10 ms·

On the one hand we argue the Internet should be global and not get Balkanized and on the other hand we arbitrarily select certain countries to place lesser or h

On the one hand we argue the Internet should be global and not get Balkanized and on the other hand we arbitrarily select certain countries to place lesser or higher trust in. Someone in China could legitimately have a similar low level of trust for US root certs and he/she would not be far wrong given that NSLs can gag companies into complying with arbitrary dictums that no one ever knows about.

gowld 7y ago
Don't confuse a "country" with a "government". The Internet is global, but that doesn't mean I trust every person on it. That's why we have spam filters and block lists and cert trust lists.
bananabreakfast 7y ago
That's some nice whataboutism you got there
tuxracer 7y ago
The risk of the communication being compromised isn't necessarily the sole concern. There are also varying levels of consequences for various types of communication for different countries. When it comes to a country that has developed extensive censorship mechanisms and it's casually accepted that one could face a visit from the police or jailed for criticizing its leader or party it doesn't seem completely arbitrary to have some additional concern when it comes to that country possibly compromising your communication.
chongli 7y ago
The original hacker dream of the internet was that it would break down borders and open up the free flow of information. Now that non-hacker types (politicians and bureaucrats, mainly) have had access for a few decades, they've realized how powerful a tool it is for empowering their authoritarian impulses. Call me cynical but I think it's only a matter of time before the internet becomes totally Balkanized. Heck, it's almost there right now.
- ferzul 7y ago
  we have ports for everything else, internet ports will come. it'll suck for me.
jopsen 7y ago
> Someone in China could legitimately have a similar low level of trust for US root certs... I love bashing America as much as the next guy, but equating it to China in terms of trust is not fair.
- vbezhenar 7y ago
  I live in Kazakhstan and I absolutely don't trust US. I don't fully trust Kazakhstani government either, but at least I know that they won't act hostile to me. I'm not removing US CAs, because it would be absurd, but I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission (and even without clear way to manually trust it again). IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business.
  - microcolonel 7y ago
    > * I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission* But you can understand why, by default, anyone who doesn't live in Kazakhstan has little to gain from trusting those CAs. The default roots are default for everyone, at the moment, so they need to be universal. Maybe they should have some sort of detection, i.e. "we see you're in Kazakhstan, trying to access this Kazakh site which is only available with this distrusted CA, would you like to trust this certificate?" > IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business. It's kinda two things, "letting" citizens submit to their governments with your software is different from specifically enabling it, which seems like what you're suggesting. Out of principle, I won't be making any particular effort to enable a "government to act on their citizens as they want", because that is immoral. If you want software that goes out of its way to oppress you, then you can write it yourself, or find somebody who will take money for that.
    - chopin 7y ago
      I would prefer that root certificates have restriction on what they can sign, eg. a Khazachstan root certificate can't legitimately sign a .com certificate. I think that not having this is a fundamental flaw in the certificate setup.
Faark 7y ago
As someone from neither the US nor China, I'd prefer CAs from both (and more) coming to a consensus. "All but X declared this site fine" sounds a lot more convincing to me. Sure, down the line the owner of the site will still be a single breaking point for that site. But I really don't like having to trust additional individual organizations.

gowld 7y ago

Don't confuse a "country" with a "government". The Internet is global, but that doesn't mean I trust every person on it. That's why we have spam filters and block lists and cert trust lists.

bananabreakfast 7y ago

That's some nice whataboutism you got there

tuxracer 7y ago

The risk of the communication being compromised isn't necessarily the sole concern. There are also varying levels of consequences for various types of communication for different countries. When it comes to a country that has developed extensive censorship mechanisms and it's casually accepted that one could face a visit from the police or jailed for criticizing its leader or party it doesn't seem completely arbitrary to have some additional concern when it comes to that country possibly compromising your communication.

chongli 7y ago

The original hacker dream of the internet was that it would break down borders and open up the free flow of information. Now that non-hacker types (politicians and bureaucrats, mainly) have had access for a few decades, they've realized how powerful a tool it is for empowering their authoritarian impulses. Call me cynical but I think it's only a matter of time before the internet becomes totally Balkanized. Heck, it's almost there right now.

ferzul 7y ago
we have ports for everything else, internet ports will come. it'll suck for me.

jopsen 7y ago

> Someone in China could legitimately have a similar low level of trust for US root certs... I love bashing America as much as the next guy, but equating it to China in terms of trust is not fair.

vbezhenar 7y ago
I live in Kazakhstan and I absolutely don't trust US. I don't fully trust Kazakhstani government either, but at least I know that they won't act hostile to me. I'm not removing US CAs, because it would be absurd, but I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission (and even without clear way to manually trust it again). IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business.
- microcolonel 7y ago
  > * I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission* But you can understand why, by default, anyone who doesn't live in Kazakhstan has little to gain from trusting those CAs. The default roots are default for everyone, at the moment, so they need to be universal. Maybe they should have some sort of detection, i.e. "we see you're in Kazakhstan, trying to access this Kazakh site which is only available with this distrusted CA, would you like to trust this certificate?" > IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business. It's kinda two things, "letting" citizens submit to their governments with your software is different from specifically enabling it, which seems like what you're suggesting. Out of principle, I won't be making any particular effort to enable a "government to act on their citizens as they want", because that is immoral. If you want software that goes out of its way to oppress you, then you can write it yourself, or find somebody who will take money for that.
  - chopin 7y ago
    I would prefer that root certificates have restriction on what they can sign, eg. a Khazachstan root certificate can't legitimately sign a .com certificate. I think that not having this is a fundamental flaw in the certificate setup.

Faark 7y ago

As someone from neither the US nor China, I'd prefer CAs from both (and more) coming to a consensus. "All but X declared this site fine" sounds a lot more convincing to me. Sure, down the line the owner of the site will still be a single breaking point for that site. But I really don't like having to trust additional individual organizations.