7 ms·

I’m pretty disappointed by this outcome. I read the entire thread. If you skim the thread and just read the sensational responses then it paints a pretty grim n

by dcow 4y ago

I’m pretty disappointed by this outcome. I read the entire thread. If you skim the thread and just read the sensational responses then it paints a pretty grim narrative of a CA that cant be transparent. But if you actually read Rachel’s responses she responds to every single accusation several times over. Yeah it’s a word swamp to wade through and the repeated context was annoying, but her company is under attack… what would you do? Would you not try to provide as much rebuttal as possible? It’s pretty… idk… irreverent to take the stance: oh gosh look at this person squirming under pressure to defend themselves why would they do that they must be guilty and malicious. I can smell it! It really feels like a perversely inappropriate forum for discussing a complicated issue like that. Rachel wasn’t trying to deceive so much as she was tying to set guidelines for appropriate review of the material at hand. And then the comment at the end to her when she was simply trying to make sure the transition happens cordially without breaking existing certificates as seems is the intention, “why does Microsoft need to answer to you?”, is just snotty on a whole new level. Honestly it makes me think we need special courts and some sort of process to handle this stuff because people don’t have time to… process. I am probably in the minority here, but I can’t help but feel like Rachel was a victim of a sloppy but effective smear campaign. I suspect the outcome would have been different if this was handled in a court of law.

