4 ms·
This is utterly ridiculous. These people signed up for a free SSL certificate knowing that revocations would cost them money. Enforcing a contract that both par
by latortuga 13y ago
This is utterly ridiculous. These people signed up for a free SSL certificate knowing that revocations would cost them money. Enforcing a contract that both parties willingly agreed to does not make them untrustworthy, it demonstrates that their customers carry immense senses of entitlement.
There are tons of SSL certificate providers out there. Their business model was not a secret when folks signed up.
- sparkie 13y agoThe business model an practices of the company are completely irrelevant to the people concerned in this case though - the users of the web browser. They never signed up for shit, and they have no incentive to trust a business which refuses to invoke compromised certs because people are unwilling to pay. Yes, this doesn't make them untrustworthy as a business, since their business model was known - it does make them untrustworthy as a party which is meant to be securing the web though - because they'll be failing at it spectacularly. Again: I never signed up to shit, and their business model means shit to me too - I just want some degree of security when browsing.
- MereInterest 13y agoI am not their customer. At most, I am their customers' customer. Why do I have any obligation toward StartSSL? If StartSSL is free to choose a business model, then others are free to make judgment based on that business model. Should the customers of StartSSL pay the revocation fee? Yes. Should StartSSL be required to give free revocations? No. Are either of those at all relevant to whether or not I should trust StartSSL certificates, given that they are less likely to be revoked when they need to be revoked?