5 ms·

Even taking the (one-sided) depiction of the conversations in DigiCert's letter at face value, maybe Sectigo's guy was being a git at best and intentionally tro

Even taking the (one-sided) depiction of the conversations in DigiCert's letter at face value, maybe Sectigo's guy was being a git at best and intentionally trolling at worst. (I don't think he was, but let's play devil's advocate.) But even then, how did DigiCert think getting legal involved would possibly go well? Sectigo stands to gain publicity and lose nothing by going public with it to the CAB as they did here, and it's not like the CAB is going to play marriage counselor and get the two companies to make up because one of them got their feefees hurt. Besides, this kind of hyper-polite passive-aggressive "erm akchually" conversation happens in every CAB incident discussion. I don't know why DigiCert got particularly upset about this one.

akerl_ 2y ago
> Besides, this kind of hyper-polite passive-aggressive "erm akchually" conversation happens in every CAB incident discussion. As somebody who doesn't spend much time scrolling CAB reports, this was jarring to me. Digicert's legal action seems nuts, and there seems like a real, risky issue in the idea that a company's customers can use the legal system to block the company from complying with its obligations to other entities, but it's hard to see any way that could be productively addressed given the back and forth in the thread. It's like I'm watching a theatrical production staring the most stereotypical corporate drones trading comments with the most stereotypical IRC nerds, both sides doing circles around an interesting topic but too busy trading blows to ever really get to it.
- SpicyLemonZest 2y ago
  > there seems like a real, risky issue in the idea that a company's customers can use the legal system to block the company from complying with its obligations to other entities As Digicert has repeatedly explained, this is simply how the United States legal system works. Courts have broad and indisputable power to issue temporary restraining orders, and the parties to a case must comply even if doing so violates some promise they made to a third party. (The point of the TRO is to maintain the status quo while the court figures out details like what promises have been made to who.) People in the PKI community who believe that some carefully written policy would enable CAs to reject an invalidation TRO, or convince a court that they cannot issue it, are wrong. The reason it's never come up before is that no CA had previously attempted to enforce a widespread 24 hour revocation caused by its own error.
  - cjbprime 2y ago
    (I think Sectigo's argument is that Digicert did not even attempt to convince the court that it should be allowed to revoke those certificates in the mandated timeframe. If they had attempted and failed, I don't think they would be receiving criticism.)
    - SpicyLemonZest 2y ago
      That's their argument, yes, but it was clearly based on the incorrect belief that there's some emergency button you can press to demand that a court consider your arguments ASAP. As Digicert explained: > The legal world does not move as fast as the demands of our CA ecosystem. Our legal approach was to work with the complainant’s legal team to get the TRO dismissed in 5 days. The court would not have dissolved the TRO in anywhere close to 5 days without the complainant's cooperation, even if Digicert had an ironclad argument for doing so. Digicert made the right choice to get the certificates rotated as fast as possible - and I don't think Sectigo intends to argue it would be better to stand on principle even if that makes the revocation slower.
      - cjbprime 2y ago
        > the incorrect belief that there's some emergency button you can press to demand that a court consider your arguments ASAP ... isn't that exactly the legal button the complainant pushed to prevent the revocation?
        SpicyLemonZest 2y ago
        Should've been more specific. You can ask a court to do all kinds of things, but the individual judge who reads your filing doesn't have to (and in most cases can't) carefully analyze your arguments that day. They need time to think it over, and probably hearings where you and the other party can explain all the arguments for why certain rulings should or shouldn't be made. A contract dispute like this, where one party says they have a right to do something and the other party says they don't, is almost always going to take longer than 1 or 5 or 30 days for a court to figure out. Temporary restraining orders are the biggest exception. If DigiCert is about to do something crazy like take down all your websites, courts are generally willing to put a temporary stop to it without understanding all the details. "Preserve the status quo" and "prevent irreparable harm" are the buzzwords.
- joshuaissac 2y ago
  > but it's hard to see any way that could be productively addressed given the back and forth in the thread Another commenter mentioned in a sibling thread the possibility of using future-dated revocations. The CA could be mandated to publish such a revocation immediately, such that it takes effect by the 24-hour deadline. Once published, the revocations themselves should be irrevocable. This would also need to be accounted for in the CA's customer contracts. https://news.ycombinator.com/item?id=43169867 https://news.ycombinator.com/item?id=43169867
  - akerl_ 2y ago
    As the comment you linked to notes, that doesn't really fix the problem so much as it ensures that the CA's legal team gets to work nights and weekends for the next year. The legal system is almost certainly going to view future-dating and immediately publishing revocations poorly in any civil action where a customer claims harm.
    - account42 2y ago
      It fixes the problem of a customer getting an injunction despite what the contract says. If DigiCert doesn't want to be liable for harm they should improve their performance, no try to weasel their way out of the agreements that let their business exist in the first place.
- thayne 2y ago
  > but it's hard to see any way that could be productively addressed It sounds to me there are things digicert could have done better, without violating the court order: - they could have revoked all the other certs that weren't protected by the TRO. They did not. - they could have contested the TRO sooner. But they didn't. - Possibly, they could have given customers more warning, since they didn't notify customers until much of the 24 hours was gone That said, IMO I don't what they did is necessarily irredeemable. But they need to come up with, and execute on, a plan to make sure something like this doesn't happen again. And threatening legal action is really not a good way to re-establish trust.