stevewatson301 4y ago
I'm not seeing where she's provided answers to the questions that really matter. All she's done is to talk in a patronizing manner to the CA members regarding their inability to understand corporate structures, as well as never answering how or why a MITM companies' SDK ended up being embedded in their app. Further, even in times of stress, lashing out isn't the best decision. If I were interrogated by a cop and I called them a bunch of names, I would attract additional charges, on top of being suspected of commiting the crime that I've been accused of.
- dcow 4y ago
  She didn't lash out, everyone else did? She made it very clear numerous times that she didn't think the forum appropriate for discussion of speculation.
  - KptMarchewa 4y ago
    There were a lot of thinly veiled legal threats.
- themoonisachees 4y ago
  To be fair they do say (without proof but that can be hard to provide) that the spyware was put there by a contract developer that was not authorized to add 3rd party tools but did anyway. That being said, given how extremely evasive they were and the lack of any tangible proof, I don't think it is unreasonable to doubt this explanation (how come you think a contract dev implementing malware isn't grounds for a lawsuit, shouldn't that be an open and shut case?)
  - dcow 4y ago
    She also said they we advised legally against pursing legal action and damages, though it crossed their minds.
    - themoonisachees 4y ago
      well, silver lining is that they now have provable damages from this dev's actions in that it played a role in sinking their business.
      - willcipriano 4y ago
        The dev will just pull up the Jira ticket that says "Add malware to app" in court. That's why they were advised not to sue.
        KingOfCoders 4y ago
        Hopefully he made a screenshot. I'm advising people for a long time now to make screenshots of emails etc. - at least have everything in writing, don't act on phone calls if you feel things are "in a grayzone" (happens often in startups).
        yakak 4y ago
        Its pretty clear that a dev with a second degree in law still wouldn't have been able to determine whether companies that shared most of the same infrastructure and listed corporate officers were 3rd parties in the context of software, without grilling someone who may or may not be a Trustcor executive, may or may not be the past founder and may or may not be dead, where such a death neither implies nor dismisses the possibility that they are still running the company.
- berkut 4y ago
  Where are you seeing her "lash" out? I can't see anything I'd describe that way in the (original) thread...
  - stevewatson301 4y ago
    This response by Rachel McPherson from Trustcor definitely comes as lashing out" > Apparently it may also come as a surprise to some readers and the researchers themselves that other root program members are in fact international governments, and some are also defense companies, or companies who are wholly-owned by defense companies and/or state-owned enterprises, meaning "businesses" that are completely owned or controlled by governments. Further, some of those governments are not free/democratic and in fact some have tragic modern histories of basic human rights violations. We are none of those things and our company does not identify with those values. Given this point above, why of all potential targets are these researchers interested in TrustCor? They could go after countries with human rights violations that have placed a CA in the program.
    - berkut 4y ago
      Seriously!? I'd argue it could be termed "what-aboutism", but I personally fail to see how that matches my definition of "lashing out"...
      - CoastalCoder 4y ago
        > I'd argue it could be termed "what-aboutism", I agree that it's "what-aboutism". In that regard, it does nothing to establish that TrustCor meets the standards for being a CA. It does raise a good question for parallel discussion, though: Should Mozilla also be scrutinizing a whole bunch of other CAs as well?
      - shkkmo 4y ago
        > Apparently it may also come as a surprise to some readers and the researchers themselves that... This part in particular is what I would view as "lashing out"
- KingOfCoders 4y ago
  Not only "SDK ended up being embedded in their app" but why they had an unobfuscated version when everyone else has only an obfuscated version of that SDK.
di4na 4y ago
The problem here with Rachel behaviour is not if they are guilty or not. The problem here is that there is an expectation that a CA have a certain standard of behaviour and ability to handle... well adversarial situations. Because that is what a CA has to do! They are the beholder of our trust. By behaving like they do and more particularly not providing any of the proof asked in the process, Trust is broken. They do not demonstrate they have their shit together, do not demonstrate they understand the process nor the problem, and in general shows they are not equipped in term of knowledge and skills to be a CA. That they are guilty or not do not matter anymore at this point. They have failed at a more basic level of being a CA. They cannot do the things we expect a CA to do. Them being breached or using their power for bad things do not even matter anymore.
- dcow 4y ago
  In civil courts, the burden of proof lies with the accuser, usually. Because this is what happens if you let public opinion rule. It’s unfair to the accused and rarely ends in their favor, regardless of innocence or guilt, as you so clearly put it.
  - SkeuomorphicBee 4y ago
    Being a root CA is a privilege, not a right. A root CA has enormous power over the whole internet, so they must prove that they are absolutely trustworthy beyond any doubt.
  - threatofrain 4y ago
    In civil courts the burden is the preponderance of evidence. And trust is a higher standard yet where the burden is on those who want the benefits of being trusted.
  - marcinzm 4y ago
    Part of a CAs job is to manage public opinion because their job is to maintain trust in the CA system. If they cannot instill trust then they should not be a CA.
irthomasthomas 4y ago
A pinned comment defending the CA with shady government ties. Hmm. Anyway, why don't you do us all a favour and quote some of those answers which you think perfectly clarify things, instead of just telling people they are reading it wrong.
plzthrowaway 4y ago
