4 ms·

wow. WOW. What starts as a relatively boring thread morphs into something else as it goes on. I have to say though, I did not read all the responses from the

wow. WOW. What starts as a relatively boring thread morphs into something else as it goes on. I have to say though, I did not read all the responses from the accused, as that is essentially impossible.

dcow 4y ago
I did and don’t feel like Rachel’s responses were sufficiently considered because of the prevailing “ugh wall of text tldr” sentiment. She may be partly to blame for that, but people asked for answers and didn’t read them when given! I don’t think TrustCor’s situation is something to joke or gloat about. Someone’s entire business just got ruined because of, if Rachel is to be believed, something wholly unrelated to operation of the CA and arguably entirely out of their control.
- hamburglar 4y ago
  For me, there was zero “ugh wall of text tldr” and a whole lot of “that wall of text I just read is obviously designed to obfuscate and hinder discussion” followed by noticing that she relentlessly kept pasting the SAME irrelevant/misleading walls of text over and over. She seemed to be actively trying to provoke the “ugh tldr” response as a tactic. An example is the bit of boilerplate that kept repeating how the app was BETA and could only have gone to a small percentage of people (not relevant), and it wasn’t ever “published” (which is a lie) and how sdks get updated all the time and it is not our place to speculate about how that might have happened. This is an extremely abridged version of this “argument” that she trotted out repeatedly just trying to tire people out. There are many other examples of this type tactic in her responses. The overall effect is that she very much appears to be arguing in bad faith.
- shp0ngle 4y ago
  She couldn’t even reply where are they from! Those were clear questions.
  - dcow 4y ago
    She actually did reply to that directly. The response from a few others saying "you didn't reply to that" was actually false and a clear indication that they didn't read her response.
- pelagicAustral 4y ago
  Personally I felt like was saying the story of a lifetime in ancient Roman in the hopes she could buffer overflow everyone else in the thread.
- kuschku 4y ago
  It was purely evasive. Half of what she wrote was statements that she can't answer that, can't speculate, doesn't know, or her lawyers advised her not to answer. The other half of her text was her answering questions that were never asked. At no point did she answer the questions that were asked. She was repeatedly asked about the corporate structure and shared investors. The answers reached from claims that it'd be too much content to summarize in this forum, claims that lawywers advised against it, claims that answering truthfully would lead to tax obligations, to claims that she doesn't know and would have to speculate. Instead, she spent lots of time explaining the remote-work arrangement in Canada (irrelevant), the upstream networks of their Phoenix datacenter (irrelevant) or the tax situation of employees/contractors working for their company (also irrelevant).
  - zaphirplane 4y ago
    I didn’t read it all, the Canada and data center explanation was in response to questions about addressed in the audit and where the business is registered. There was a few strangeness but no smoking gun still maybe CA should be beyond reproach
    - treis 4y ago
      Like not being run by a gigantic company who's primary revenue derives from tracking as much activity on the web as they can? Or not being a company who derives the majority its revenue from the company above? This whole controversy is like a flock of lambs asking a pride of lions to stop some mosquitoes from biting them.
      - dcow 4y ago
        Exactly. It's not like Apple would happily explain to you how their tax haven is setup if you but simply asked out of concern about whether they should be trusted to own everyone's phones and push the root CA list in the first place... ... ...
  - NovemberWhiskey 4y ago
    >It was purely evasive. Half of what she wrote was statements that she can't answer that, can't speculate, doesn't know, or her lawyers advised her not to answer. To be clear: if you don't know the answer, it's not evasive to say "I cannot answer that" or "I don't know the answer" or "giving an answer would be speculation on my part".
- deleted 4y ago
  [deleted]
- mort96 4y ago
