6 ms·

I think it's unfair to treat the browser vendors as "other corporate entities" as if they don't have a direct relationship with the CAs. Essentially, a CA is a

I think it's unfair to treat the browser vendors as "other corporate entities" as if they don't have a direct relationship with the CAs. Essentially, a CA is a trust reseller. the browser vendors trust the owners of the root certificates, and the CAs resell that trust to websites. As a reseller, you are always beholden to the producer of the product your are selling. That's the nature of a resale business, and it makes perfect sense that the browser vendors, the "original manufacturer" of the product the CA is selling, has more influence over the CA's business than the FTC or the DOJ does.

CaliforniaKarl 9y ago
I didn't mean "other corporate entities" as a pejorative term. I was trying to come up with a generic descriptor, and since all of the browser makers have some sort of articles of incorporation (even Mozilla, at https://www.mozilla.org/en-US/foundation/documents/articles-of-incorporation/ https://www.mozilla.org/en-US/foundation/documents/articles-...), that's why I came up with "other corporate entities". The reseller analogy is interesting! But I think there is one thing missing from that, which is the exchange of value, or the contractual arrangement. As a customer of a CA, you possibly pay some form of money, and you always agree to some form of contract (in the form of Terms & Conditions). But the CA does not may money to the browser vendors, as far as I'm aware. And looking through some of the Mozilla CA Certificate Root Program bugs, I don't see any indication of contracts/T&Cs being agreed to, except what is implicit in the fact that prople are requesting inclusion. What makes this more confusing is that the CA's do pay money, to a third party in the form of auditors who make sure that the CA is following the various CAB Forum requirements. So it is hard for me to see this as a reseller type of arrangement.

CaliforniaKarl 9y ago

I didn't mean "other corporate entities" as a pejorative term. I was trying to come up with a generic descriptor, and since all of the browser makers have some sort of articles of incorporation (even Mozilla, at https://www.mozilla.org/en-US/foundation/documents/articles-of-incorporation/ https://www.mozilla.org/en-US/foundation/documents/articles-...), that's why I came up with "other corporate entities". The reseller analogy is interesting! But I think there is one thing missing from that, which is the exchange of value, or the contractual arrangement. As a customer of a CA, you possibly pay some form of money, and you always agree to some form of contract (in the form of Terms & Conditions). But the CA does not may money to the browser vendors, as far as I'm aware. And looking through some of the Mozilla CA Certificate Root Program bugs, I don't see any indication of contracts/T&Cs being agreed to, except what is implicit in the fact that prople are requesting inclusion. What makes this more confusing is that the CA's do pay money, to a third party in the form of auditors who make sure that the CA is following the various CAB Forum requirements. So it is hard for me to see this as a reseller type of arrangement.