> I am probably in the minority here, but I can’t help but feel like Rachel was a victim of a sloppy but effective smear campaign. I usually have sympathy for privacy-friendly services being abused by bad actors, and i certainly have sympathy for anyone being impersonated by State-sponsored APT for nefarious purposes. However, after reading through the thread, this does not seem to match reality. It took just a few email back and forth for TrustCor to change their statement from "we know nothing about these people" to "we used to have common investors", while placing the blame on a single recently-deceased individual... which still does not explain how a malicious data exfiltration (malware) SDK ended up in a beta product of theirs (a question they silently skimmed over), or why they pretend not to know why most of their legal infrastructure in place is deeply tied to this malicious actor. Without commenting on the CA operations of TrustCor (and its lack of transparency), or the seemingly-broken security promises of the MsgSafe service, it seems relevant for the CA/B forum that TrustCor is obviously arguing in bad faith and trying to dissimulate ties to a now-well-known APT. You would certainly expect most CAs to operate more transparently, to be registered where they actually operate, and to disclose where their hardware is located, especially when this location exposes them to NSL-style laws. Operating out of a mailbox in a tax heaven, for a company based in Canada, with machines in the USA is already very sketchy. TrustCor's responses in the mailing lists in my humble opinion clearly outlines that they are bad faith (if not entirely malicious) and should be treated accordingly by browser vendors. I understand that Rachel is now in a bad position and feels smeared. And maybe she is not the person responsible for the malicious setup/activities of the entire company (maybe she's even unaware), but that's what you get for being the public face of a rather-secretive malicious actor.
tgsovlerkhgsel 4y ago
To me, it looks like Kathleen Wilson from Mozilla did a great job sorting undisputed facts from all the noise in https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic..., and the noise that came from Rachel mostly served to obfuscate that these facts remain facts, and leave removal of the CA as the logical conclusion. Based on that, it seems like the "rebuttal" is trying to rebut irrelevant things, leaving the undisputable elephant standing in the room. (I admit I haven't read the entire wall of text.) > I suspect the outcome would have been different if this was handled in a court of law. If it was a criminal court trying to prove something beyond reasonable doubt, certainly. For a CA, it's the other way around, there needs to be strong evidence that keeping the CA is beneficial to the users.
- dcow 4y ago
  I agree that Kathleen’s response (tone, articulation, scope) was on point. Objectively, it does become hard to justify the value of a CA when there’s a mob of people questioning the value. In a very raw sense, this is probably the most user-centric outcome. So I will sleep on that. But in a process sense, I am left wanting. I still don’t know what damage was done and why TrustCor CA got this special treatment in the first place in any way material to their CA issuing business, which they appeared to put great effort into operating by the books.
  - charleyablaze 4y ago
    My read is that Mozilla were much more concerned about the shared ownership and operations with Measurement System, than the presence of the malware. I think we can agree that you can't be doing crimes under one company name and simultaneously operate a trusted CA under another?
    - dcow 4y ago
      I do agree that we shouldn’t allow something that overt. But, if I read correctly, Rachel claimed that there was no longer any shared ownership and tried to explain that ownership in the sense that the word was being use was not a correct term in the first place. I believe she said it was a shared incorporation services / legal council / investor, at most, and that the speculation as to that relationship conferring any authority pertaining to the CA’s operations was entirely incorrect since the executive authority had long since been signed over to actual company officers.
themoonisachees 4y ago
One one hand i agree that being defensive is warranted given the accusation, especially considering most of the claims appear to be related to an entirely different product than their CA business. The bit where someone goes to great length to demonstrate how they email isn't e2ee is especially jarring. That said, it appears mozilla's decision is founded not on their response in the thread, but on the fact that Trustcor basically is a root CA for the sole reason that they provide a useful service in the exact product being shown as untrustworthy. If the only reason is their email service, and their email service can't hold up to scrutiny (including promising e2ee and not actually providing it, and having poor development security practices) then why do they have root CA power in 99% of client devices? in my opinion, their email service didn't warrant such inclusion to begin with, even if the service was sound, and that's not accounting for their weird corporate ties (which may be legitimate, tbf).
- dcow 4y ago
  Rachel stated that TrustCor CA has many customers that are not the email service. Because this isn’t a court, discovery won’t tell us if that is, in fact, true or not. But if it is, then it seems completely normal.
  - themoonisachees 4y ago
    Moz's decision isn't based on the costumer base, it's based on "what does you being a root CA provide?". Their email service was listed as the primary reason they should be a root CA (regardless of other eventual costumers) and if the email service isn't sound then their primary reason is moot.
    - dcow 4y ago
      That’s fair and I do agree with that line of reasoning. You don’t need a CA to run a mail service anymore. Perhaps we should audit all of the CA value statements and weed out dated entities…
  - otikik 4y ago
    I don't think those other customers share offices or personnel with TrustCor tough.
tux3 4y ago
