DigiCert to Acquire Symantec’s Website Security and Related PKI Solutions

Post by [deleted] » Wed, Aug 02, 2017, 10:10 PM UTC

tptacek wrote: post #41

toomuchtodo wrote: post #37

Earlier quoted context omitted.

I suppose we'll agree to disagree (RegSCI in this case). Happy to grab a beer if you want to lecture me on how I'm wrong, I try to be open minded. Whether it's ceremony or not, I have to check the box or face harsh regulatory penalties.

Happy to do this over beer, but I'm not sure I understand which of the SCI rules would determine which CA you use. I'm a little amused (not at you, but at the absurdity of the whole process) that we're talking about CA selection for products that almost definitely can't even properly quote and unquote a FIX field separator from user input.

Post by justinjlynn » Wed, Aug 02, 2017, 10:13 PM UTC

tptacek wrote: post #30

justinjlynn wrote: post #22

Earlier quoted context omitted.

Indeed. Classic reverse buyout to escape a bad name. It's complete bullshit and the browser vendors should see right through it.

It would be a "classic reverse buyout" if DigiCert was going to continue to operate the Symantec CA infrastructure. If it is not, then Google and Mozilla will have accomplished their most important objective, which is the elimination of insecure certificate issuers in current operation. You clearly have other objectives you would like Google and Mozilla to accomplish for you, and I probably agree with many of them, b…

Post by tptacek » Wed, Aug 02, 2017, 10:15 PM UTC

justinjlynn wrote: post #44

tptacek wrote: post #30

Earlier quoted context omitted.

It would be a "classic reverse buyout" if DigiCert was going to continue to operate the Symantec CA infrastructure. If it is not, then Google and Mozilla will have accomplished their most important objective, which is the elimination of insecure certificate issuers in current operation. You clearly have other objectives you would like Google and Mozilla to accomplish for you, and I probably agree with many of them, b…

And now the same people who made that shitty infrastructure will control a large chunk of the business that created what was once (probably) a perfectly good one -- and likely make the same shit decisions that made their old one shit as well making digicerts' infrastructure worse, and eventually probably shit as well.

Post by justinjlynn » Wed, Aug 02, 2017, 10:21 PM UTC

tptacek wrote: post #45

justinjlynn wrote: post #43

Earlier quoted context omitted.

> What exactly does Google accomplish by somehow trying to prevent Symantec from having a beneficial interest in its customer base? What digicert is doing, in allowing Symantec to continue operating in their name, is wrong and really lessens what it means to completely fuck up the core mission of what a CA does and it makes a mockery of any sort of censure any browser/TLS developer/user could do. They should have to…

I'm really having trouble following you. You keep writing as if the alternative to Digicert's fire-sale acquisition was that Symantec's CA would simply vanish off the face of the Earth. No. False premise.

Post by justinjlynn » Wed, Aug 02, 2017, 10:24 PM UTC

geofft wrote: post #36

justinjlynn wrote: post #12

Earlier quoted context omitted.

You may want to come up with an escape plan then. If digicert can buy Symantec so that Symantec can escape censure what message does that send? At this point Symantec should be considered so radioactive that nobody would go near it for fear of contamination. Symantec betrayed all of us and digicert, in buying it and rewarding the behaviour is doing the same.

I think your outrage is properly directed, and I agree with you that this is way too nice an ending for Symantec. However, I don't think that anyone is actually going to make Symantec as contaminated as you or I want. If the people at DigiCert who were competent yesterday are operating Symantec's infrastructure today, that infrastructure is now trustworthy. And in buying and salvaging it, DigiCert did the community a…