4 ms·

Why is it Google that is making these rules? A company would not have this kind of power in a fair competition market.

by blueflow 1y ago

WorldPeas 1y ago
now I guess we understand why chrome is too dangerous for them to own from a monopolistic standpoint
- DocTomoe 1y ago
  You could say that about any large browser vendor, and I seem to remember there having been a 'free' CA (OpenCA? FreeCA?) in the late 2000s, early 2010s which lost Firefox support over something small as well. The truth is - the whole infrastructure depends on trust. And of one vendor of a major browser decides to no longer trust a CA, for whatever reason, the CA becomes essentially worthless overnight. Yes, people theoretically can install their own Root certificates. No, 99,99% of internet users won't.
  - WorldPeas 1y ago
    The problem here is conflict of interest, Google is very interested in maintaining the GMail monopoly, that is likely the #1 reason people have google accounts. Correct me if I'm wrong but no other vendors save for edge(MS) and safari(Apple) own a mail service, a browser should be an impartial connection to an open ecosystem, and especially in Apple or MSIE's case we can see how this can be severely abused.
    - DocTomoe 1y ago
      No, I'm with you. this clearly is just another sneaky move by one of the big guys. Browsers should be impartial. And, - personally - I think CA management should be OS-level, not browser-level, though that only moves the problem to another potential abuser. In the end, the whole trust-based encryption of http concept is inheriently faulty and abusable. Doesn't mean there is not the problem of 'trust' not being enforceable.
jaoane 1y ago
[flagged]
- toomuchtodo 1y ago
  No, Let's Encrypt is an independent entity. https://www.abetterinternet.org/about/ https://www.abetterinternet.org/about/ > ISRG is a California public benefit corporation, and is recognized by the IRS as a tax-exempt organization under Section 501(c)(3) of the Internal Revenue Code.
  - bityard 1y ago
    But Google is one of their top sponsors: https://www.abetterinternet.org/sponsors/ https://www.abetterinternet.org/sponsors/
    - toomuchtodo 1y ago
      This only reduces their independence if they are making decisions based on that specific sponsorship. AWS and the German government (https://www.sovereign.tech/ https://www.sovereign.tech/) are also sponsors at that level, for example. Maybe the US government should kick in some change?
aaomidi 1y ago
Google is making these rules for it's own root program. There are multiple root programs out there. Also, root programs have their own requirements, and then the general baseline requirements discussed in the CA/B forum. The industry self-regulates pretty darn well.

Why is it Google that is making these rules? A company would not have this kind of power in a fair competition market.

WorldPeas 1y ago

now I guess we understand why chrome is too dangerous for them to own from a monopolistic standpoint

DocTomoe 1y ago
You could say that about any large browser vendor, and I seem to remember there having been a 'free' CA (OpenCA? FreeCA?) in the late 2000s, early 2010s which lost Firefox support over something small as well. The truth is - the whole infrastructure depends on trust. And of one vendor of a major browser decides to no longer trust a CA, for whatever reason, the CA becomes essentially worthless overnight. Yes, people theoretically can install their own Root certificates. No, 99,99% of internet users won't.
- WorldPeas 1y ago
  The problem here is conflict of interest, Google is very interested in maintaining the GMail monopoly, that is likely the #1 reason people have google accounts. Correct me if I'm wrong but no other vendors save for edge(MS) and safari(Apple) own a mail service, a browser should be an impartial connection to an open ecosystem, and especially in Apple or MSIE's case we can see how this can be severely abused.
  - DocTomoe 1y ago
    No, I'm with you. this clearly is just another sneaky move by one of the big guys. Browsers should be impartial. And, - personally - I think CA management should be OS-level, not browser-level, though that only moves the problem to another potential abuser. In the end, the whole trust-based encryption of http concept is inheriently faulty and abusable. Doesn't mean there is not the problem of 'trust' not being enforceable.

jaoane 1y ago

[flagged]

toomuchtodo 1y ago
No, Let's Encrypt is an independent entity. https://www.abetterinternet.org/about/ https://www.abetterinternet.org/about/ > ISRG is a California public benefit corporation, and is recognized by the IRS as a tax-exempt organization under Section 501(c)(3) of the Internal Revenue Code.
- bityard 1y ago
  But Google is one of their top sponsors: https://www.abetterinternet.org/sponsors/ https://www.abetterinternet.org/sponsors/
  - toomuchtodo 1y ago
    This only reduces their independence if they are making decisions based on that specific sponsorship. AWS and the German government (https://www.sovereign.tech/ https://www.sovereign.tech/) are also sponsors at that level, for example. Maybe the US government should kick in some change?

aaomidi 1y ago

Google is making these rules for it's own root program. There are multiple root programs out there. Also, root programs have their own requirements, and then the general baseline requirements discussed in the CA/B forum. The industry self-regulates pretty darn well.