3 ms·

In HN fashion, I figured the comment might be read by a person of interest. So first off -- thank you for spending your time on something critical to the inter

by ethbr0 4y ago

In HN fashion, I figured the comment might be read by a person of interest. So first off -- thank you for spending your time on something critical to the internet! I don't, and so my words/critiques are cheap. Here's a couple questions I'm honestly curious about, from someone more tuned to the mores and social currents in the groups. And especially now this has fallen off the front page and is less visible. DISCLAIMER: Neither of the below seem applicable to this situation in question. It definitely seemed the right call, for the right reasons. These are asked about NEXT time. 1) Do you believe the process, as it exists today, is resistant to accusations of bad faith, especially if a few participants are semi-captured into playing along at the onset? (I.e. the "create a lot of smoke and imply there's fire" scenario, perhaps by a commercial competitor with social connections in the group) 2) One of the comments noted that there wasn't a policy for the squishier corporate/organization expectations, which led to subjective judgement calls on whether legal/corporate/ownership structures looked right. Is this accurate? And if so, what are your thoughts on if their lack is a problem or not (including historical situations where it's said this also happened)?

kseifried 4y ago
1) Nope, as evidenced by the fact that we just had one existing root CA booted out due to apparent links to spyware (Trustcor) and a second CA applying with links to spyware (BJCA.cn) that may or may not make it in. 2) As I've said, CA's should be above reproach. A CA involved in any way with spyware has a clear conflict of interest that can (and has) resulted in major security problems for users (e.g. MitM interception). Also a lot of this gets worse the more you look: Asking HOW we are supposed to review these documents and confirm that the auditor is indeed a valid auditor, for example results in, well, no answer. Examples: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/LnkB0S0ndbM https://groups.google.com/a/mozilla.org/g/dev-security-polic... https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/5v_hynxRfl8 https://groups.google.com/a/mozilla.org/g/dev-security-polic...
- ethbr0 4y ago
  On 1, I was thinking about the opposite: a potentially-valid CA (probably a smaller one) that has some unclear paperwork, that someone pieces together a narrative about, with the intention of getting them booted. On 2, agreed on the above reproach. But defining that across international and multiple legal jurisdictions, corporate structures, ownership structures, etc. seems... complex. And honestly, not something I'd trust myself with (as a primarily-SWE). And the external audits don't attest to corporate structure, do they?
  - kseifried 4y ago
    1) If that's the case they should be able to prove they are legitimate without to much effort. If a CA can't prove they are legitimate, well. Err.. they probably need to be booted then. 2) Correct but there are also many CA's that have managed to do a good job here. Why should we allow poorly behaved CAs in when it affects potentially billions of devices and people? As for the external audits correct, they are very narrow in scope, there are also no requirements around change of control (e.g. company A buys an existing root CA).

by ethbr0 4y ago

kseifried 4y ago

1) Nope, as evidenced by the fact that we just had one existing root CA booted out due to apparent links to spyware (Trustcor) and a second CA applying with links to spyware (BJCA.cn) that may or may not make it in. 2) As I've said, CA's should be above reproach. A CA involved in any way with spyware has a clear conflict of interest that can (and has) resulted in major security problems for users (e.g. MitM interception). Also a lot of this gets worse the more you look: Asking HOW we are supposed to review these documents and confirm that the auditor is indeed a valid auditor, for example results in, well, no answer. Examples: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/LnkB0S0ndbM https://groups.google.com/a/mozilla.org/g/dev-security-polic... https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/5v_hynxRfl8 https://groups.google.com/a/mozilla.org/g/dev-security-polic...

ethbr0 4y ago
On 1, I was thinking about the opposite: a potentially-valid CA (probably a smaller one) that has some unclear paperwork, that someone pieces together a narrative about, with the intention of getting them booted. On 2, agreed on the above reproach. But defining that across international and multiple legal jurisdictions, corporate structures, ownership structures, etc. seems... complex. And honestly, not something I'd trust myself with (as a primarily-SWE). And the external audits don't attest to corporate structure, do they?
- kseifried 4y ago
  1) If that's the case they should be able to prove they are legitimate without to much effort. If a CA can't prove they are legitimate, well. Err.. they probably need to be booted then. 2) Correct but there are also many CA's that have managed to do a good job here. Why should we allow poorly behaved CAs in when it affects potentially billions of devices and people? As for the external audits correct, they are very narrow in scope, there are also no requirements around change of control (e.g. company A buys an existing root CA).