4 ms·
Meet Japanese government. https://groups.google.com/g/mozilla.dev.security.policy/c/Mezqdljjerc/m/nIirftRqAgAJ https://groups.google.com/g/mozilla.dev.security
by ezoe 4y ago
Meet Japanese government.
https://groups.google.com/g/mozilla.dev.security.policy/c/Mezqdljjerc/m/nIirftRqAgAJ https://groups.google.com/g/mozilla.dev.security.policy/c/Me...
Mozilla: There are some misissued certificates. Revoke it.
Japan: Nah, you can trust us. We are government. It will expire soon anyway.
Mozilla: That's not an acceptable response. We do not trust you. Have a good day.
Japan: Wait. We will revoke. Just kidding. Please trust us.
Mozilla: Too late.
- anotheraccount9 4y ago"To conclude this discussion, Mozilla is denying the Japanese Government ApplicationCA2 Root inclusion request. I'd like to thank everyone for your constructive input into the discussion, and I'd like to thank the Japanese Government representatives for their patience and work to address issues as they have been discovered. I will be resolving the bug as "WONTFIX"." Lol
- throwawaaarrgh 4y ago"We are preparing to revoke certificates immediately, rather than waiting for certificates issued prior to 2017 to expire. However, even if we revoke those certificates, if your judgment is not affected and our request is rejected, there is no point in doing it. Please let us know if our request will be accepted by revoking all the certificates we issued prior to 2017." oh lawd.....
- Someone1234 4y agoThat quote by itself is a reason to drop a CA. If you're only going to do the things you're REQUIRED to do when you're threatened with rejection/revocation, then you shouldn't be a CA to begin with. The arrogance shown in that thread is appalling.
- ethbr0 4y ago> If you're only going to do the things you're REQUIRED to do when you're threatened with rejection/revocation, then you shouldn't... Have you dealt with public sector before? That's essentially status quo across the board.
- throwup 4y agoDon't trouble yourself. We'll handle revoking your certs for you... ALL of them.
- zerkten 4y agoI'm curious about Japan, surveillance, and cybersecurity. Are there any good reads on this combination of topics?
- alephnerd 4y agoIt's hard to find resources in English describing the Cybersecurity environment and posture in Japan, but having worked with Japanese organizations in that space, they have decent talent but middling institutional knowhow and process. Basically slight more competent Germans if I'm being honest. On the other hand, South Koreans organizations tend to have their shit together. Surveillance: https://theintercept.com/2018/05/19/japan-dfs-surveillance-agency/ https://theintercept.com/2018/05/19/japan-dfs-surveillance-a... https://www.nytimes.com/2022/02/02/business/japan-elderly-surveillance.html https://www.nytimes.com/2022/02/02/business/japan-elderly-su... https://giswatch.org/en/country-report/communications-surveillance/japan https://giswatch.org/en/country-report/communications-survei... Cybersecurity: legal framework - https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/japan https://iclg.com/practice-areas/cybersecurity-laws-and-regul... policy - https://thediplomat.com/2022/09/japan-needs-a-cyber-ministry-former-jgsdf-major-general/ https://thediplomat.com/2022/09/japan-needs-a-cyber-ministry...
- r00fus 4y agoIf only regulatory agencies handled bad actors in such a no-nonsense manner. Instead it's a political mess, where larger players can strong-arm the regulator.
- tptacek 4y agoI have to concede, this is funnier than TrustCor, and much quicker, too.
- ezoe 4y agoGlad it gave you a laugh. To me, TrustCor isn't funny. They are obviously malicious. For this case, it's just incompetent that lead them to be banned.. A way funnier.
- hn_go_brrrrr 4y agoIf you want funnier, read the WoSign threads, and their sequel, StartSSL.