5 ms·

Worth noting that CertSimple is a competitor of Symantec, and can't offer SGC certificates, so they are basically whinging that their competitor is marketing th

Worth noting that CertSimple is a competitor of Symantec, and can't offer SGC certificates, so they are basically whinging that their competitor is marketing their certificates on a feature people don't need. That's basically par for the course when selling to businesses, especially where non-technical people are in a position of deciding whether to buy, and which vendor to chose from. It'd also be nice if HackerNews wasn't quite so populated with thinly veiled ads for companies disguised as blog posts.

nailer 11y ago
We sell SSL certificates and we're quite proud of it. > can't offer SGC certificates We could sell SGC products today if we wanted to - we have the API keys, a partner account with another certificate provider (not Digicert), and a node module written for the relevant REST API. We don't want to. > are basically whinging that their competitor is marketing their certificates on a feature people don't need. Marketing certificates on a feature people don't need - and making it seem as if they need it - is wrong. > That's basically par for the course when selling to businesses, especially where non-technical people are in a position of deciding whether to buy, and which vendor to chose from. Being common does not make it right. If you think it does: what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK. Furthermore it's not 'par for the course': many other CAs don't sell IE5 support as hard as Symantec does. Here's DigiCert writing against SGC (we use DigiCert as our CA) https://www.digicert.com/sgc-ssl-certificates.htm https://www.digicert.com/sgc-ssl-certificates.htm, here's their competitor GoDaddy writing against SGC: http://agrihortico.com/freedownloads/SGC.pdf http://agrihortico.com/freedownloads/SGC.pdf
- dogecoinbase 11y ago
  what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK. Ugh, seriously? I was vaguely fine with the blog post before (though it is a bit advertisement-y for HN in context), but this is reprehensible (at least in the context of judging companies by the stances their employees take...).
  - javert 11y ago
    It's also reprehensible to say that it's OK for companies to cheat their cusomters. I don't think the CertSimple guy was actually trying to boycott that guy's company, he was trying to make a point.
    - lanaius 11y ago
      I read it as a mixed call to boycott (and shaming) together with an appeal to CertSimple's expertise; "I don't see you actually having any startups, and thus your opinion is meaningless. If you do have a startup you certainly are a bad startup."
      - nailer 11y ago
        It's a simple statement that companies shouldn't cheat their customers, nor should we support companies (including HN startups) that think it is OK to cheat their customers.
  - TazeTSchnitzel 11y ago
    I guess the author of the post, seeing someone defending what Symantec's doing, seems to have mistakenly assumed they are a Symantec employee. Perhaps they jumped to conclusions to quickly.
- bjterry 11y ago
  Is DigiCert able to provide SGC but they choose not to, or are they unable to do so?
  - yuhong 11y ago
    Browsers only trusted a limited number of roots for SGC. I wonder if any SGC certs actually were issued off "GTE CyberTrust Root" that expired in 2006.
    - vtlynch 11y ago
      Do you know how to identify if a Root can issue SGC certs? I am seeing an OID (2.16.840.1.113730.4.1) in the EKU field for both End-Entity and Intermediate Certs from Thawte, but nothing on the Root. Was the ability to issue an SGC cert more of a policy thing than an actual flag in the cert? I BELIEVE that DigiCert used to issue certs with SGC if you specially requested it, but I cant find any sources on that at the moment.
      - yuhong 11y ago
        It was a list built into the browser. For IE/SChannel they hardcoded two roots (into RSABASE.DLL/RSAENH.DLL I think), the VeriSign Class 3 root and "Root SGC Authority". When they added new roots into IE 5.01/NT4 SP6/Win2000, they made some of them SGC capable by shipping cross certificates to this "Root SGC Authority" (you can still see them if you have a WinXP system). The reason Thawte SGC SuperCerts uses the VeriSign root now was that this particular cross certificate expired in 2004.
  - nailer 11y ago
    I'm not sure re: Digicert, we (CertSimple) have an alternate certificate source that can provide SGC certificates, and choose not to.
- alex_sf 11y ago
  Just so you know, from a third party perspective, this reply looks ridiculous.
- umanwizard 11y ago
  Since when does everyone on HN automatically work for a startup?
- drzaiusapelord 11y ago
  >If you think it does: what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK. So much for the recent initiative of a calmer more respectful discourse here at HN. Now its "criticize my company? Fuck you, who do you work for so I can criticize you!"
- yellowapple 11y ago
  > what's the name of your startup? Why do you assume that every HN user is involved with some startup?
javert 11y ago
Companies calling out their competitors when they cheat customers and rip them off is a feature, not a bug.
- derefr 11y ago
  Indeed; "thinly-veiled ads" by an opponent in a zero-sum game is the impoetus behind half the useful data-gathering and analysis in the world. See: misdeeds by one political party investigated by an opposing party to create hit pieces; evidence investigated by the prosecution and defense on a criminal case to prove one-another wrong; etc.
  - javert 11y ago
    There are people in the business of exposing corporate fraud, and the way they make money is by shorting the stock before exposing the fraud.
vtlynch 11y ago
You are right, CertSimple is a competitor (reselling Digicert), but nothing in their blog post is wrong. They may be getting benefical advertising from this post, but they are doing so by providing a public service calling out the baseless fear mongering from Symantec and other CAs. As nailer replied, it may be common, but it is not right. Those tactics should be called out and shamed whenever possible.
Karunamon 11y ago
It would be even nicer if useful content wasn't immediately slagged on in the comment section by people accusing them of impropriety. So much for no gratuitous negativity...
drzaiusapelord 11y ago
I hate how certs have become this SEO-like snake oil, promoted in equally devious ways. This is pretty much free advertising for certsimple and an attack on some outdated Symantec webpage. Today its x cipher with y bits. Tomorrow its something else. Picking on old marketing and sales pages isn't the big scoop HN thinks it is. >It'd also be nice if HackerNews wasn't quite so populated with thinly veiled ads for companies disguised as blog posts. Have we had our weekly Cloudflare lovefest yet?

