mikemaccana

Mike from CertSimple, replying from ye-olde-openid account:

Wildcards don't exist for EV (non-EV certs allow you to register *.whatever.com, then make github.com.whatever.com).

Totally agreed re SANS. I'd like that to change too. Once we switch to evergreen browsers, some of the newer CAs will hopefully shake up the market a little.

Side note: all certificates these days are SANS (ie, nearly everyone has non-www and www, and the actual CN isn't looked at except as a fallback in old IE).

Official guidelines are here: https://cabforum.org/wp-content/uploads/EV-V1_5_2Libre.pdf

Certificates usually use the x509v3 object for 'Jurisdiction of Business Name' and this would point to the national / state level identifier. Ie, in the UK, Digicert looks up the company on Companies House and signs the UK company ID - the end-user doesn't supply the company ID, just the legal name, the verifying CA then checks the government authority to get the company ID. It would be similar in Brazil.

You can see the national company ID inside an EV cert from the browser, and also from openssl:

https://certsimple.com/blog/do-ev-ssl-certificates-have-bett...

One of the the things we're looking at is getting metrics on the parts that most people don't have, do better pre-arm people for verification.

No, not really. I have code written for the Comodo API from before I spoke to Digicert. I would get a MUCH larger cut for that than I do Digicert.

> Or would GeoTrust somehow force you to participate in that IE5 upsell if you were to sell their EV-certs instead of DigiCerts?

Yes. The Symantec reseller agreement (remember, GeoTrust is a brand not a company) explicitly forbids you from contradicting their marketing.

Also: part of doing good in the world in not supporting people who trick others.

Mike from CertSimple here, from my old openid account (as I'm replying too fast with my other one):

> $469 USD per year?

No. All certificates are two years - the big price is the total. I've made this more apparent on the front page.

If someone wants a non-EV cert we also recommend https://letsencrypt.org

We could easily sell non-EV certs - they can be generated in seconds as they don't require manual ID verification to make a quick buck, but I think poor identity verification is what got SSL into the current mess we're in. You'll note GitHub, Stripe, Mozilla and npm have EV certs. Make of that what you will.

Unfortunately letsencrypt doesn't do EV certs.

We compared Symantec (whose brands include GeoTrust) when deciding on a CA partner. We picked Digicert based on the issuance speed and business practices. Symantec upsell IE5-level export encryption as a security feature. We don't want to support that.

The CA we chose to partner with - Digicert - who we have the same prices as - sits in the middle of the market. They makes the certs for GitHub, Facebook, Intel, Yahoo, and Nintendo.

Mike, openid account here:

Feedback heard loud and clear - prices are now front and center on the site.

Mike from CertSimple here on old openid account, main one is submitting too fast:

We're not a big fan of trust logos either - though if you do want one it's included. As well as the tests you mentioned, usertesting.com ran some tests where removing them aids conversion:

http://info.usertesting.com/OnDemandWebinarOptimizeYourWebFo... at 36:15

> This is a case study I borrowed from Pep at ConversionExcel, that tested this for one of his clients. This is the original one"

https://certsimple.com/images/blog/trust-seals-stop-conversi...

> I'll show you the variation here. He removed some from fields, he also treated the copy copy and he also removed the stuff over here (the trust seals), so there's multiple things going on.

https://certsimple.com/images/blog/removing-trust-seals-conv...

> What I want to show you is that =the version without all the other stuff and the trust seals converted better=.

https://certsimple.com/images/blog/removing-trust-seals-conv...

There's also another study (trying to find link) where they found making your own trust logo improved conversions.

As with the nature of user testing: other people's results may not apply to you. Measure yourself.

(Mike here, replying with my old openid account as I'm submitting too fast)

> Clicking on "Get Started" scrolls up and expects me to start filling the form. Sleazy, very sleazy.

