Live data from Hacker News

WoSign and StartCom: Mozilla’s proposed conclusion

docs.google.com

251–252 of 252 posts

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#251
post #23

Earlier quoted context omitted.

after their heartbleed extortions they really deserve nothing less (and yes, I was a paying customer)

While their current/recent behaviours that are being discussed are deplorable, I don't think the heartbleed thing is as morally corrupt as many people affected make out. Their rules always clearly stated the cost of replacement certificates and that this would only be waived if the replacement was needed due to their fault. As heartbleed was not a problem they caused they were well within their agreements with the cu…

Oh come on, I get really tired of this "well, that's what the agreement said".

Revocation is a critical part of a well-functioning CA system, and charging for revocations of free certificates actively puts that at risk, because it disincentivizes people from revoking potentially-compromised certificates - that is why it's morally corrupt.

> They are a commercial body afterall.

That's their problem, and putting the CA system at risk because "well, we have to make money somehow" is not even remotely acceptable.

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#252

Well, this is as good a week as any to migrate my certificates to Let's Encrypt. I just need to figure out how to do domain validation.

I stopped using startcom after their response to the heartbleed vulnerability.

That really should have been my clue.
Post reply on HN