I think showing empathy is good and important. Responding to accusations on a public forum is understandably stressful, I could understand how it's hard to stay entirely placid in that situation. And I strongly agree on inflammatory comments like the Microsoft comment at the end, which do nothing to raise the level of the discussion. However, I think it's helpful to consider public comments separately from the responses of browser vendors. I think they did an admirable job of keeping the contents of their messages calm and focused on establishing uncontroversial claims. In no way are Apple or Mozilla's responses trying to make the person squirm, or trying to 'smell the guilt'. Mozilla's final assessment rests on TrustCor's quantifying value statement in light of the MsgSafe.io findings, i.e. the close tie of TrustCor operatives with this malware operation. The legal system is hardly a panacea. Legal battles can be made to last many years. And a court of law has no ground to litigate on questions of trust in the first place. The forum was able to establish a list of important and uncontested claims in a few weeks of strenuous discussion, and their assessment of the benefits of keeping TrustCor vs. the risks seems reasonable to me. Third-party inflammatory messages about Microsoft notwithstanding.
- dcow 4y ago
  I do agree with your assessment of the official responses. I’ll admit I may be overly sympathetic towards Rachel, but after reading her responses, I was left wanting a more substantiated resolution. It’s hard for me to trust a “value judgement” in the middle of a riot, so to speak.
- mschuster91 4y ago
  > Responding to accusations on a public forum is understandably stressful, I could understand how it's hard to stay entirely placid in that situation. Which is why at that point you hire lawyers and a corporate communications agency to do this for you. When your company's existence is on the line, you don't want to do that stuff yourself.
  - dcow 4y ago
    Which is very hard when given an exploding timeline of a few days to respond… Honestly I felt like some of her responses were crafted with input form people with legal training and that’s exactly what turned people off because everyone knows lawyers can’t be trusted rite.
ikiris 4y ago
The problem isn't a lack of "Response", its a lack of "answers". When someone asks you what is the shared ownership of these two entities, and you tell a story about your summer in lancaster working in the mail room of one of the entities, it isn't useful or related to the question.
- dcow 4y ago
  That’s not what happened is it? She directly answered and said they were funded at one point historically by the same investment group, but that relationship had since dissolved. For all we know she had been working incredibly hard to keep the business above board despite financial incentives to be corrupt and unethical individuals willing to pursue them. If you ask most founders of companies who’s on their cap table as an outside person you generally won’t get a strait answer, especially not in a public forum. I take issue with the expectation that answers are required in the first place without some substantial reason why they’re relevant.
  - ikiris 4y ago
    Do you understand the content in the thread? Its hard to tell from your repeated assertions that do not match what actually occurred in the thread. It feels like you skimmed, and have some bias attempting to give the benefit of doubt to what you see as the embattled party in some kind of unjust lynching instead of legitimate questions of entire shared corporate officer structures, and clearly shared dev teams [that the representative blatantly attempted to claim was out of line while avoiding the actual part of that evidence that was damning, that the dev somehow had access to the raw source of the library in question that very strongly indicates that it was their library and not the rouge devs'] of a known malware entity and a ROOT level CA. If you are just trying to play devils advocate in what you feel is somehow a mob action instead of what is probably extremely conservative actions by some of the biggest and most legally careful entities in the planet then honestly, I ask why and for what purpose?
    - dcow 4y ago
      I read the whole thing word for word.
charleyablaze 4y ago
I agree there was a lot of mud slinging in that thread, but this is the key bit from Mozilla's response, supported by statements which Trustcor haven't disagreed with: > Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware. Trustcor’s responses via their Vice President of CA operations further substantiates the factual basis for Mozilla’s concerns. It's not some other company, its the same owners and operators doing malware under one name and running a CA under another.
- irthomasthomas 4y ago
  The most shocking aspect of this is how it reveals that Mozilla, Microsoft and Google do zero due diligence before adding a new root CA. Relying on independent researchers to find problems.
  - warp 4y ago
    Is that still the case? Or is it just new root CAs get the appropriate amount of scrutiny, but a lot of existing CAs have been effectively grandfathered in because they were added two decades ago when folks weren't as diligent? EDIT: elsewhere in the thread someone linked the bugzilla request for TrustCor to be added. I had assumed that was a long time ago, but it's "only" 7 years ago.
KptMarchewa 4y ago
That's very weird take - the non-answers provided were as slimy as possible, hiding behind word soup and weird legal claims. I don't see anyone innocent arguing in that way. Instead of "tying to set guidelines" you can try to honestly answer the questions.
dsfyu404ed 4y ago
The part that really drives me up the wall is that the same groups of people that drive these sorts of situations will turn right back around and complain that entities knee-jerk react with a salvo of smear campaigns, corporate BS and other dirty tricks in the face of even the most mild and genuine criticism as if they themselves are not the driving factor behind creating a situation in which that is not the "safe" response. See also: Ford Pinto
phyzome 4y ago
I had only read up to Joel's self-correction (last message of Nov 18, 2022) and my impression was that the TrustCor rep was being evasive and kept changing her story. For example, the CA doesn't operate out of Arizona, that's just where they keep a bit of equipment -- except then it does. And not being able or willing to answer some very simple questions. That's on top of the technical and legal evidence of the companies basically being the same company. The wall-of-text could be a result of unfair accusation, sure. No doubt she's under a lot of stress either way! And I did think that some of the accusations in the thread were a bit harsh, sarcastic, or otherwise inappropriate. But the facts stand.

