3 ms·

EDIT: Okay. Downvoter. Now defend your position. I think people should clam down and think thoroughly. I don't know the actual math on the cost for a CA to re

by yeukhon 13y ago

EDIT: Okay. Downvoter. Now defend your position. I think people should clam down and think thoroughly. I don't know the actual math on the cost for a CA to revoke and re-issue a new certificate. But what if someone finds another critical vulnerability? Do we go back and ask to revoke our certificate again? Free of charge? Is it necessary to call StartCom evil? Is that even fair? If you are serving real user data, please get a paid certificate yourself. Why? Because you have slightly better control of your certificate. If you are just running demo or running personal blog then get one from places like gandi.net (1 year at $16.00) edit: someone mention ssls.com and namecheap.com (resellers) offer cheap Comondo PositiveSSL at less than $10 per year. If you are running open source project, consider https://www.globalsign.com/ssl/ssl-open-source/ https://www.globalsign.com/ssl/ssl-open-source/ and http://www.godaddy.com/ssl/ssl-open-source.aspx http://www.godaddy.com/ssl/ssl-open-source.aspx. If you still can't afford one, I really don't know what to say to you at the moment.

drdaeman 13y ago
@EDIT: Sorry, that was me. I've misclicked the wrong button - meant to upvote, and there seems to be no way to undo. Nonetheless, I disagree. > Do we go back and ask to revoke our certificate again? Free of charge? That's right, ask to revoke. In current system, considering the position CAs' are in, trust is primarily their problem. If CA's not revoking the certificate that's compromised, it's CA who's to blame, not server administrators. Not sure about server admins who don't want to pay, but end users (those who see the false green padlock) have full moral right to call such CA "evil".
- yeukhon 13y ago
  Thank you. I think people should try to explain their downvote whenever possible so that I can have a decent discussion as my argument isn't always "correct". Like I said I don't know the cost to revoke certificate as a CA. One possible defense for StartCom is that they are worried about facing the same bill as the next critical vulnerability emerge. Someone said in some other threads that StartCom has this fee from ancient time. If that's true, this is just another "fine print" issue. > but end users (those who see the false green padlock) have full moral right to call such CA "evil". I agree. Though the question remains: should the CA take the blame of the flaw of a library every time given CA is not a charity, but a business?

by yeukhon 13y ago

drdaeman 13y ago

@EDIT: Sorry, that was me. I've misclicked the wrong button - meant to upvote, and there seems to be no way to undo. Nonetheless, I disagree. > Do we go back and ask to revoke our certificate again? Free of charge? That's right, ask to revoke. In current system, considering the position CAs' are in, trust is primarily their problem. If CA's not revoking the certificate that's compromised, it's CA who's to blame, not server administrators. Not sure about server admins who don't want to pay, but end users (those who see the false green padlock) have full moral right to call such CA "evil".

yeukhon 13y ago
Thank you. I think people should try to explain their downvote whenever possible so that I can have a decent discussion as my argument isn't always "correct". Like I said I don't know the cost to revoke certificate as a CA. One possible defense for StartCom is that they are worried about facing the same bill as the next critical vulnerability emerge. Someone said in some other threads that StartCom has this fee from ancient time. If that's true, this is just another "fine print" issue. > but end users (those who see the false green padlock) have full moral right to call such CA "evil". I agree. Though the question remains: should the CA take the blame of the flaw of a library every time given CA is not a charity, but a business?