3 ms·

1. It does look like there's very strong reason to believe that these particular certs were not misissued, in the sense that the people who have the private key

1. It does look like there's very strong reason to believe that these particular certs were not misissued, in the sense that the people who have the private keys really are the people who control the domains. Stronger than the sort of verification that the CA/BF requires. It's a bug if the system can't deal with that. 2. It's also true that there are rules, they exist for a reason, these Alegeus guys aren't special, and dragging this stuff into the courts is antisocial in the extreme. So it wouldn't be unreasonable for browsers to, say, explicitly blacklist their domains for as long as there conceivably might be noncompliant certs out there.

jandrese 2y ago
The issue isn't that someone is taking over this particular healthcare industry domain, just that in that time period there could be bad certs issued for other subdomains and there is no way to verify it. The whole setup where the verification depends on a leading underscore because subdomains aren't allowed to start with an underscore seems rather flimsy to me, but it's how the system is set up.
michaelt 2y ago
> It's also true that there are rules, they exist for a reason, [...] dragging this stuff into the courts is antisocial in the extreme [...] it wouldn't be unreasonable for browsers to, say, explicitly blacklist their domains You know who else thinks there are rules, that the rules exist for a reason, and that draconian punishments should be applied to people who try to derail attempts to enforce the rules? Judges. Like the judge that granted this temporary restraining order.
- Hizonner 2y ago
  The browsers don't have any contract with Alegeus, nor any relationship at all. They owe Alegeus nothing. They're not covered in the TRO. I doubt the TRO could legally be extended to cover them. Browsers do have a relationship with their users, who may very well be relying on them to enforce the CA/BF validity rules, or if they can't do that to provide equivalent security guarantees. And in particular many of the users rely on their browsers to protect them by blocking suspicious domains in various ways. So blocking the domains wouldn't be arbitrary, capricious, discriminatory, or anything like that. Judges don't have infinite sua sponte powers to order just anybody to do just anything. Although I admit they sometimes act as though they did, especially when they feel like their authoriteh has been disrespecked. Anyway the browsers aren't gonna do it. There's zero chance. So legalities don't really arise. I'm just saying it wouldn't be unreasonable.
- bastawhiz 2y ago
  The judge's TRO doesn't apply to browser vendors, it applies to Digi cert. The plaintiff didn't file for an injunction against browser vendors, and they probably couldn't even if they wanted to because they have no business relationship with them. What responsibility do the browsers have to this company?
  - michaelt 2y ago
    The judge has issued an order that the websites not be disrupted, just for a few days while the contracts and paperwork get straightened out. If a browser vendor disrupted the websites, because they knew of this court order and decided to take deliberate action to defy the authority of the court, that's contempt of court. The browser vendor then gets pulled up in front of the judge who granted the restraining order. The browser vendor says "ah, but the court order only says the certificate can't be revoked, we didn't revoke it we blacklisted it" and the judge says "that's a great argument so I'm not going to send you to jail, I'm going to send you to prison instead"
    - gaadd33 2y ago
      How does a judge send a company to prison or jail?
      - Radle 2y ago
        The person who ultimately made the decision is liable.
    - bastawhiz 2y ago
      No they didn't. You can read the order: > IT IS HEREBY ORDERED that DigiCert is prohibited from revoking the security certificates for the Alegeus Websites for a period of seven (7) days, or until the Court is able to schedule a hearing on the Motion, whichever is earlier. The order specifically mentioned Digicert and nobody else. The order doesn't magically apply to everyone else in the world.

jandrese 2y ago

The issue isn't that someone is taking over this particular healthcare industry domain, just that in that time period there could be bad certs issued for other subdomains and there is no way to verify it. The whole setup where the verification depends on a leading underscore because subdomains aren't allowed to start with an underscore seems rather flimsy to me, but it's how the system is set up.

michaelt 2y ago

> It's also true that there are rules, they exist for a reason, [...] dragging this stuff into the courts is antisocial in the extreme [...] it wouldn't be unreasonable for browsers to, say, explicitly blacklist their domains You know who else thinks there are rules, that the rules exist for a reason, and that draconian punishments should be applied to people who try to derail attempts to enforce the rules? Judges. Like the judge that granted this temporary restraining order.

Hizonner 2y ago
The browsers don't have any contract with Alegeus, nor any relationship at all. They owe Alegeus nothing. They're not covered in the TRO. I doubt the TRO could legally be extended to cover them. Browsers do have a relationship with their users, who may very well be relying on them to enforce the CA/BF validity rules, or if they can't do that to provide equivalent security guarantees. And in particular many of the users rely on their browsers to protect them by blocking suspicious domains in various ways. So blocking the domains wouldn't be arbitrary, capricious, discriminatory, or anything like that. Judges don't have infinite sua sponte powers to order just anybody to do just anything. Although I admit they sometimes act as though they did, especially when they feel like their authoriteh has been disrespecked. Anyway the browsers aren't gonna do it. There's zero chance. So legalities don't really arise. I'm just saying it wouldn't be unreasonable.
bastawhiz 2y ago
The judge's TRO doesn't apply to browser vendors, it applies to Digi cert. The plaintiff didn't file for an injunction against browser vendors, and they probably couldn't even if they wanted to because they have no business relationship with them. What responsibility do the browsers have to this company?
- michaelt 2y ago
  The judge has issued an order that the websites not be disrupted, just for a few days while the contracts and paperwork get straightened out. If a browser vendor disrupted the websites, because they knew of this court order and decided to take deliberate action to defy the authority of the court, that's contempt of court. The browser vendor then gets pulled up in front of the judge who granted the restraining order. The browser vendor says "ah, but the court order only says the certificate can't be revoked, we didn't revoke it we blacklisted it" and the judge says "that's a great argument so I'm not going to send you to jail, I'm going to send you to prison instead"
  - gaadd33 2y ago
    How does a judge send a company to prison or jail?
    - Radle 2y ago
      The person who ultimately made the decision is liable.
  - bastawhiz 2y ago
    No they didn't. You can read the order: > IT IS HEREBY ORDERED that DigiCert is prohibited from revoking the security certificates for the Alegeus Websites for a period of seven (7) days, or until the Court is able to schedule a hearing on the Motion, whichever is earlier. The order specifically mentioned Digicert and nobody else. The order doesn't magically apply to everyone else in the world.