Hacker News Reader

Hacker News

Comment by ezoe | Hacker News Reader

Parent Full thread

ezoe

Meet Japanese government.

https://groups.google.com/g/mozilla.dev.security.policy/c/Me...

Mozilla: There are some misissued certificates. Revoke it.

Japan: Nah, you can trust us. We are government. It will expire soon anyway.

Mozilla: That's not an acceptable response. We do not trust you. Have a good day.

Japan: Wait. We will revoke. Just kidding. Please trust us.

Mozilla: Too late.

View on HN

"To conclude this discussion, Mozilla is denying the Japanese Government ApplicationCA2 Root inclusion request. I'd like to thank everyone for your constructive input into the discussion, and I'd like to thank the Japanese Government representatives for their patience and work to address issues as they have been discovered. I will be resolving the bug as "WONTFIX"."

Lol

"We are preparing to revoke certificates immediately, rather than waiting for certificates issued prior to 2017 to expire. However, even if we revoke those certificates, if your judgment is not affected and our request is rejected, there is no point in doing it. Please let us know if our request will be accepted by revoking all the certificates we issued prior to 2017."

oh lawd.....

That quote by itself is a reason to drop a CA. If you're only going to do the things you're REQUIRED to do when you're threatened with rejection/revocation, then you shouldn't be a CA to begin with. The arrogance shown in that thread is appalling.

> If you're only going to do the things you're REQUIRED to do when you're threatened with rejection/revocation, then you shouldn't...

Have you dealt with public sector before? That's essentially status quo across the board.

Don't trouble yourself. We'll handle revoking your certs for you... ALL of them.

If only regulatory agencies handled bad actors in such a no-nonsense manner. Instead it's a political mess, where larger players can strong-arm the regulator.

I have to concede, this is funnier than TrustCor, and much quicker, too.

Glad it gave you a laugh. To me, TrustCor isn't funny. They are obviously malicious. For this case, it's just incompetent that lead them to be banned.. A way funnier.

If you want funnier, read the WoSign threads, and their sequel, StartSSL.

I'm curious about Japan, surveillance, and cybersecurity. Are there any good reads on this combination of topics?

It's hard to find resources in English describing the Cybersecurity environment and posture in Japan, but having worked with Japanese organizations in that space, they have decent talent but middling institutional knowhow and process. Basically slight more competent Germans if I'm being honest. On the other hand, South Koreans organizations tend to have their shit together.

Surveillance:

https://theintercept.com/2018/05/19/japan-dfs-surveillance-a...

https://www.nytimes.com/2022/02/02/business/japan-elderly-su...

https://giswatch.org/en/country-report/communications-survei...

Cybersecurity:

legal framework - https://iclg.com/practice-areas/cybersecurity-laws-and-regul...

policy - https://thediplomat.com/2022/09/japan-needs-a-cyber-ministry...

Reply on news.ycombinator.com