3 ms·
The article is down for me, but: From a POV of fairness to StartCom, I agree with you, and initially saw it as a ridiculous sense of entitlement on the part of
by Joeboy 13y ago
The article is down for me, but:
From a POV of fairness to StartCom, I agree with you, and initially saw it as a ridiculous sense of entitlement on the part of their (non-paying) customers. However as a third party user of the web I am somewhat persuaded by the simple argument that the certs should be distrusted on the basis that they are no longer trustworthy.
Edit: Having thought about it for a minute, a logical consequence of my argument is that all certificates signed by CAs that charge a revocation or reissue fee should be distrusted, which probably makes it not a very reasonable argument. I guess this just leaves us at "Valid SSL certificates are not necessarily trustworthy and we just have to live with that".
Edit2: http://news.netcraft.com/archives/2014/04/11/heartbleed-certificate-revocation-tsunami-yet-to-arrive.html http://news.netcraft.com/archives/2014/04/11/heartbleed-cert...
- revelation 13y agoI have no problem with them asking for money to issue a new certificate, but revoking the old one when it is compromised is an obligation they took on when selling (or giving it away) in the first place. An obligation to Mozilla and others that have put them in their trust store if I may add. It is the same reason we have mandatory recycling provisions. Just because your shit is free doesn't mean we have to sit by and watch you pollute the world.
- Joeboy 13y agoHm, by that argument I guess they (and all other CAs) should just revoke all of the ones on servers that are/were vulnerable without user intervention. I can't imagine that would make them any more popular, although it probably would be the right thing to do.
- deleted 13y ago[deleted]
- raimue 13y agoSorry for the downtime. I did not expect this to be that popular.