4 ms·

The thing I found somewhat baffling is that they didn't renew the certificate because they were certain that Firefox wasn't checking the certificate expiration.

The thing I found somewhat baffling is that they didn't renew the certificate because they were certain that Firefox wasn't checking the certificate expiration. I'm wondering why they didn't renew the certificate and then implement a certificate expiration check. I don't mean to be too harsh, but that part of the post-mortem reads like, "Oh, we don't need to renew our intermediate signing certificate because there's a known security vulnerability in Firefox that allows us to get around it."

Yoric 7y ago
Well, it's the kind of errors that happens when two teams forget to communicate.
- luckylion 7y ago
  But the communication is just the "why they thought it wouldn't be a big deal". The "why would you let a certificate expire that is actively used in code signing" is a different issue.
TwoNineFive 7y ago
No, it's not baffling. It's white-washing and blame-shifting. "it turns out to be more complicated" = It's even worse than you probably imagined. We knew the certificate was going to expire and willingly let it happen because we don't know how our own product works. Also look at this new update mechanism and the other problems we caused! Forget about the fact that none of this makes any sense and please don't fire me for gross incompetence. This was always a no-win situation for the people responsible. Allowing a certificate to expire has no reasonable justifications possible. It was always just going to be a question of if anyone would actually be held accountable for negligence or if they would excuse and blame-shift their way out of it. I don't mean to be so negative about it. The silver lining could have been setting an example of doing a real investigation, finding that people were negligent, and holding those negligent people accountable, but I don't see that happening here because the people doing the investigating are the ones responsible. The "it turns out to be more complicated" quote reminds me of Russ Roberts from Econ Talk. He has a number of interesting mannerisms that clearly signals his personal opinion on things. He doesn't come out and say "That's a terrible idea and I disagree!". Instead he whines "Well I'm not so sure." And when some study or evidence goes against his preconceived ideas or biases he says "Well, it's complicated".

Yoric 7y ago

Well, it's the kind of errors that happens when two teams forget to communicate.

luckylion 7y ago
But the communication is just the "why they thought it wouldn't be a big deal". The "why would you let a certificate expire that is actively used in code signing" is a different issue.

TwoNineFive 7y ago

No, it's not baffling. It's white-washing and blame-shifting. "it turns out to be more complicated" = It's even worse than you probably imagined. We knew the certificate was going to expire and willingly let it happen because we don't know how our own product works. Also look at this new update mechanism and the other problems we caused! Forget about the fact that none of this makes any sense and please don't fire me for gross incompetence. This was always a no-win situation for the people responsible. Allowing a certificate to expire has no reasonable justifications possible. It was always just going to be a question of if anyone would actually be held accountable for negligence or if they would excuse and blame-shift their way out of it. I don't mean to be so negative about it. The silver lining could have been setting an example of doing a real investigation, finding that people were negligent, and holding those negligent people accountable, but I don't see that happening here because the people doing the investigating are the ones responsible. The "it turns out to be more complicated" quote reminds me of Russ Roberts from Econ Talk. He has a number of interesting mannerisms that clearly signals his personal opinion on things. He doesn't come out and say "That's a terrible idea and I disagree!". Instead he whines "Well I'm not so sure." And when some study or evidence goes against his preconceived ideas or biases he says "Well, it's complicated".