akerl_ 2y ago

> Besides, this kind of hyper-polite passive-aggressive "erm akchually" conversation happens in every CAB incident discussion. As somebody who doesn't spend much time scrolling CAB reports, this was jarring to me. Digicert's legal action seems nuts, and there seems like a real, risky issue in the idea that a company's customers can use the legal system to block the company from complying with its obligations to other entities, but it's hard to see any way that could be productively addressed given the back and forth in the thread. It's like I'm watching a theatrical production staring the most stereotypical corporate drones trading comments with the most stereotypical IRC nerds, both sides doing circles around an interesting topic but too busy trading blows to ever really get to it.

SpicyLemonZest 2y ago
> there seems like a real, risky issue in the idea that a company's customers can use the legal system to block the company from complying with its obligations to other entities As Digicert has repeatedly explained, this is simply how the United States legal system works. Courts have broad and indisputable power to issue temporary restraining orders, and the parties to a case must comply even if doing so violates some promise they made to a third party. (The point of the TRO is to maintain the status quo while the court figures out details like what promises have been made to who.) People in the PKI community who believe that some carefully written policy would enable CAs to reject an invalidation TRO, or convince a court that they cannot issue it, are wrong. The reason it's never come up before is that no CA had previously attempted to enforce a widespread 24 hour revocation caused by its own error.
- cjbprime 2y ago
  (I think Sectigo's argument is that Digicert did not even attempt to convince the court that it should be allowed to revoke those certificates in the mandated timeframe. If they had attempted and failed, I don't think they would be receiving criticism.)
  - SpicyLemonZest 2y ago
    That's their argument, yes, but it was clearly based on the incorrect belief that there's some emergency button you can press to demand that a court consider your arguments ASAP. As Digicert explained: > The legal world does not move as fast as the demands of our CA ecosystem. Our legal approach was to work with the complainant’s legal team to get the TRO dismissed in 5 days. The court would not have dissolved the TRO in anywhere close to 5 days without the complainant's cooperation, even if Digicert had an ironclad argument for doing so. Digicert made the right choice to get the certificates rotated as fast as possible - and I don't think Sectigo intends to argue it would be better to stand on principle even if that makes the revocation slower.
    - cjbprime 2y ago
      > the incorrect belief that there's some emergency button you can press to demand that a court consider your arguments ASAP ... isn't that exactly the legal button the complainant pushed to prevent the revocation?
      - SpicyLemonZest 2y ago
        Should've been more specific. You can ask a court to do all kinds of things, but the individual judge who reads your filing doesn't have to (and in most cases can't) carefully analyze your arguments that day. They need time to think it over, and probably hearings where you and the other party can explain all the arguments for why certain rulings should or shouldn't be made. A contract dispute like this, where one party says they have a right to do something and the other party says they don't, is almost always going to take longer than 1 or 5 or 30 days for a court to figure out. Temporary restraining orders are the biggest exception. If DigiCert is about to do something crazy like take down all your websites, courts are generally willing to put a temporary stop to it without understanding all the details. "Preserve the status quo" and "prevent irreparable harm" are the buzzwords.
joshuaissac 2y ago
> but it's hard to see any way that could be productively addressed given the back and forth in the thread Another commenter mentioned in a sibling thread the possibility of using future-dated revocations. The CA could be mandated to publish such a revocation immediately, such that it takes effect by the 24-hour deadline. Once published, the revocations themselves should be irrevocable. This would also need to be accounted for in the CA's customer contracts. https://news.ycombinator.com/item?id=43169867 https://news.ycombinator.com/item?id=43169867
- akerl_ 2y ago
  As the comment you linked to notes, that doesn't really fix the problem so much as it ensures that the CA's legal team gets to work nights and weekends for the next year. The legal system is almost certainly going to view future-dating and immediately publishing revocations poorly in any civil action where a customer claims harm.
  - account42 2y ago
    It fixes the problem of a customer getting an injunction despite what the contract says. If DigiCert doesn't want to be liable for harm they should improve their performance, no try to weasel their way out of the agreements that let their business exist in the first place.
thayne 2y ago
> but it's hard to see any way that could be productively addressed It sounds to me there are things digicert could have done better, without violating the court order: - they could have revoked all the other certs that weren't protected by the TRO. They did not. - they could have contested the TRO sooner. But they didn't. - Possibly, they could have given customers more warning, since they didn't notify customers until much of the 24 hours was gone That said, IMO I don't what they did is necessarily irredeemable. But they need to come up with, and execute on, a plan to make sure something like this doesn't happen again. And threatening legal action is really not a good way to re-establish trust.