Hacker News Reader

Comment by azeemba | Hacker News Reader

The ICP-Brazil thing was just a surprise coincidence as I was finishing up the article. I had started collecting my notes on the topic when Entrust got distrusted. Fun threads to read through:

- https://bugzilla.mozilla.org/show_bug.cgi?id=1890898

- https://groups.google.com/a/mozilla.org/g/dev-security-polic...

DigiCert incident was pretty loud so that got my attention too: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322

View on HN

That's really stupid: they got in trouble for writing down a requirement that wasn't actually a requirement and wasn't meant to be a requirement, in a human readable document, and then not revoking and reissuing those certificates which didn't meet the requirement, which still don't meet it so revoking and reissuing achieves nothing, and weren't supposed to meet it anyway so there's nothing actually wrong with them. Part of the point of having humans in a process is so that they can make sensible decisions when the process prescribes something nonsensical, but Mozilla wants to follow the nonsensical process at all costs.

No that's not what they did. They had made promises about how they would handle issuing certs not in compliance with their CPS then went back on them, after a long history of similar things.

It's all brown M&Ms here.

"Hey, just so you know, we did read your brown M&Ms clause, but since last month M&M is running a special promotion where they only make rainbow colours, we got you a bowl of yellow ones instead."

Which is the correct course of action:

"Of course. Thank you for paying attention to the spirit of the rule."

Or: "No, fuck you, show is cancelled."

---

All of the stuff I said happened did happen. The extra context you are providing is irrelevant since it does not change the fact that what happened is stupid and it's Mozilla's fault that stupid stuff happened.

Reply on news.ycombinator.com