4 ms·

That is a pretty breathtaking example of ivory tower thinking if there ever was one. I really just don't know what else I can say about that kind of proposal.

likeabatterycar 2y ago
To put things into perspective, the people behind the browser with < 2.5% market share are acting like they have the biggest swinging dick in the room, and proposing policies with authority, that could potentially screw over 100% of the internet. Think about that for a minute. The reality is the CAs could tell Mozilla to go pound sand and they would have no recourse. Is there not a governing body for certificate policies with voting members? CA trust should be handled at the OS vendor level. Mozilla having its own trust anchors is a relic of the past. If CAs refuse to comply, they at worst inconvenience 2.5% of their customers temporarily until they find a better browser.
- ForHackernews 2y ago
  >CA trust should be handled at the OS vendor level. Who's the "vendor" for Linux? IBM? The outcome of this idea is Google & Microsoft can MITM all internet traffic.
  - likeabatterycar 2y ago
    > The outcome of this idea is Google & Microsoft can MITM all internet traffic. Google, MS, and Apple already handle their own CA trust. So this conspiracy theory would already be true.
    - ForHackernews 2y ago
      Wait, is it a "conspiracy theory" or is it true? Are you claiming both? I'm aware that Google, Apple, Microsoft etc. could already MITM traffic to Chrome/Safari/Edge browsers if they were so determined.
  - ElevenLathe 2y ago
    > Who's the "vendor" for Linux? IBM? There are countless companies and groups (but only a handful that serve the vast majority of users) releasing a version of Linux bundled with a GNU userland and other open source niceties, all designed to work together as a system. These are colloquially called "Linux distributions".
    - agwa 2y ago
      Linux distros universally use the Mozilla root store. So if a CA told Mozilla "to go pound sand" as suggested by likeabatterycar, the CA would end up distrusted not only by the "2.5%" of browser users, but by every Linux server.
- agwa 2y ago
  Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users. As for Microsoft, they are simply asleep at the wheel, trusting terrible CAs that do things like misissue a google.com certificate <https://bugzilla.mozilla.org/show_bug.cgi?id=1934361 https://bugzilla.mozilla.org/show_bug.cgi?id=1934361>.
  - jonas21 2y ago
    Don't you think there's a difference between having short certificate lifetimes (which would be clear when the certificate is issued), and randomly revoking perfectly good certificates without warning?
    - agwa 2y ago
      They are not literally the same, but the point of both measures is to encourage automation by server operators, and are strongly opposed by those who would prefer to keep managing certificates manually. My point is - Apple, like Mozilla, doesn't mind inconveniencing server operators if they see a security benefit for users. (Also, the revocations would not be without warning - mechanisms like ARI can inform server operators prior to revocation so the certificate can be automatically replaced.)
      - WorldMaker 2y ago
        It's also a part of why Let's Encrypt exists as a market force from the other side of this playing field. Now that they've proven heavy automation works and shown they can use it to drive costs down, Apple and Mozilla don't look so crazy asking for the old, expensive behemoths to move faster/smarter/better.
  - likeabatterycar 2y ago
    > Google Chrome also takes a hard line when it comes to revocation requirements Unless you run an enterprise CA, in which case Chrome doesn't check for revocation AT ALL. Google went rogue and made up their own rules. The whole of PKI should be ripped up and not left up to those who can shout loudest.

likeabatterycar 2y ago

To put things into perspective, the people behind the browser with < 2.5% market share are acting like they have the biggest swinging dick in the room, and proposing policies with authority, that could potentially screw over 100% of the internet. Think about that for a minute. The reality is the CAs could tell Mozilla to go pound sand and they would have no recourse. Is there not a governing body for certificate policies with voting members? CA trust should be handled at the OS vendor level. Mozilla having its own trust anchors is a relic of the past. If CAs refuse to comply, they at worst inconvenience 2.5% of their customers temporarily until they find a better browser.

ForHackernews 2y ago
>CA trust should be handled at the OS vendor level. Who's the "vendor" for Linux? IBM? The outcome of this idea is Google & Microsoft can MITM all internet traffic.
- likeabatterycar 2y ago
  > The outcome of this idea is Google & Microsoft can MITM all internet traffic. Google, MS, and Apple already handle their own CA trust. So this conspiracy theory would already be true.
  - ForHackernews 2y ago
    Wait, is it a "conspiracy theory" or is it true? Are you claiming both? I'm aware that Google, Apple, Microsoft etc. could already MITM traffic to Chrome/Safari/Edge browsers if they were so determined.
- ElevenLathe 2y ago
  > Who's the "vendor" for Linux? IBM? There are countless companies and groups (but only a handful that serve the vast majority of users) releasing a version of Linux bundled with a GNU userland and other open source niceties, all designed to work together as a system. These are colloquially called "Linux distributions".
  - agwa 2y ago
    Linux distros universally use the Mozilla root store. So if a CA told Mozilla "to go pound sand" as suggested by likeabatterycar, the CA would end up distrusted not only by the "2.5%" of browser users, but by every Linux server.
agwa 2y ago
Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users. As for Microsoft, they are simply asleep at the wheel, trusting terrible CAs that do things like misissue a google.com certificate <https://bugzilla.mozilla.org/show_bug.cgi?id=1934361 https://bugzilla.mozilla.org/show_bug.cgi?id=1934361>.
- jonas21 2y ago
  Don't you think there's a difference between having short certificate lifetimes (which would be clear when the certificate is issued), and randomly revoking perfectly good certificates without warning?
  - agwa 2y ago
    They are not literally the same, but the point of both measures is to encourage automation by server operators, and are strongly opposed by those who would prefer to keep managing certificates manually. My point is - Apple, like Mozilla, doesn't mind inconveniencing server operators if they see a security benefit for users. (Also, the revocations would not be without warning - mechanisms like ARI can inform server operators prior to revocation so the certificate can be automatically replaced.)
    - WorldMaker 2y ago
      It's also a part of why Let's Encrypt exists as a market force from the other side of this playing field. Now that they've proven heavy automation works and shown they can use it to drive costs down, Apple and Mozilla don't look so crazy asking for the old, expensive behemoths to move faster/smarter/better.
- likeabatterycar 2y ago
  > Google Chrome also takes a hard line when it comes to revocation requirements Unless you run an enterprise CA, in which case Chrome doesn't check for revocation AT ALL. Google went rogue and made up their own rules. The whole of PKI should be ripped up and not left up to those who can shout loudest.