> Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?
Yes, because of the project's open nature the Mozilla CA program Bugzilla and their dev-security-policy mailing list have become the de facto public discussion point for TLS-related issues.
oof. even as a bystander i’m feeling the cortisol just reading the questions. i’m curious what even goes into compiling this list of questions - did they plan on going for the kill?
The intent isn't public shaming, it's to have enough information about what the hell happened, so that the failure mode can be squashed as thoroughly as possible in the future. Other CAs and interested parties should be terrified about the possibility that they have the same cockroach infestation as a result of using the same software or similar procedures, rather than sneer about how bad the so-called "human error" was this time.
They planned on expecting a reasonable level of competence.
There’s no excusing this. This is a company that specializes in “digital trust”. Even if they exit the TLS CA cert business, would you want to rely on them for the “post-quantum cryptography” prominently featured on their homepage?
This is a case where it would actually make sense for a government to come in and shut them down. There’s no reasonable scenario in which this is a company that anyone should use for “digital trust”, and any customers dumb enough to do that might literally need to be protected from themselves, for everyone’s benefit.
You wouldn’t have to twist my arm very hard to convince me that any customers that continue to use them after this incident should also be shut down.
Why brutal? Reads very reasonable to me, nothing personal and nothing about someone or feelings everything about the entity and its obligations.
I think they brutally expose the utter incompetence of that company.
People think “brutal” needs to be like a YouTube clickbait video
Reasonably brutal.
Offtopic: collapsing comments with a flair like ‘off topic’ or ‘me too’ is a great idea and really adds to keep the discussion on track.
This was a good read on the situation, thanks for the link.
Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?
> Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?
Yes, because of the project's open nature the Mozilla CA program Bugzilla and their dev-security-policy mailing list have become the de facto public discussion point for TLS-related issues.
oof. even as a bystander i’m feeling the cortisol just reading the questions. i’m curious what even goes into compiling this list of questions - did they plan on going for the kill?
The intent isn't public shaming, it's to have enough information about what the hell happened, so that the failure mode can be squashed as thoroughly as possible in the future. Other CAs and interested parties should be terrified about the possibility that they have the same cockroach infestation as a result of using the same software or similar procedures, rather than sneer about how bad the so-called "human error" was this time.
They planned on expecting a reasonable level of competence.
There’s no excusing this. This is a company that specializes in “digital trust”. Even if they exit the TLS CA cert business, would you want to rely on them for the “post-quantum cryptography” prominently featured on their homepage?
This is a case where it would actually make sense for a government to come in and shut them down. There’s no reasonable scenario in which this is a company that anyone should use for “digital trust”, and any customers dumb enough to do that might literally need to be protected from themselves, for everyone’s benefit.
You wouldn’t have to twist my arm very hard to convince me that any customers that continue to use them after this incident should also be shut down.
[flagged]