3 ms·

> There were definitely some people on the mailing list who were less than professional Especially people like Kurt Seifried who appears to have no relationshi

> There were definitely some people on the mailing list who were less than professional Especially people like Kurt Seifried who appears to have no relationship to any of the browser vendors or parties involved. Just some random person demanding answers from Rachel as though he is a prosecutor. It doesn't seem to me like a public mailing list is necessarily the best way to handle this given the seriousness of the topic and the business impact to the company involved.

pas 4y ago
it concerns millions of users directly and billions indirectly. yes we can trust Mozilla and the other browser vendors to do the right thing. we already trust them very explicitly when using their software. but the public by default approach is pretty good for these things. IETF, NANOG and other big org lists are also public. yes as all mailing lists there are occasional flareups. (and yes browser vendors or various CA/B forum members can still start a shadow list to conspire) ... but the business impact happened when they did the not-the-right thing, to minimize their impact they could have declared this an incident, suspend issuance, withdraw from the trusted set and apply again later. they again did the not-the-right thing by trying to bullshit their way to minimal impact. it's not exactly virtuous, but quite understandable to throw a few rotten eggs. (and the list could be CA/B members & candidates only).
- kseifried 4y ago
  It's wild that people think there is some sort of "CA Police" looking out for bad CAs. Sorry but random people like myself demanding answers during the public discussion phase is actually what the "CA Police" looks like. If anyone is interested, we're looking into what can be done around the root certificate world, if you're interested feel free to reach out to me at kurt@seifried.org (I'm still in the exploratory phase, e.g. can anything actionable/useful be done, and so on).
rektide 4y ago
Given the same facts, I come to opposite conclusion. To create trust, this business must be conducted in public & must be open access. Imposing any more barriers or concealing the dealings would be actively harmful to the process. Anyone is capable of presenting good data to inform these decisions, to show how & why trust should or should not be given, and that's great, that's how we let in the sunlight. It is just a mailing list. No one has to take commenters seriously. I found the tone here by the cimmunity to be quite fine. But even if it descended sitnificantly, became much less professional, I wouldnt be happy per se but I would not until a long long descent begin to question the value of the open process. It is up to the reader to figure out what credentials people have; as Kurt said, you've got to do your own searching to find out. That there is noise in the channel (in this case it did not seem to come from the community) is not something we should restrict the processs to avoid; it is something we must allow & be able to be tolerant & resillient to.

pas 4y ago

it concerns millions of users directly and billions indirectly. yes we can trust Mozilla and the other browser vendors to do the right thing. we already trust them very explicitly when using their software. but the public by default approach is pretty good for these things. IETF, NANOG and other big org lists are also public. yes as all mailing lists there are occasional flareups. (and yes browser vendors or various CA/B forum members can still start a shadow list to conspire) ... but the business impact happened when they did the not-the-right thing, to minimize their impact they could have declared this an incident, suspend issuance, withdraw from the trusted set and apply again later. they again did the not-the-right thing by trying to bullshit their way to minimal impact. it's not exactly virtuous, but quite understandable to throw a few rotten eggs. (and the list could be CA/B members & candidates only).

kseifried 4y ago
It's wild that people think there is some sort of "CA Police" looking out for bad CAs. Sorry but random people like myself demanding answers during the public discussion phase is actually what the "CA Police" looks like. If anyone is interested, we're looking into what can be done around the root certificate world, if you're interested feel free to reach out to me at kurt@seifried.org (I'm still in the exploratory phase, e.g. can anything actionable/useful be done, and so on).

rektide 4y ago

Given the same facts, I come to opposite conclusion. To create trust, this business must be conducted in public & must be open access. Imposing any more barriers or concealing the dealings would be actively harmful to the process. Anyone is capable of presenting good data to inform these decisions, to show how & why trust should or should not be given, and that's great, that's how we let in the sunlight. It is just a mailing list. No one has to take commenters seriously. I found the tone here by the cimmunity to be quite fine. But even if it descended sitnificantly, became much less professional, I wouldnt be happy per se but I would not until a long long descent begin to question the value of the open process. It is up to the reader to figure out what credentials people have; as Kurt said, you've got to do your own searching to find out. That there is noise in the channel (in this case it did not seem to come from the community) is not something we should restrict the processs to avoid; it is something we must allow & be able to be tolerant & resillient to.