by dcow 4y ago

stevewatson301 4y ago

I'm not seeing where she's provided answers to the questions that really matter. All she's done is to talk in a patronizing manner to the CA members regarding their inability to understand corporate structures, as well as never answering how or why a MITM companies' SDK ended up being embedded in their app. Further, even in times of stress, lashing out isn't the best decision. If I were interrogated by a cop and I called them a bunch of names, I would attract additional charges, on top of being suspected of commiting the crime that I've been accused of.

dcow 4y ago
She didn't lash out, everyone else did? She made it very clear numerous times that she didn't think the forum appropriate for discussion of speculation.
- KptMarchewa 4y ago
  There were a lot of thinly veiled legal threats.
themoonisachees 4y ago
To be fair they do say (without proof but that can be hard to provide) that the spyware was put there by a contract developer that was not authorized to add 3rd party tools but did anyway. That being said, given how extremely evasive they were and the lack of any tangible proof, I don't think it is unreasonable to doubt this explanation (how come you think a contract dev implementing malware isn't grounds for a lawsuit, shouldn't that be an open and shut case?)
- dcow 4y ago
  She also said they we advised legally against pursing legal action and damages, though it crossed their minds.
  - themoonisachees 4y ago
    well, silver lining is that they now have provable damages from this dev's actions in that it played a role in sinking their business.
    - willcipriano 4y ago
      The dev will just pull up the Jira ticket that says "Add malware to app" in court. That's why they were advised not to sue.
      - KingOfCoders 4y ago
        Hopefully he made a screenshot. I'm advising people for a long time now to make screenshots of emails etc. - at least have everything in writing, don't act on phone calls if you feel things are "in a grayzone" (happens often in startups).
      - yakak 4y ago
        Its pretty clear that a dev with a second degree in law still wouldn't have been able to determine whether companies that shared most of the same infrastructure and listed corporate officers were 3rd parties in the context of software, without grilling someone who may or may not be a Trustcor executive, may or may not be the past founder and may or may not be dead, where such a death neither implies nor dismisses the possibility that they are still running the company.
berkut 4y ago
Where are you seeing her "lash" out? I can't see anything I'd describe that way in the (original) thread...
- stevewatson301 4y ago
  This response by Rachel McPherson from Trustcor definitely comes as lashing out" > Apparently it may also come as a surprise to some readers and the researchers themselves that other root program members are in fact international governments, and some are also defense companies, or companies who are wholly-owned by defense companies and/or state-owned enterprises, meaning "businesses" that are completely owned or controlled by governments. Further, some of those governments are not free/democratic and in fact some have tragic modern histories of basic human rights violations. We are none of those things and our company does not identify with those values. Given this point above, why of all potential targets are these researchers interested in TrustCor? They could go after countries with human rights violations that have placed a CA in the program.
  - berkut 4y ago
    Seriously!? I'd argue it could be termed "what-aboutism", but I personally fail to see how that matches my definition of "lashing out"...
    - CoastalCoder 4y ago
      > I'd argue it could be termed "what-aboutism", I agree that it's "what-aboutism". In that regard, it does nothing to establish that TrustCor meets the standards for being a CA. It does raise a good question for parallel discussion, though: Should Mozilla also be scrutinizing a whole bunch of other CAs as well?
    - shkkmo 4y ago
      > Apparently it may also come as a surprise to some readers and the researchers themselves that... This part in particular is what I would view as "lashing out"
KingOfCoders 4y ago
Not only "SDK ended up being embedded in their app" but why they had an unobfuscated version when everyone else has only an obfuscated version of that SDK.

