3 ms·
Fair enough, but bear in mind that StartSSL's revocation fee is lower than what most certificate providers charge as a starting price. Personally, I'm fine with
by teraflop 11y ago
Fair enough, but bear in mind that StartSSL's revocation fee is lower than what most certificate providers charge as a starting price. Personally, I'm fine with taking the risk and eating the $25 cost if something unexpected happens.
- clinta 11y agoNo company should be incentivising companies to not revoke compromised certificates. Even if the cost is modest. It's more about not patronizing a company with such a bad business model than it is about the dollar cost.
- currysausage 11y agoStartSSL's business model: making things free that don't cost them measurable money, and charging for transactions that cost them money. An exception from that rule in the wake of Heartbleed would arguably have been appropriate, but the business model as such is in no way bad. If the whole SSL industry worked in a way that put price and cost in proportion, there would be no need for Let's Encrypt.
- Karunamon 11y agoHow does an automated revocation cost them money?
- currysausage 11y agohttps://blog.cloudflare.com/the-hard-costs-of-heartbleed/ https://blog.cloudflare.com/the-hard-costs-of-heartbleed/
- mikeash 11y agoWhat about every other certificate issuer, whose up-front fees incentivize companies to not encrypt data in the first place?
- clinta 11y agoNot encrypting is better than not revoking a compromised certificate. A compromised certificate gives the user the impression that the connection is secure when it's security is compromised. A plaintext connection makes no false claims.
- mikeash 11y agoIn which case if you don't want to pay for revocation, you could just revert back to an unencrypted connection.