5 ms·

Do you have a source? Some quick searching only brought up cloudflare dropping them.

by SahAssar 3y ago

lmm 3y ago
Not to hand, and if I did it would probably be a post on the forum itself, which, well, you see the problem.
- woodruffw 3y ago
  I would go ahead and hazard that “major DV CA refuses to validate controversial site” would be major news. There’s no evidence that LE has ever done this, much less ever considered it, much less even has the basic technical ability to manually intervene in the DV process.
  - lmm 3y ago
    Hardcoding a check for whether the domain is a particular fixed string is trivial. Any competent technical organisation can do that in less than a day. Yes it wouldn't be principled or elegant, but it would work. Currently LE looks like neutral infrastructure that would never do such a thing. But so did CloudFlare, right up until the point where they suddenly weren't.
    - SahAssar 3y ago
      CloudFlare never looked like neutral infra, since they control the traffic so they need to (from a legal standpoint at least) block certain things. There has always been things cloudflare would not host. CA:s do not control the traffic, they just say if a key is associated with a domain.
    - woodruffw 3y ago
      I don’t think it makes sense to compare a for-profit content delivery product with a non-profit CA. They fill different purposes, and exist under different regulatory and incentive models. They don’t do remotely the same things, and don’t even have the same basic “profile” (one being an active network participant, and the other being a static participant in the PKI). Again: this entire thread exists because you (baselessly and incorrectly) speculated that LE has censored people. We’ve now moved on to baselessly speculating about what LE could do, which is approximately as useful. Which is to say: not.
      - lmm 3y ago
        I made it clear from the start that a) this was a partial recollection b) it was entirely possible that it hadn't got to the point of physically attempting to issue a certificate. It was definitely a topic that was dicussed on KF, and a part that I do remember clearly is that LE's terms permit them to choose to refuse service to entities based on the content of what those entities are serving. And it's very obvious that it would be technically possible for them to do so, contrary to what you ("baselessly and incorrectly", if we're going there) suggested in your last reply. If LE wanted to make a clear committment to content-neutral operation it could do so. It has taken a different tack in its ToS, even if it hasn't been pushed to the point of applying that in practice yet.

Do you have a source? Some quick searching only brought up cloudflare dropping them.

lmm 3y ago

Not to hand, and if I did it would probably be a post on the forum itself, which, well, you see the problem.

woodruffw 3y ago
I would go ahead and hazard that “major DV CA refuses to validate controversial site” would be major news. There’s no evidence that LE has ever done this, much less ever considered it, much less even has the basic technical ability to manually intervene in the DV process.
- lmm 3y ago
  Hardcoding a check for whether the domain is a particular fixed string is trivial. Any competent technical organisation can do that in less than a day. Yes it wouldn't be principled or elegant, but it would work. Currently LE looks like neutral infrastructure that would never do such a thing. But so did CloudFlare, right up until the point where they suddenly weren't.
  - SahAssar 3y ago
    CloudFlare never looked like neutral infra, since they control the traffic so they need to (from a legal standpoint at least) block certain things. There has always been things cloudflare would not host. CA:s do not control the traffic, they just say if a key is associated with a domain.
  - woodruffw 3y ago
    I don’t think it makes sense to compare a for-profit content delivery product with a non-profit CA. They fill different purposes, and exist under different regulatory and incentive models. They don’t do remotely the same things, and don’t even have the same basic “profile” (one being an active network participant, and the other being a static participant in the PKI). Again: this entire thread exists because you (baselessly and incorrectly) speculated that LE has censored people. We’ve now moved on to baselessly speculating about what LE could do, which is approximately as useful. Which is to say: not.
    - lmm 3y ago
      I made it clear from the start that a) this was a partial recollection b) it was entirely possible that it hadn't got to the point of physically attempting to issue a certificate. It was definitely a topic that was dicussed on KF, and a part that I do remember clearly is that LE's terms permit them to choose to refuse service to entities based on the content of what those entities are serving. And it's very obvious that it would be technically possible for them to do so, contrary to what you ("baselessly and incorrectly", if we're going there) suggested in your last reply. If LE wanted to make a clear committment to content-neutral operation it could do so. It has taken a different tack in its ToS, even if it hasn't been pushed to the point of applying that in practice yet.