di4na 4y ago

The problem here with Rachel behaviour is not if they are guilty or not. The problem here is that there is an expectation that a CA have a certain standard of behaviour and ability to handle... well adversarial situations. Because that is what a CA has to do! They are the beholder of our trust. By behaving like they do and more particularly not providing any of the proof asked in the process, Trust is broken. They do not demonstrate they have their shit together, do not demonstrate they understand the process nor the problem, and in general shows they are not equipped in term of knowledge and skills to be a CA. That they are guilty or not do not matter anymore at this point. They have failed at a more basic level of being a CA. They cannot do the things we expect a CA to do. Them being breached or using their power for bad things do not even matter anymore.

dcow 4y ago
In civil courts, the burden of proof lies with the accuser, usually. Because this is what happens if you let public opinion rule. It’s unfair to the accused and rarely ends in their favor, regardless of innocence or guilt, as you so clearly put it.
- SkeuomorphicBee 4y ago
  Being a root CA is a privilege, not a right. A root CA has enormous power over the whole internet, so they must prove that they are absolutely trustworthy beyond any doubt.
- threatofrain 4y ago
  In civil courts the burden is the preponderance of evidence. And trust is a higher standard yet where the burden is on those who want the benefits of being trusted.
- marcinzm 4y ago
  Part of a CAs job is to manage public opinion because their job is to maintain trust in the CA system. If they cannot instill trust then they should not be a CA.

irthomasthomas 4y ago

A pinned comment defending the CA with shady government ties. Hmm. Anyway, why don't you do us all a favour and quote some of those answers which you think perfectly clarify things, instead of just telling people they are reading it wrong.

plzthrowaway 4y ago

> I am probably in the minority here, but I can’t help but feel like Rachel was a victim of a sloppy but effective smear campaign. I usually have sympathy for privacy-friendly services being abused by bad actors, and i certainly have sympathy for anyone being impersonated by State-sponsored APT for nefarious purposes. However, after reading through the thread, this does not seem to match reality. It took just a few email back and forth for TrustCor to change their statement from "we know nothing about these people" to "we used to have common investors", while placing the blame on a single recently-deceased individual... which still does not explain how a malicious data exfiltration (malware) SDK ended up in a beta product of theirs (a question they silently skimmed over), or why they pretend not to know why most of their legal infrastructure in place is deeply tied to this malicious actor. Without commenting on the CA operations of TrustCor (and its lack of transparency), or the seemingly-broken security promises of the MsgSafe service, it seems relevant for the CA/B forum that TrustCor is obviously arguing in bad faith and trying to dissimulate ties to a now-well-known APT. You would certainly expect most CAs to operate more transparently, to be registered where they actually operate, and to disclose where their hardware is located, especially when this location exposes them to NSL-style laws. Operating out of a mailbox in a tax heaven, for a company based in Canada, with machines in the USA is already very sketchy. TrustCor's responses in the mailing lists in my humble opinion clearly outlines that they are bad faith (if not entirely malicious) and should be treated accordingly by browser vendors. I understand that Rachel is now in a bad position and feels smeared. And maybe she is not the person responsible for the malicious setup/activities of the entire company (maybe she's even unaware), but that's what you get for being the public face of a rather-secretive malicious actor.

tgsovlerkhgsel 4y ago

To me, it looks like Kathleen Wilson from Mozilla did a great job sorting undisputed facts from all the noise in https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic..., and the noise that came from Rachel mostly served to obfuscate that these facts remain facts, and leave removal of the CA as the logical conclusion. Based on that, it seems like the "rebuttal" is trying to rebut irrelevant things, leaving the undisputable elephant standing in the room. (I admit I haven't read the entire wall of text.) > I suspect the outcome would have been different if this was handled in a court of law. If it was a criminal court trying to prove something beyond reasonable doubt, certainly. For a CA, it's the other way around, there needs to be strong evidence that keeping the CA is beneficial to the users.