  The rejection, in the end, was because "it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware", as Kathleen puts it. I read through all of Rachel's walls of text, and nothing there dispels the referred-to connection. And it seems like Mozilla's concern is: "Is it in Mozilla's users interest to have this CA in their trust store?", which is probably the only sane way to run a trust root program. That means any concerns about the well-being of the company which runs the CA must be ignored.
- joshstrange 4y ago
  > I did and don’t feel like Rachel’s responses were sufficiently considered because of the prevailing “ugh wall of text tldr” sentiment. I read it all, it was extremely repetitive with little substance. When she did say something new/interesting it was cagey and often not direct. > She may be partly to blame for that, but people asked for answers and didn’t read them when given! Disagree. They read it and ignored the fluff that said nothing of value. > I don’t think TrustCor’s situation is something to joke or gloat about. Someone’s entire business just got ruined because of, if Rachel is to be believed, something wholly unrelated to operation of the CA and arguably entirely out of their control. And that's the thing, she isn't to be believed, I sure as heck don't believe her. I posted in another comment a clear lie about linking to the android app (not to mention the constant "It was never in released" BS is so mealy mouthed it isn't even funny). The same parent company owned the CA and this msgsafe, it also seems clear there was a little more to the "Measurement Systems" relationship than Rachel would admit. Sorry, that's way too many coincidences. The final nail in the coffin is the ties (even if they are fragile) to Packet Forensics which you wouldn't want in the same breath as CA yet the connections are hard to ignore given everything else Rachel said (or didn't say). I also don't for a second trust all the: > I was reminded by some of you this is a big public forum with non-CA-operators and non-browser/platform-developers present, and that participants have a lot of interest in these topics but not always the same level of experience or familiarity with the CA operations and root CA program guidelines or technical knowhow as the intended audience. Therefore let me begin by saying THANK YOU to my fellow CA/B Forum members and members of the larger community for reminding me of that, and separately thank you for those of you that have sent very nice and encouraging, supportive emails (you know who you are) Yeah, my girlfriend goes to another school, you've never heard of it... Okkkkkaaayyy. Then look at their "Why are you persecuting us!" line about other CA's, which just screams guilty. On top of all of that their msgsafe system appears to be a fraud (it's not E2EE despite their claims) so if they are acting that way with one arm of their parent company why should we trust the CA (who's auditor looks questionable and also the fact they've used the same one every year)?
  - twic 4y ago
    > Yeah, my girlfriend goes to another school, you've never heard of it... Okkkkkaaayyy. The phrase you are really reaching for here, well-known to every truly ancient netizen, is "the lurkers support me in email". Some unhinged usenetter (but i repeat myself) traced its origins to the mid '90s: https://groups.google.com/g/soc.singles.moderated/c/UTopjdXT8Ks https://groups.google.com/g/soc.singles.moderated/c/UTopjdXT... And, as mentioned in that poast, there is a song: http://www.jowaltonbooks.com/poetry/whimsy/the-lurkers-support-me-in-email/ http://www.jowaltonbooks.com/poetry/whimsy/the-lurkers-suppo...
- lolinder 4y ago
  I was sympathetic to Rachel at the beginning, but nothing that she said in ever resolved the main concerns: * TrustCor owns MsgSafe.io, which somehow incorporated an unobfuscated and customized version of the malware. She kept trying to distance the CA from MsgSafe, but as Kathleen points out that's disingenuous given that Rachel herself is both VP of Operations of the CA and Director of Operations of MsgSafe. * TrustCor was, until recently, owned by the same holding company that also owned Measurement Systems, which produced the malware incorporated by MsgSafe's app. If these things were not true, they should have been pretty easy to debunk. If they are true, I agree with Mozilla that they provide sufficient reason to revoke the CA. The ties to the malware are just too close to risk leaving them trusted.

