2 ms·

So paying to a browser is good buy paying to a government is bad?

by bombolo 4y ago

netheril96 4y ago
The browser vendors know what they are doing. The government has no idea.
- bombolo 4y ago
  As if browser vendors never included any shady or incompetent root CA? For example: https://www.techtarget.com/searchsecurity/news/252436120/23000-Symantec-certificates-revoked-following-leak-of-private-keys https://www.techtarget.com/searchsecurity/news/252436120/230... Firefox seems to include root CA from the governments of: Hong Kong (so China?), Spain, Turkey, Tunisia, Netherlands.
  - olliej 4y ago
    And when they find evidence of a CA misbehaving they revoke them, as here, they don’t go to the EU and say “hey we think you need to re audit this company” and then wait a few months/years while the business continues to pay the EU to remain in the root stores.
olliej 4y ago
Wtf are you talking about? You don’t pay a browser to get your roots included. You file a bug report, and provide the supporting documentation and audits. If the relevant root program considers your supporting documentation sufficient, they include you. You cannot pay a root program to include your root certa, and any CA that was found to have done so would likely find other programs considering that to be a red flag.
- tialaramex 4y ago
  It's actually interesting. Three of the major trust stores are also OS vendors. Microsoft, Apple and Google. Each of those three actually just has a rather opaque "send us an email and we'll talk about it" type process. I don't think there's any implication that you can or should pay them money (indeed Microsoft is clear that there is "No Fee" for this), clearly none of these organisations is desperate for cash. But it's actually unclear what you can do besides maybe send email and hope. Mozilla's process is as you state to file a Bugzilla bug. You go in a big queue and there's eventually a public discussion on m.d.s.policy once you get to the front of the queue. Now, in theory there is no relationship between Mozilla's transparent process and say, Apple or Microsoft. Indeed even for Google there's only a rather thin relationship, the final decision is theirs but they do say you need to talk to Mozilla. But in practice the Mozilla process matters most.

So paying to a browser is good buy paying to a government is bad?

netheril96 4y ago

The browser vendors know what they are doing. The government has no idea.

bombolo 4y ago
As if browser vendors never included any shady or incompetent root CA? For example: https://www.techtarget.com/searchsecurity/news/252436120/23000-Symantec-certificates-revoked-following-leak-of-private-keys https://www.techtarget.com/searchsecurity/news/252436120/230... Firefox seems to include root CA from the governments of: Hong Kong (so China?), Spain, Turkey, Tunisia, Netherlands.
- olliej 4y ago
  And when they find evidence of a CA misbehaving they revoke them, as here, they don’t go to the EU and say “hey we think you need to re audit this company” and then wait a few months/years while the business continues to pay the EU to remain in the root stores.

olliej 4y ago

Wtf are you talking about? You don’t pay a browser to get your roots included. You file a bug report, and provide the supporting documentation and audits. If the relevant root program considers your supporting documentation sufficient, they include you. You cannot pay a root program to include your root certa, and any CA that was found to have done so would likely find other programs considering that to be a red flag.

tialaramex 4y ago
It's actually interesting. Three of the major trust stores are also OS vendors. Microsoft, Apple and Google. Each of those three actually just has a rather opaque "send us an email and we'll talk about it" type process. I don't think there's any implication that you can or should pay them money (indeed Microsoft is clear that there is "No Fee" for this), clearly none of these organisations is desperate for cash. But it's actually unclear what you can do besides maybe send email and hope. Mozilla's process is as you state to file a Bugzilla bug. You go in a big queue and there's eventually a public discussion on m.d.s.policy once you get to the front of the queue. Now, in theory there is no relationship between Mozilla's transparent process and say, Apple or Microsoft. Indeed even for Google there's only a rather thin relationship, the final decision is theirs but they do say you need to talk to Mozilla. But in practice the Mozilla process matters most.