nailer 11y ago

We sell SSL certificates and we're quite proud of it. > can't offer SGC certificates We could sell SGC products today if we wanted to - we have the API keys, a partner account with another certificate provider (not Digicert), and a node module written for the relevant REST API. We don't want to. > are basically whinging that their competitor is marketing their certificates on a feature people don't need. Marketing certificates on a feature people don't need - and making it seem as if they need it - is wrong. > That's basically par for the course when selling to businesses, especially where non-technical people are in a position of deciding whether to buy, and which vendor to chose from. Being common does not make it right. If you think it does: what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK. Furthermore it's not 'par for the course': many other CAs don't sell IE5 support as hard as Symantec does. Here's DigiCert writing against SGC (we use DigiCert as our CA) https://www.digicert.com/sgc-ssl-certificates.htm https://www.digicert.com/sgc-ssl-certificates.htm, here's their competitor GoDaddy writing against SGC: http://agrihortico.com/freedownloads/SGC.pdf http://agrihortico.com/freedownloads/SGC.pdf

dogecoinbase 11y ago
what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK. Ugh, seriously? I was vaguely fine with the blog post before (though it is a bit advertisement-y for HN in context), but this is reprehensible (at least in the context of judging companies by the stances their employees take...).
- javert 11y ago
  It's also reprehensible to say that it's OK for companies to cheat their cusomters. I don't think the CertSimple guy was actually trying to boycott that guy's company, he was trying to make a point.
  - lanaius 11y ago
    I read it as a mixed call to boycott (and shaming) together with an appeal to CertSimple's expertise; "I don't see you actually having any startups, and thus your opinion is meaningless. If you do have a startup you certainly are a bad startup."
    - nailer 11y ago
      It's a simple statement that companies shouldn't cheat their customers, nor should we support companies (including HN startups) that think it is OK to cheat their customers.
- TazeTSchnitzel 11y ago
  I guess the author of the post, seeing someone defending what Symantec's doing, seems to have mistakenly assumed they are a Symantec employee. Perhaps they jumped to conclusions to quickly.
bjterry 11y ago
Is DigiCert able to provide SGC but they choose not to, or are they unable to do so?
- yuhong 11y ago
  Browsers only trusted a limited number of roots for SGC. I wonder if any SGC certs actually were issued off "GTE CyberTrust Root" that expired in 2006.
  - vtlynch 11y ago
    Do you know how to identify if a Root can issue SGC certs? I am seeing an OID (2.16.840.1.113730.4.1) in the EKU field for both End-Entity and Intermediate Certs from Thawte, but nothing on the Root. Was the ability to issue an SGC cert more of a policy thing than an actual flag in the cert? I BELIEVE that DigiCert used to issue certs with SGC if you specially requested it, but I cant find any sources on that at the moment.
    - yuhong 11y ago
      It was a list built into the browser. For IE/SChannel they hardcoded two roots (into RSABASE.DLL/RSAENH.DLL I think), the VeriSign Class 3 root and "Root SGC Authority". When they added new roots into IE 5.01/NT4 SP6/Win2000, they made some of them SGC capable by shipping cross certificates to this "Root SGC Authority" (you can still see them if you have a WinXP system). The reason Thawte SGC SuperCerts uses the VeriSign root now was that this particular cross certificate expired in 2004.
- nailer 11y ago
  I'm not sure re: Digicert, we (CertSimple) have an alternate certificate source that can provide SGC certificates, and choose not to.
alex_sf 11y ago
Just so you know, from a third party perspective, this reply looks ridiculous.
umanwizard 11y ago
Since when does everyone on HN automatically work for a startup?
drzaiusapelord 11y ago
>If you think it does: what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK. So much for the recent initiative of a calmer more respectful discourse here at HN. Now its "criticize my company? Fuck you, who do you work for so I can criticize you!"
yellowapple 11y ago
> what's the name of your startup? Why do you assume that every HN user is involved with some startup?

javert 11y ago

Companies calling out their competitors when they cheat customers and rip them off is a feature, not a bug.

derefr 11y ago
Indeed; "thinly-veiled ads" by an opponent in a zero-sum game is the impoetus behind half the useful data-gathering and analysis in the world. See: misdeeds by one political party investigated by an opposing party to create hit pieces; evidence investigated by the prosecution and defense on a criminal case to prove one-another wrong; etc.
- javert 11y ago
  There are people in the business of exposing corporate fraud, and the way they make money is by shorting the stock before exposing the fraud.

vtlynch 11y ago

You are right, CertSimple is a competitor (reselling Digicert), but nothing in their blog post is wrong. They may be getting benefical advertising from this post, but they are doing so by providing a public service calling out the baseless fear mongering from Symantec and other CAs. As nailer replied, it may be common, but it is not right. Those tactics should be called out and shamed whenever possible.

Karunamon 11y ago

It would be even nicer if useful content wasn't immediately slagged on in the comment section by people accusing them of impropriety. So much for no gratuitous negativity...

drzaiusapelord 11y ago

I hate how certs have become this SEO-like snake oil, promoted in equally devious ways. This is pretty much free advertising for certsimple and an attack on some outdated Symantec webpage. Today its x cipher with y bits. Tomorrow its something else. Picking on old marketing and sales pages isn't the big scoop HN thinks it is. >It'd also be nice if HackerNews wasn't quite so populated with thinly veiled ads for companies disguised as blog posts. Have we had our weekly Cloudflare lovefest yet?