dcow 4y ago

I did and don’t feel like Rachel’s responses were sufficiently considered because of the prevailing “ugh wall of text tldr” sentiment. She may be partly to blame for that, but people asked for answers and didn’t read them when given! I don’t think TrustCor’s situation is something to joke or gloat about. Someone’s entire business just got ruined because of, if Rachel is to be believed, something wholly unrelated to operation of the CA and arguably entirely out of their control.

hamburglar 4y ago
For me, there was zero “ugh wall of text tldr” and a whole lot of “that wall of text I just read is obviously designed to obfuscate and hinder discussion” followed by noticing that she relentlessly kept pasting the SAME irrelevant/misleading walls of text over and over. She seemed to be actively trying to provoke the “ugh tldr” response as a tactic. An example is the bit of boilerplate that kept repeating how the app was BETA and could only have gone to a small percentage of people (not relevant), and it wasn’t ever “published” (which is a lie) and how sdks get updated all the time and it is not our place to speculate about how that might have happened. This is an extremely abridged version of this “argument” that she trotted out repeatedly just trying to tire people out. There are many other examples of this type tactic in her responses. The overall effect is that she very much appears to be arguing in bad faith.
shp0ngle 4y ago
She couldn’t even reply where are they from! Those were clear questions.
- dcow 4y ago
  She actually did reply to that directly. The response from a few others saying "you didn't reply to that" was actually false and a clear indication that they didn't read her response.
pelagicAustral 4y ago
Personally I felt like was saying the story of a lifetime in ancient Roman in the hopes she could buffer overflow everyone else in the thread.
kuschku 4y ago
It was purely evasive. Half of what she wrote was statements that she can't answer that, can't speculate, doesn't know, or her lawyers advised her not to answer. The other half of her text was her answering questions that were never asked. At no point did she answer the questions that were asked. She was repeatedly asked about the corporate structure and shared investors. The answers reached from claims that it'd be too much content to summarize in this forum, claims that lawywers advised against it, claims that answering truthfully would lead to tax obligations, to claims that she doesn't know and would have to speculate. Instead, she spent lots of time explaining the remote-work arrangement in Canada (irrelevant), the upstream networks of their Phoenix datacenter (irrelevant) or the tax situation of employees/contractors working for their company (also irrelevant).
- zaphirplane 4y ago
  I didn’t read it all, the Canada and data center explanation was in response to questions about addressed in the audit and where the business is registered. There was a few strangeness but no smoking gun still maybe CA should be beyond reproach
  - treis 4y ago
    Like not being run by a gigantic company who's primary revenue derives from tracking as much activity on the web as they can? Or not being a company who derives the majority its revenue from the company above? This whole controversy is like a flock of lambs asking a pride of lions to stop some mosquitoes from biting them.
    - dcow 4y ago
      Exactly. It's not like Apple would happily explain to you how their tax haven is setup if you but simply asked out of concern about whether they should be trusted to own everyone's phones and push the root CA list in the first place... ... ...
- NovemberWhiskey 4y ago
  >It was purely evasive. Half of what she wrote was statements that she can't answer that, can't speculate, doesn't know, or her lawyers advised her not to answer. To be clear: if you don't know the answer, it's not evasive to say "I cannot answer that" or "I don't know the answer" or "giving an answer would be speculation on my part".
deleted 4y ago
[deleted]
mort96 4y ago
The rejection, in the end, was because "it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware", as Kathleen puts it. I read through all of Rachel's walls of text, and nothing there dispels the referred-to connection. And it seems like Mozilla's concern is: "Is it in Mozilla's users interest to have this CA in their trust store?", which is probably the only sane way to run a trust root program. That means any concerns about the well-being of the company which runs the CA must be ignored.
joshstrange 4y ago
> I did and don’t feel like Rachel’s responses were sufficiently considered because of the prevailing “ugh wall of text tldr” sentiment. I read it all, it was extremely repetitive with little substance. When she did say something new/interesting it was cagey and often not direct. > She may be partly to blame for that, but people asked for answers and didn’t read them when given! Disagree. They read it and ignored the fluff that said nothing of value. > I don’t think TrustCor’s situation is something to joke or gloat about. Someone’s entire business just got ruined because of, if Rachel is to be believed, something wholly unrelated to operation of the CA and arguably entirely out of their control. And that's the thing, she isn't to be believed, I sure as heck don't believe her. I posted in another comment a clear lie about linking to the android app (not to mention the constant "It was never in released" BS is so mealy mouthed it isn't even funny). The same parent company owned the CA and this msgsafe, it also seems clear there was a little more to the "Measurement Systems" relationship than Rachel would admit. Sorry, that's way too many coincidences. The final nail in the coffin is the ties (even if they are fragile) to Packet Forensics which you wouldn't want in the same breath as CA yet the connections are hard to ignore given everything else Rachel said (or didn't say). I also don't for a second trust all the: > I was reminded by some of you this is a big public forum with non-CA-operators and non-browser/platform-developers present, and that participants have a lot of interest in these topics but not always the same level of experience or familiarity with the CA operations and root CA program guidelines or technical knowhow as the intended audience. Therefore let me begin by saying THANK YOU to my fellow CA/B Forum members and members of the larger community for reminding me of that, and separately thank you for those of you that have sent very nice and encouraging, supportive emails (you know who you are) Yeah, my girlfriend goes to another school, you've never heard of it... Okkkkkaaayyy. Then look at their "Why are you persecuting us!" line about other CA's, which just screams guilty. On top of all of that their msgsafe system appears to be a fraud (it's not E2EE despite their claims) so if they are acting that way with one arm of their parent company why should we trust the CA (who's auditor looks questionable and also the fact they've used the same one every year)?
- twic 4y ago
  > Yeah, my girlfriend goes to another school, you've never heard of it... Okkkkkaaayyy. The phrase you are really reaching for here, well-known to every truly ancient netizen, is "the lurkers support me in email". Some unhinged usenetter (but i repeat myself) traced its origins to the mid '90s: https://groups.google.com/g/soc.singles.moderated/c/UTopjdXT8Ks https://groups.google.com/g/soc.singles.moderated/c/UTopjdXT... And, as mentioned in that poast, there is a song: http://www.jowaltonbooks.com/poetry/whimsy/the-lurkers-support-me-in-email/ http://www.jowaltonbooks.com/poetry/whimsy/the-lurkers-suppo...
lolinder 4y ago
I was sympathetic to Rachel at the beginning, but nothing that she said in ever resolved the main concerns: * TrustCor owns MsgSafe.io, which somehow incorporated an unobfuscated and customized version of the malware. She kept trying to distance the CA from MsgSafe, but as Kathleen points out that's disingenuous given that Rachel herself is both VP of Operations of the CA and Director of Operations of MsgSafe. * TrustCor was, until recently, owned by the same holding company that also owned Measurement Systems, which produced the malware incorporated by MsgSafe's app. If these things were not true, they should have been pretty easy to debunk. If they are true, I agree with Mozilla that they provide sufficient reason to revoke the CA. The ties to the malware are just too close to risk leaving them trusted.