3 ms·

All this doesn't matter. What matters is the destructive potential and a breach of trust. CAs have been distrusted for less.

• john_strinlai 7mo ago
  >CAs have been distrusted for less. root programs are super specific about root cause analysis, what actions lead up to distrust, differentiating deliberate maliciousness from systemic incompetence, etc. its like the exact opposite of "all this doesnt matter". of course they still look at the outcome (danger to users, etc.), typically as a first step. but they take great care to determine exactly what lead up to a specific outcome.
  • orbital-decay 7mo ago
    It really depends on the scale of the breach, for example DigiNotar was immediately killed for their gross incompetence. In this case even the scale is unclear, with heavy suspicion towards malice and little hope on fixing any process inside that monstrous bureaucracy or even making it meaningfully care if it's not. I see no reason to trust Microsoft anymore, regardless of it being a fuckup or malice.
  • direwolf20 7mo ago
    I think they meant a CA that acted like Microsoft would be distrusted. Not a CA that acted like WireGuard would be distrusted.