the potential to screw over all of their innocent customers as well. (Future customers with the first action; all customers if the second action comes to pass and they revoke the root CA.) And screwing them could likely mean they abandon HTTPS completely instead. Note that I am not advocating for Mozilla to give them a pass; far from it. If anything, this is just one more indictment on the long list of reasons why the entire CA system is completely broken. I actually just recently purchased a certificate, and had my choices narrowed down to StartSSL or AlphaSSL. I am really glad I went with the latter right about now. I can't tell you how absolutely livid I would become if Mozilla ended up revoking my root CA after dropping over $100 on my certificate.

homero 10y ago
True but you're forgetting that it may be cheap to cover up shady certs they throw in, distraction. Like all the money laundering resorts in Cancun.
yrro 10y ago
Surely you could have demanded a refund if you had chosen StartSSL and they sold you what turned out to be a defective product?
- inimino 10y ago
  Good luck collecting after the company's potential future revenue has been erased.
  - byuu 10y ago
    Best recourse would be a credit card chargeback. If Paypal, probably a writeoff. The trickier part is, it's unknown whether StartCom will backdate more certificates, triggering Mozilla to block them entirely. That could happen well after the window where you're allowed to request a chargeback. Although I do believe it's extremely unlikely that they will. Unless Google and Microsoft follow suit, such an action is just as likely to damage Mozilla as it is to damage StartCom. People who just want to access websites will not bother to understand the reason why suddenly only Firefox is refusing to let them view their pages.

by byuu 10y ago

homero 10y ago

True but you're forgetting that it may be cheap to cover up shady certs they throw in, distraction. Like all the money laundering resorts in Cancun.

yrro 10y ago

Surely you could have demanded a refund if you had chosen StartSSL and they sold you what turned out to be a defective product?

inimino 10y ago
Good luck collecting after the company's potential future revenue has been erased.
- byuu 10y ago
  Best recourse would be a credit card chargeback. If Paypal, probably a writeoff. The trickier part is, it's unknown whether StartCom will backdate more certificates, triggering Mozilla to block them entirely. That could happen well after the window where you're allowed to request a chargeback. Although I do believe it's extremely unlikely that they will. Unless Google and Microsoft follow suit, such an action is just as likely to damage Mozilla as it is to damage StartCom. People who just want to access websites will not bother to understand the reason why suddenly only Firefox is refusing to let them view their pages.