4 ms·

> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. So how about we stop this proposal in its track right now in

> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. So how about we stop this proposal in its track right now instead?

AnIdiotOnTheNet 5y ago
Why? If given the choice between allowing corporate control of something and allowing an elected government control of something, it is not immediately obvious to me that leaving everything in corporate hands is a good idea.
- danShumway 5y ago
  You're right, it's not immediately obvious across the board. But in this very specific case, Mozilla is making an argument that the government standards are meaningfully less secure than their own. Involving a government doesn't magically make things better 100% of the time, the actual tangible proposal still has to be better than what is happening in the market. Is that the case here? We don't need to have an abstract argument about whether governments or private corporations are always better; look at the specifics of this proposal and see if they're good for browser security. We have a lot of data that suggests that EV certificates do not provide meaningful security because the "green lock" doesn't actually guarantee what consumers think it does. Independent of what you think about governments overall, is it good to have a new standard that ignores that research in favor of having yet another kind of special certificate that is displayed to users as more trustworthy? In this specific case, Camerfirma is still considered by the EU government to be a trustworthy certificate provider even though all major browsers have blocked the company for repeated mistakes/policy violations. Independent of whether or not you trust the government overall, is a standard that would require browsers to trust Camerfirma a good idea? I don't think we should immediately assume any government involvement in the market is a bad idea, but there's also real danger in saying, "well, in theory it might be preferable for this to be more democratic", and then never asking the followup question, "but in practice, is this specific proposal good?" Yes, you're 100% correct, it's not immediately obviously bad across the board for the government to control something. But when I go beyond what is immediately obvious to me, then I start seeing arguments from Mozilla and other security researchers that (in my mind) make a lot of sense.
- native_samples 5y ago
  EU isn't an elected government - the Parliament has no real power. EU is actually a dictatorship of bureaucrats. The current way TLS is managed has far more democratic legitimacy. You can pick your browser and operating system i.e. root store, and then edit it if you want. EU dictating one is worse in every possible respect.
  - feanaro 5y ago
    Exactly this. Trust must remain configurable by many instead of by a single authority.
- feanaro 5y ago
  Well, because as you can see, this law is already introducing strife where there should be none, by unskillfully requiring something that's not useful. What problem is this supposed to be solving again? By rolling out QWAC, we would be reducing the agility of the ecosystem and preventing automated certificate issuance methods like LetsEncrypt which have improved the status quo immensely. And for what gain? This is not a debate over whether certificate issuance should be controlled by corporations versus the government.

> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. So how about we stop this proposal in its track right now instead?

AnIdiotOnTheNet 5y ago

Why? If given the choice between allowing corporate control of something and allowing an elected government control of something, it is not immediately obvious to me that leaving everything in corporate hands is a good idea.

danShumway 5y ago
You're right, it's not immediately obvious across the board. But in this very specific case, Mozilla is making an argument that the government standards are meaningfully less secure than their own. Involving a government doesn't magically make things better 100% of the time, the actual tangible proposal still has to be better than what is happening in the market. Is that the case here? We don't need to have an abstract argument about whether governments or private corporations are always better; look at the specifics of this proposal and see if they're good for browser security. We have a lot of data that suggests that EV certificates do not provide meaningful security because the "green lock" doesn't actually guarantee what consumers think it does. Independent of what you think about governments overall, is it good to have a new standard that ignores that research in favor of having yet another kind of special certificate that is displayed to users as more trustworthy? In this specific case, Camerfirma is still considered by the EU government to be a trustworthy certificate provider even though all major browsers have blocked the company for repeated mistakes/policy violations. Independent of whether or not you trust the government overall, is a standard that would require browsers to trust Camerfirma a good idea? I don't think we should immediately assume any government involvement in the market is a bad idea, but there's also real danger in saying, "well, in theory it might be preferable for this to be more democratic", and then never asking the followup question, "but in practice, is this specific proposal good?" Yes, you're 100% correct, it's not immediately obviously bad across the board for the government to control something. But when I go beyond what is immediately obvious to me, then I start seeing arguments from Mozilla and other security researchers that (in my mind) make a lot of sense.
native_samples 5y ago
EU isn't an elected government - the Parliament has no real power. EU is actually a dictatorship of bureaucrats. The current way TLS is managed has far more democratic legitimacy. You can pick your browser and operating system i.e. root store, and then edit it if you want. EU dictating one is worse in every possible respect.
- feanaro 5y ago
  Exactly this. Trust must remain configurable by many instead of by a single authority.
feanaro 5y ago
Well, because as you can see, this law is already introducing strife where there should be none, by unskillfully requiring something that's not useful. What problem is this supposed to be solving again? By rolling out QWAC, we would be reducing the agility of the ecosystem and preventing automated certificate issuance methods like LetsEncrypt which have improved the status quo immensely. And for what gain? This is not a debate over whether certificate issuance should be controlled by corporations versus the government.