dcow 4y ago
I agree that Kathleen’s response (tone, articulation, scope) was on point. Objectively, it does become hard to justify the value of a CA when there’s a mob of people questioning the value. In a very raw sense, this is probably the most user-centric outcome. So I will sleep on that. But in a process sense, I am left wanting. I still don’t know what damage was done and why TrustCor CA got this special treatment in the first place in any way material to their CA issuing business, which they appeared to put great effort into operating by the books.
- charleyablaze 4y ago
  My read is that Mozilla were much more concerned about the shared ownership and operations with Measurement System, than the presence of the malware. I think we can agree that you can't be doing crimes under one company name and simultaneously operate a trusted CA under another?
  - dcow 4y ago
    I do agree that we shouldn’t allow something that overt. But, if I read correctly, Rachel claimed that there was no longer any shared ownership and tried to explain that ownership in the sense that the word was being use was not a correct term in the first place. I believe she said it was a shared incorporation services / legal council / investor, at most, and that the speculation as to that relationship conferring any authority pertaining to the CA’s operations was entirely incorrect since the executive authority had long since been signed over to actual company officers.

themoonisachees 4y ago

One one hand i agree that being defensive is warranted given the accusation, especially considering most of the claims appear to be related to an entirely different product than their CA business. The bit where someone goes to great length to demonstrate how they email isn't e2ee is especially jarring. That said, it appears mozilla's decision is founded not on their response in the thread, but on the fact that Trustcor basically is a root CA for the sole reason that they provide a useful service in the exact product being shown as untrustworthy. If the only reason is their email service, and their email service can't hold up to scrutiny (including promising e2ee and not actually providing it, and having poor development security practices) then why do they have root CA power in 99% of client devices? in my opinion, their email service didn't warrant such inclusion to begin with, even if the service was sound, and that's not accounting for their weird corporate ties (which may be legitimate, tbf).

dcow 4y ago
Rachel stated that TrustCor CA has many customers that are not the email service. Because this isn’t a court, discovery won’t tell us if that is, in fact, true or not. But if it is, then it seems completely normal.
- themoonisachees 4y ago
  Moz's decision isn't based on the costumer base, it's based on "what does you being a root CA provide?". Their email service was listed as the primary reason they should be a root CA (regardless of other eventual costumers) and if the email service isn't sound then their primary reason is moot.
  - dcow 4y ago
    That’s fair and I do agree with that line of reasoning. You don’t need a CA to run a mail service anymore. Perhaps we should audit all of the CA value statements and weed out dated entities…
- otikik 4y ago
  I don't think those other customers share offices or personnel with TrustCor tough.

tux3 4y ago

I think showing empathy is good and important. Responding to accusations on a public forum is understandably stressful, I could understand how it's hard to stay entirely placid in that situation. And I strongly agree on inflammatory comments like the Microsoft comment at the end, which do nothing to raise the level of the discussion. However, I think it's helpful to consider public comments separately from the responses of browser vendors. I think they did an admirable job of keeping the contents of their messages calm and focused on establishing uncontroversial claims. In no way are Apple or Mozilla's responses trying to make the person squirm, or trying to 'smell the guilt'. Mozilla's final assessment rests on TrustCor's quantifying value statement in light of the MsgSafe.io findings, i.e. the close tie of TrustCor operatives with this malware operation. The legal system is hardly a panacea. Legal battles can be made to last many years. And a court of law has no ground to litigate on questions of trust in the first place. The forum was able to establish a list of important and uncontested claims in a few weeks of strenuous discussion, and their assessment of the benefits of keeping TrustCor vs. the risks seems reasonable to me. Third-party inflammatory messages about Microsoft notwithstanding.

