Weird. The copy I read says they have just deleted that section of their user agreement.
Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
221–230 of 404 posts
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#222Earlier quoted context omitted.
It shouldn't be located in Europe (because, as you said, US minions are no better than the US itself). Instead it should move to a neutral country, somewhere like Singapore or Uruguay.
Suddenly the idea of having a CA hosted in space on a satellite issuing certs seems like a good idea.
New startup idea: Starlink for TLS.
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#223Earlier quoted context omitted.
This is not that though. This is literally about a company that has a branch in the USA and another branch in another country, where it's bound by that country's laws. If the foreign entity which just so happens to be commercially linked to the one in the USA has any dealings with countries sanctioned by the US, the US branch is punished. There was a case a few years ago where a public University in Brazil bought lab…
Incorporating a subsidiary in a foreign country doesn't make the parent company immune to the legal obligations it has in it's home country. It would be absurd if that were the case. Sometimes people try setting up subsidiaries overseas to hide their evasion of the law, but it is illegal to do so.
> Incorporating a subsidiary in a foreign country doesn't make the parent company immune to the legal obligations it has in it's home country.
We're not talking about legal obligations in its home country though. I can buy Jack Daniels at age 19 in my country from their local subsidiary, and no-one thinks that this should be a crime for their US parent company because the US drinking age is higher. (Of course it would be a crime for either the parent or the subsidiary to sell to 19 year olds in the US)
(No-one is blaming Dell or Let's Encrypt here, to be clear, it's the US' excessive extraterritorial laws that are the problem)
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#224Earlier quoted context omitted.
Incorporating a subsidiary in a foreign country doesn't make the parent company immune to the legal obligations it has in it's home country. It would be absurd if that were the case. Sometimes people try setting up subsidiaries overseas to hide their evasion of the law, but it is illegal to do so.
You may call it a subsidiary all you want, but it's still a company that's wholly incorporated in foreign soil, doing business in foreign soil. At least in Brazil, companies that operate there must obey local laws. What happens when those laws are in contradiction with US laws, like in the example I cited? Is Brazil supposed to cave? Is Brazil supposed to keep fining Dell Brasil until it folds? Maybe prosecute Dell B…
It is plainly routine for a company to have to deal with multiple legal jurisdictions at a time.
Yes, sometimes this causes compliance complication. This isn't unusual, it happens frequently.
Ultimately, every government exercises the laws of their country as they see fit, using the enforcement tools they have available to them. These rules often extend outside of their borders and apply to foreign or partially-foreign entities depending on the situation. The only limits on this are the practical means of enforcing it.
Dell Brazil would have been subject to Cuba sanctions because it was controlled by the US parent company. The US has obvious jurisdiction over Dell Technologies the parent company, and the nexus to enforce it.
Nothing you are are describing is even remotely unique to the US. No country is going to let you set up a foreign subsidiary to launder goods around sanctions law. If they did, everyone would do that and nobody would ever follow sanctions.
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#225Is this actually new? Looks like a standard US export restriction for encryption technology to me. These sorts of restrictions have been around since the '90s. Let's Encrypt becomes subject to US export restrictions on cryptography if they are a US company, or if they post anything to github or post anything to major app stores. Every app I have ever posted to Google Play has had to submit a form to the US government…
Organisations that are serious about promoting privacy should have been avoiding the US since the '90s and/or '50s, but the second best time to reincorporate in a safe jurisdiction is today.
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#226Gotta love the word 'sanction'. It is it's own antonym! "The committee sanctioned the new policy." (approved it) "The committee sanctioned the rogue nation." (penalized it)
There are many autoantonyms in traditional English, e.g. cleave.
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#227Is this actually new? Looks like a standard US export restriction for encryption technology to me. These sorts of restrictions have been around since the '90s. Let's Encrypt becomes subject to US export restrictions on cryptography if they are a US company, or if they post anything to github or post anything to major app stores. Every app I have ever posted to Google Play has had to submit a form to the US government…
A certificate is not cryptography, though, it's a number. The entity requesting the certificate already has the cryptographic software installed on their servers, as do the clients trying to connect to them. There's nothing technologically special about the number, it's all in the realm of the social contract, in that it has been blessed by a chain of trust.
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#228Earlier quoted context omitted.
Incorporating a subsidiary in a foreign country doesn't make the parent company immune to the legal obligations it has in it's home country. It would be absurd if that were the case. Sometimes people try setting up subsidiaries overseas to hide their evasion of the law, but it is illegal to do so.
> Incorporating a subsidiary in a foreign country doesn't make the parent company immune to the legal obligations it has in it's home country. We're not talking about legal obligations in its home country though . I can buy Jack Daniels at age 19 in my country from their local subsidiary, and no-one thinks that this should be a crime for their US parent company because the US drinking age is higher. (Of course it wou…
If you are in the US you must ensure that your local company, and any sub-entity you control abroad complies with sanctions law. That is US law, and the US can apply that law to Dell the parent company, because it is in the US and controls the subsidary.
> I can buy Jack Daniels at age 19 in my country from their local subsidiary, and no-one thinks that this should be a crime for their US parent company because the US drinking age is higher.
Because there is no US law that says you cannot sell alcohol to people abroad under 19. Heck, there's no US federal law that says Jack Daniels can't sell to people in the US under 19, either. And in fact, there are some places in the US where you can legally drink at 18, e.g. Puerto Rico. But if the US congress wanted to pass one of these laws and enforce it, it could.
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#229Earlier quoted context omitted.
I always saw it as a trust-chain and think that anyone is welcomed to create a root certificate and distribute it to whomever trusts them. Most simple services may not need TLS, but with the ISPs eavesdropping on our communication, a form of secure communication is required and the currently best solution we have requires a trust-chain to be built.
> I always saw it as a trust-chain and think that anyone is welcomed to create a root certificate and distribute it to whomever trusts them. Note that phones already try to prevent you from using a certificate that you provide yourself.
"Try to prevent"? What does that mean?
Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]
#230Earlier quoted context omitted.
> every government will absolutely double-issue certificates to police, secret service and friends of goverment, and no one will have any recourse. Countries already have CA that issue certificates with more legal force than a handwritten signature. I can open a bank account, pay my taxes and sign up to all government services. But I can't use them for a webpage. > With DANE (or other country-issued certificates) DAN…
DANE is entirely dependent on DNSSEC, and DNSSEC is, by design, under the government control, with all the bureaucratic mess and mistakes this implies. This would be pretty terrible if anyone actually cared about DNSSEC, but luckily for us, no one cares.. So let's keep things this way.
You obviously don't know how DNSSEC works. The DNS root of trust is ICANN, not a government.