3 ms·

People may feel uneasy about this, but what is the alternative? A few years ago we were in a situation where CAs basically could do whatever crap they want and

by hannob 9y ago

People may feel uneasy about this, but what is the alternative? A few years ago we were in a situation where CAs basically could do whatever crap they want and had to face no consequences at all. Google and Mozilla have at some point said "stop" and have started tightening rules. Ultimately if you operate a CA properly there is also little to fear. Don't issue certs for domains whose owners haven't asked for it, don't violate the rules that CAs and Browsers agreed upon, if mistakes happen be transparent about it, explain them and answer questions. No CA has faced any serious consequences for minor mistakes. The cases where CAs have faced consequences all had in common that major violations of rules happened multiple times.

forapurpose 9y ago
> People may feel uneasy about this, but what is the alternative? The FTC or Congress should regulate these things, not a volunteer, highly self-interested oligopoly. I think the government has not kept up: Just like law enforcement is not effective in protecting you against cybercrime, the FTC and Congress haven't kept up with trade issues on the Internet. It's 2017; these issues are no longer new. I like Mozilla, but in the long run there's not much reason to think that the current arrangement will take seriously the interests of users and consumers, as well as CAs, small browser vendors, others using public key crypto, and other stakeholders. Those people need a seat at the table, a vote, power. That's what democratic government and regulation are for: Situations where power should be distributed democratically, not to whomever has the most marketshare.
- hannob 9y ago
  > The FTC or Congress should regulate these things, not a volunteer, highly self-interested oligopoly. The Internet is not limited to the US. Also existing attempts of gov regulation of crypto aren't exactly a success story. We had two major fuckups very recently of crypto that had multiple government crypto-certifications.

by hannob 9y ago

forapurpose 9y ago

> People may feel uneasy about this, but what is the alternative? The FTC or Congress should regulate these things, not a volunteer, highly self-interested oligopoly. I think the government has not kept up: Just like law enforcement is not effective in protecting you against cybercrime, the FTC and Congress haven't kept up with trade issues on the Internet. It's 2017; these issues are no longer new. I like Mozilla, but in the long run there's not much reason to think that the current arrangement will take seriously the interests of users and consumers, as well as CAs, small browser vendors, others using public key crypto, and other stakeholders. Those people need a seat at the table, a vote, power. That's what democratic government and regulation are for: Situations where power should be distributed democratically, not to whomever has the most marketshare.

hannob 9y ago
> The FTC or Congress should regulate these things, not a volunteer, highly self-interested oligopoly. The Internet is not limited to the US. Also existing attempts of gov regulation of crypto aren't exactly a success story. We had two major fuckups very recently of crypto that had multiple government crypto-certifications.