dcow 4y ago
I do agree with your assessment of the official responses. I’ll admit I may be overly sympathetic towards Rachel, but after reading her responses, I was left wanting a more substantiated resolution. It’s hard for me to trust a “value judgement” in the middle of a riot, so to speak.
mschuster91 4y ago
> Responding to accusations on a public forum is understandably stressful, I could understand how it's hard to stay entirely placid in that situation. Which is why at that point you hire lawyers and a corporate communications agency to do this for you. When your company's existence is on the line, you don't want to do that stuff yourself.
- dcow 4y ago
  Which is very hard when given an exploding timeline of a few days to respond… Honestly I felt like some of her responses were crafted with input form people with legal training and that’s exactly what turned people off because everyone knows lawyers can’t be trusted rite.

ikiris 4y ago

The problem isn't a lack of "Response", its a lack of "answers". When someone asks you what is the shared ownership of these two entities, and you tell a story about your summer in lancaster working in the mail room of one of the entities, it isn't useful or related to the question.

dcow 4y ago
That’s not what happened is it? She directly answered and said they were funded at one point historically by the same investment group, but that relationship had since dissolved. For all we know she had been working incredibly hard to keep the business above board despite financial incentives to be corrupt and unethical individuals willing to pursue them. If you ask most founders of companies who’s on their cap table as an outside person you generally won’t get a strait answer, especially not in a public forum. I take issue with the expectation that answers are required in the first place without some substantial reason why they’re relevant.
- ikiris 4y ago
  Do you understand the content in the thread? Its hard to tell from your repeated assertions that do not match what actually occurred in the thread. It feels like you skimmed, and have some bias attempting to give the benefit of doubt to what you see as the embattled party in some kind of unjust lynching instead of legitimate questions of entire shared corporate officer structures, and clearly shared dev teams [that the representative blatantly attempted to claim was out of line while avoiding the actual part of that evidence that was damning, that the dev somehow had access to the raw source of the library in question that very strongly indicates that it was their library and not the rouge devs'] of a known malware entity and a ROOT level CA. If you are just trying to play devils advocate in what you feel is somehow a mob action instead of what is probably extremely conservative actions by some of the biggest and most legally careful entities in the planet then honestly, I ask why and for what purpose?
  - dcow 4y ago
    I read the whole thing word for word.

charleyablaze 4y ago

I agree there was a lot of mud slinging in that thread, but this is the key bit from Mozilla's response, supported by statements which Trustcor haven't disagreed with: > Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware. Trustcor’s responses via their Vice President of CA operations further substantiates the factual basis for Mozilla’s concerns. It's not some other company, its the same owners and operators doing malware under one name and running a CA under another.

irthomasthomas 4y ago
The most shocking aspect of this is how it reveals that Mozilla, Microsoft and Google do zero due diligence before adding a new root CA. Relying on independent researchers to find problems.
- warp 4y ago
  Is that still the case? Or is it just new root CAs get the appropriate amount of scrutiny, but a lot of existing CAs have been effectively grandfathered in because they were added two decades ago when folks weren't as diligent? EDIT: elsewhere in the thread someone linked the bugzilla request for TrustCor to be added. I had assumed that was a long time ago, but it's "only" 7 years ago.

KptMarchewa 4y ago

That's very weird take - the non-answers provided were as slimy as possible, hiding behind word soup and weird legal claims. I don't see anyone innocent arguing in that way. Instead of "tying to set guidelines" you can try to honestly answer the questions.

dsfyu404ed 4y ago

The part that really drives me up the wall is that the same groups of people that drive these sorts of situations will turn right back around and complain that entities knee-jerk react with a salvo of smear campaigns, corporate BS and other dirty tricks in the face of even the most mild and genuine criticism as if they themselves are not the driving factor behind creating a situation in which that is not the "safe" response. See also: Ford Pinto

phyzome 4y ago

I had only read up to Joel's self-correction (last message of Nov 18, 2022) and my impression was that the TrustCor rep was being evasive and kept changing her story. For example, the CA doesn't operate out of Arizona, that's just where they keep a bit of equipment -- except then it does. And not being able or willing to answer some very simple questions. That's on top of the technical and legal evidence of the companies basically being the same company. The wall-of-text could be a result of unfair accusation, sure. No doubt she's under a lot of stress either way! And I did think that some of the accusations in the thread were a bit harsh, sarcastic, or otherwise inappropriate. But the facts stand.