6 ms·
"Bad Actors" in the tech field tend to flock together. Comodo has been at the center of several really ugly stories, this one being the latest. The CEO of Comod
by originalsimba 9y ago
"Bad Actors" in the tech field tend to flock together. Comodo has been at the center of several really ugly stories, this one being the latest. The CEO of Comodo attempted to sue Lets Encrypt before they launched, in order to kill the project because of the threat it represented to their business model. after 24 hours of backlash from the internet public he backed down and said it was all a misunderstanding. Of course.
Cloudflare uses Comodo for their SSL. They could use some other cert authority, but they chose to use Comodo. This is on topic, in a general sense of CAs and trust. It bears repeating: Bad actors tend to flock together.
- sneak 9y agoYour argument for guilt by association is not compelling. Cloudflare is their customer. I am Cloudflare’s customer. Does that make me a bad actor too?
- deleted 9y ago[deleted]
- Bombthecat 9y agoThe question is: why does cloadflrare even use them? There are like ten thousand other options...
- PuffinBlue 9y agoI believe at the time they deployed their Universal SSL, which was over four years ago, is absolutely massive scale, and is free, they were the partner that could actually deliver the necessary integration and infrastructure to handle that sort of load. Also, they were amongst the only ones to offer ECDSA certificates IIRC. Cloudflare detailed a little bit about this in this and other blog posts: https://blog.cloudflare.com/universal-ssl-how-it-scales/ https://blog.cloudflare.com/universal-ssl-how-it-scales/
- prdonahue 9y agoWe use several CAs to issue—Comodo, DigiCert, GlobalSign—and will be adding Let's Encrypt once they support i) SHA-2/ECDSA signatures and ii) wildcards. Having multiple issuers is important for us as each CA, at some point in time, has operational issues. Additionally, as you've seen with Symantec, browsers take action to distrust certain issuers/roots. When either of these scenarios happens, our customers don't care if it's the third-party that's down—they expect fast and reliable issuance from us (Cloudflare).
- originalsimba 9y agoIf Cloudflare wants wildcards it's so they can have multiple customers, each using completely different origin servers, on a single certificate, which makes those certificates worthless, and I hope Let's Encrypt blacklists Cloudflare from using them when wildcards are launched.
- niij 9y agoHow is that misusing a wildcard certificate? Should proxy server websites be HTTP only since the content is loaded from a different origin server?
- originalsimba 9y agoWhy does a proxy server need to decrypt traffic to serve it? Why can't it simply _act as a proxy_? What Cloudflare does is dangerous to the integrity of safe browsing, for a variety of reasons. And their aggressive marketing to convince a lot of tech-ignorant people with low traffic websites that they need a CDN is harmful. Is it too much to ask that their service at least operate in a way that doesn't poison the internet they're getting rich from?
- duskwuff 9y agoWhat you're describing is a multi-domain certificate, not a wildcard. Let's Encrypt already supports multi-domain certificates.
- jgrahamc 9y ago
- djsumdog 9y agoContinued usage of Cloudflare baffles me. They spewed tons of private data, across customer boundaries, on random web responses, which made its way into search engine cache around the world. They conducted an act of Internet censorship: https://fightthefuture.org/article/the-new-era-of-corporate-censorship/ https://fightthefuture.org/article/the-new-era-of-corporate-... ..and the CTO who made that decision later backed down and said he wouldn't make that same decision again. O_o I really feel like the biggest reason they're still in business is that very few alternatives offer anything really competitive.
- sneak 9y agoKeeping nazis off of servers one owns/rents themselves is not censorship.
- niij 9y agoHow is that not censorship? Their opinions are wrong and disgusting but kicking them as a customer for their beliefs is very obviously censorship.
- tialaramex 9y agoCensorship is something sovereign entities do. When anybody else chooses what they will or won't say we call that Free Speech. Nazis don't have a right to make other people say what they want. The fact that American TV networks weren't allowed to say "shithole" in reporting what the US President said is an example of censorship. The FCC, a government agency, requires that they not use certain words. When Fox decided to get rid of O'Reilly that's not censorship that's just basic ability to read how the wind is blowing.
- originalsimba 9y agoYou're speaking of a strict definition of censorship which is when an authoritative body is the one censoring. And you are not wrong. Private censorship is still censorship, however. It is also a form of speech itself.
- originalsimba 9y agoI'm not suggesting guilt by association. What I'm suggesting is that the crooked CEO of $Comodo and the crooked CEO of $Cloudflare probably made some back room deals where they laughed about how they'd be taking advantage of all the peasants who've made them both wealthy. I'm simply pointing out that when you have incompetent and crooked people in tech, they often run in packs. You might argue that altruism has no place in business but I disagree. When the CEO of Comodo launched his attack on Let's Encrypt, Cloudflare had opportunity to cut all ties with them. There's plenty of other CAs they could work with. They chose to ignore that scandal, and that matters.