5 ms·

> Someone in China could legitimately have a similar low level of trust for US root certs... I love bashing America as much as the next guy, but equating it to

by jopsen 7y ago

> Someone in China could legitimately have a similar low level of trust for US root certs... I love bashing America as much as the next guy, but equating it to China in terms of trust is not fair.

vbezhenar 7y ago
I live in Kazakhstan and I absolutely don't trust US. I don't fully trust Kazakhstani government either, but at least I know that they won't act hostile to me. I'm not removing US CAs, because it would be absurd, but I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission (and even without clear way to manually trust it again). IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business.
- microcolonel 7y ago
  > * I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission* But you can understand why, by default, anyone who doesn't live in Kazakhstan has little to gain from trusting those CAs. The default roots are default for everyone, at the moment, so they need to be universal. Maybe they should have some sort of detection, i.e. "we see you're in Kazakhstan, trying to access this Kazakh site which is only available with this distrusted CA, would you like to trust this certificate?" > IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business. It's kinda two things, "letting" citizens submit to their governments with your software is different from specifically enabling it, which seems like what you're suggesting. Out of principle, I won't be making any particular effort to enable a "government to act on their citizens as they want", because that is immoral. If you want software that goes out of its way to oppress you, then you can write it yourself, or find somebody who will take money for that.
  - chopin 7y ago
    I would prefer that root certificates have restriction on what they can sign, eg. a Khazachstan root certificate can't legitimately sign a .com certificate. I think that not having this is a fundamental flaw in the certificate setup.
    - thu2111 7y ago
      X.509 has supported this for a long time and so have browsers, iirc Chrome restricted some French CA to specific domains at one point. The issue here is not so much technical as cultural. Mozilla employees don't know or care about people from Kazakhstan and didn't prioritise finding ways to reduce the disruption.
  - lmm 7y ago
    > But you can understand why, by default, anyone who doesn't live in Kazakhstan has little to gain from trusting those CAs. No more or less than any other root CA? They're run by the legitimate, internationally recognised, democratically elected government of Kazakhstan. I'd expect many Kazakh businesses to have a certification path with that CA at the root; that seems like no more or less legitimate a root certificate than, I don't know, Deutsche Telekom or VeriSign or whoever. Currently I use more websites that are based in the US or Germany than are based in Kazakhstan, sure, but it's not like there aren't legitimate web businesses in every country.
    - microcolonel 7y ago
      Being elected in Kazakhstan makes them legitimate in Kazakhstan, it doesn't make their international behaviour acceptable to everyone.
      - lmm 7y ago
        We're not talking about some pariah state here. Kazakhstan is pretty close to a model international citizen; they've not started any wars, they're not accused of hacking or spying on anyone or interfering in other countries. It's hard to imagine any reasonable standard that would exclude Kazakhstan but include enough countries to reasonably qualify as international.

by jopsen 7y ago

> Someone in China could legitimately have a similar low level of trust for US root certs... I love bashing America as much as the next guy, but equating it to China in terms of trust is not fair.

vbezhenar 7y ago

I live in Kazakhstan and I absolutely don't trust US. I don't fully trust Kazakhstani government either, but at least I know that they won't act hostile to me. I'm not removing US CAs, because it would be absurd, but I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission (and even without clear way to manually trust it again). IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business.

microcolonel 7y ago
> * I'm actually pretty angry at Firefox blacklisting some KZ certificates without my permission* But you can understand why, by default, anyone who doesn't live in Kazakhstan has little to gain from trusting those CAs. The default roots are default for everyone, at the moment, so they need to be universal. Maybe they should have some sort of detection, i.e. "we see you're in Kazakhstan, trying to access this Kazakh site which is only available with this distrusted CA, would you like to trust this certificate?" > IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business. It's kinda two things, "letting" citizens submit to their governments with your software is different from specifically enabling it, which seems like what you're suggesting. Out of principle, I won't be making any particular effort to enable a "government to act on their citizens as they want", because that is immoral. If you want software that goes out of its way to oppress you, then you can write it yourself, or find somebody who will take money for that.
- chopin 7y ago
  I would prefer that root certificates have restriction on what they can sign, eg. a Khazachstan root certificate can't legitimately sign a .com certificate. I think that not having this is a fundamental flaw in the certificate setup.
  - thu2111 7y ago
    X.509 has supported this for a long time and so have browsers, iirc Chrome restricted some French CA to specific domains at one point. The issue here is not so much technical as cultural. Mozilla employees don't know or care about people from Kazakhstan and didn't prioritise finding ways to reduce the disruption.
- lmm 7y ago
  > But you can understand why, by default, anyone who doesn't live in Kazakhstan has little to gain from trusting those CAs. No more or less than any other root CA? They're run by the legitimate, internationally recognised, democratically elected government of Kazakhstan. I'd expect many Kazakh businesses to have a certification path with that CA at the root; that seems like no more or less legitimate a root certificate than, I don't know, Deutsche Telekom or VeriSign or whoever. Currently I use more websites that are based in the US or Germany than are based in Kazakhstan, sure, but it's not like there aren't legitimate web businesses in every country.
  - microcolonel 7y ago
    Being elected in Kazakhstan makes them legitimate in Kazakhstan, it doesn't make their international behaviour acceptable to everyone.
    - lmm 7y ago
      We're not talking about some pariah state here. Kazakhstan is pretty close to a model international citizen; they've not started any wars, they're not accused of hacking or spying on anyone or interfering in other countries. It's hard to imagine any reasonable standard that would exclude Kazakhstan but include enough countries to reasonably qualify as international.