4 ms·

Always two sides to a story but the guy who caused the validation bug at DigiCert already resigned because of it (which is extreme), the Sectigo guy wanted to p

Always two sides to a story but the guy who caused the validation bug at DigiCert already resigned because of it (which is extreme), the Sectigo guy wanted to prevent the bug being closed so he could keep pushing them (in a subjectively prickly fashion) for more answers about their general responsiveness. A bit of back and forth discourse is fine and expected, but if you keep pushing someone who has their own legal dept they're eventually going to wander over to the coffee machine and have a chat about it with them, then they're going to take a look and it becomes their problem. So the number one rule would be don't even breath the word "legal" unless you want to invoke them. This particular response is just a letter telling them to back off and it's why you have a legal dept, so they can argue with each other. This one has just found it's way into the open. There is a understandable perspective that says CAs shouldn't be burdened with legal risk in their discussions, but that's contrary to the fact these guys are commercial entities protecting their interests, so you don't get it both ways unless all your CAs are non-commercial, and even then that would only extend so far.

willvarfar 2y ago
You've given a detailed rundown like you've been following, so what is your sense about the resignation? Did the guy resign willingly, or is Digicert the kind of management that likely scapegoated him?
- braiamp 2y ago
  He assumed personal responsibility rather than institutional. At the time, everyone in the community expressed alarm that that happened, because 1) and this is obvious, there's no way a single guy would be responsible for the entire fallout and 2) because it sets a bad precedent about what companies can do with their PoC wrt web PKI. It also meant a loss in institutional knowledge about how things worked.
  - smithcoin 2y ago
    Do you have any resources regarding the resignation I could read?
    - lelandbatey 2y ago
      Here's the long message he left stating in part his resignation. The comments which follow spend quite some time speaking about his resignation: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c17 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c17
      - smithcoin 2y ago
        Thanks for pointing it out - I couldn't really follow the full 'drama' between the two threads.
      - MotherFlower 2y ago
        His resignation was merely a tactic to diffuse the situation. He didn’t actually leave—he's still there, active as ever.
  - thayne 2y ago
    > It also meant a loss in institutional knowledge about how things worked. And the experience earned from the mistake.
- 128bitz 2y ago
  [dead]
- DeepPPP 2y ago
  He is still here. Far from a scapegoat. Wait and see. He will be back in no time.
account42 2y ago
Perhaps they should have also had a chat with their PR departement. And anyone responsible for company strategy. Becose the actions of the legal department just backfired.
DeepPPP 2y ago
No he didn't truly resign. Retained as contractor and most likely waiting to be reinstated. You got misled.

willvarfar 2y ago

You've given a detailed rundown like you've been following, so what is your sense about the resignation? Did the guy resign willingly, or is Digicert the kind of management that likely scapegoated him?

braiamp 2y ago
He assumed personal responsibility rather than institutional. At the time, everyone in the community expressed alarm that that happened, because 1) and this is obvious, there's no way a single guy would be responsible for the entire fallout and 2) because it sets a bad precedent about what companies can do with their PoC wrt web PKI. It also meant a loss in institutional knowledge about how things worked.
- smithcoin 2y ago
  Do you have any resources regarding the resignation I could read?
  - lelandbatey 2y ago
    Here's the long message he left stating in part his resignation. The comments which follow spend quite some time speaking about his resignation: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c17 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c17
    - smithcoin 2y ago
      Thanks for pointing it out - I couldn't really follow the full 'drama' between the two threads.
    - MotherFlower 2y ago
      His resignation was merely a tactic to diffuse the situation. He didn’t actually leave—he's still there, active as ever.
- thayne 2y ago
  > It also meant a loss in institutional knowledge about how things worked. And the experience earned from the mistake.
128bitz 2y ago
[dead]
DeepPPP 2y ago
He is still here. Far from a scapegoat. Wait and see. He will be back in no time.

account42 2y ago

Perhaps they should have also had a chat with their PR departement. And anyone responsible for company strategy. Becose the actions of the legal department just backfired.

DeepPPP 2y ago

No he didn't truly resign. Retained as contractor and most likely waiting to be reinstated. You got misled.