Call me cynical but I think it's only a matter of time before the internet becomes totally Balkanized. Heck, it's almost there right now.
I love bashing America as much as the next guy, but equating it to China in terms of trust is not fair.
IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business.
But you can understand why, by default, anyone who doesn't live in Kazakhstan has little to gain from trusting those CAs. The default roots are default for everyone, at the moment, so they need to be universal. Maybe they should have some sort of detection, i.e. "we see you're in Kazakhstan, trying to access this Kazakh site which is only available with this distrusted CA, would you like to trust this certificate?"
> IMO software must respect every country and let government to act on their citizens as they want, even if some US guy thinks that it's not OK. It's not really his business.
It's kinda two things, "letting" citizens submit to their governments with your software is different from specifically enabling it, which seems like what you're suggesting. Out of principle, I won't be making any particular effort to enable a "government to act on their citizens as they want", because that is immoral.
If you want software that goes out of its way to oppress you, then you can write it yourself, or find somebody who will take money for that.
The issue here is not so much technical as cultural. Mozilla employees don't know or care about people from Kazakhstan and didn't prioritise finding ways to reduce the disruption.
No more or less than any other root CA? They're run by the legitimate, internationally recognised, democratically elected government of Kazakhstan. I'd expect many Kazakh businesses to have a certification path with that CA at the root; that seems like no more or less legitimate a root certificate than, I don't know, Deutsche Telekom or VeriSign or whoever. Currently I use more websites that are based in the US or Germany than are based in Kazakhstan, sure, but it's not like there aren't legitimate web businesses in every country.
The government of Kazakhstan used the CA inappropriately, to impersonate at least 37 domains. That is at least illegal in itself, as far as international trademark law is concerned. It contravenes all norms of international business.
In short, the claim that the government of Kazakhstan is a "model international citizen" is particularly laughable in the context of their abuse of their root certificate, and you'd be an absolute fool to trust it when connecting to hosts outside Kazakhstan (assuming you kinda have no choice when doing business with hosts within Kazakhstan).
Back when I worked for a Fortune 500 company they did exactly the same thing. So no, it's a completely normal, widely accepted practice for international businesses. (Also note that at least one major US ISP injects its own "content" into third-party websites).
No, it is not the same thing. Kazakhstan is not your employer intercepting your work computer's traffic while you're at work, it's a country intercepting all of your communications toward state goals. You can't just "quit" Kazakhstan.