Hi there - the only way to 'Get started' getting an EV cert is to start collecting the info for the CSR. I have the same opinion of GoDaddy as you do - if there's something I can do better here I'm open to suggestions.

I've adjusted the code to always show the prices on the first step without the HN link. Originally I used the drop down banner at the top because the banner is animated and prominent, but since it doesn't show up if there's no coupon code, I've moved it to the main page.

Digicert provide the verification and support (we also provide our own in addition). Your CertSimple order ID is a valid Digicert order ID, and you can call Digicert and quote the order ID we give you. We just make the application process simpler.

What browser/OS are you using? I'm having trouble replicating the bug you encountered.

(Mike here: posting from my old openid account because 'you're submitting too fast')

DigiCert are indeed our parter CA - they do Facebook, GitHub, Stripe and Yahoo's SSL certs. We looked at a number of CAs (and actually wrote code against their APIs when we were testing), and chose DigiCert based on a combination of EV verification time and business practices.

Our retail prices are the same as DigiCert's - I suspect you're looking at the 'per year' price on https://www.digicert.com/ev-ssl-certification.htm. With the HN discount, you get the ability to apply for a certificate in less than a minute combined with DigiCert's fast verification practices.

With CertSimple the big number is always the final price.

That includes unlimited server licenses, we don't try and upsell SGC, etc. We're actually really picky things like that, see: https://certsimple.com/about

>Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated?

No, you don't. This is mentioned in the article.

Really? I bought the shiny blue liquid vista pearl looked a lot like a poor, and very self conscious, attempt to imitate their competitors.

Interestingly, Chrome and Gmail do strange things when you MITM attack them. Try enabling Charles Proxy and watch all he requests to securebriwsing.Google.com.

Html5test.com scores? I've got a new android phone but it won't run chrome.

Ifconfig will fail completely in some cases.

Eg, an alias on a vlan on a bond.

Oh that's neat. Thankyou.

He said open standard, not FLOSS.

Then use 'their'.

Yep. As someone who wants to know if they have CarrierIQ, my main concern is whether I have CarrierIQ.

They don't pay as much attention to UI as these guys. I'd rather use the better app.

Have you used ICS? They don't have a consistent icon theme, there's multiple messenger apps with different look and feels, the UI favors Tron era styling over actually using the capabilities of a modern display, and the widget adding has a strange 3d effect that means your not quite sure where you're putting something anymore.

Sure. The HTC hero was considered phone of the year by T3, the biggest gadget magazine in the UK, over the iPhone.

granting privileges to a select group of people and denying then to others in particular contexts skews power even more.

If I was your customer, the fact you're trying to get systemtap running on ubuntu rather than RHEL or a derivative would concern me.

Someone should really write an article on using dtrace on a BSD where it's patchable, but not officially supported, and call it 'using dtrace'. The article is very transparent FUD.

Some background from WP:

"Brittany is a female given name of French and Latin origins, after Brittany, a region of France...

Brittany is also derived from 'Britannia', a 2nd century Roman goddess."

Isn't the name ' britney' itself a misspelling?

'Properly'.

But yes, otherwise I find I don't have time to fix it later. Occasionally, when I know there's a better way of doing it but am having trouble thinking of it immediately I throw a # TODO in there.

In the major distros, Fedora and Ubuntu and OpenSuSE, a lot of packages, some of which aren't used by most users, sometimes default iptables rules, sometimes no iptables rules at all.

In newer, less friendly but more tech oriented distros (these aren't opposing forces, but in Linux they're misunderstood to be) like Arch, a lot less.

This would apply to Pyjamas (Python that compiles to JS) too.

That said, Coffeescript is very similar to Python.

Assuming a cleanup is significant, yes, I'm fairly sure Google or another high-profile Linux contributor would have done the same. It's just maintenance work - necessary, but not industry changing like the initial release of GNU+Linux (as a complete OS) was.

I think most of the complaints were about UAC, which was acknowledged to be overly chatty by Microsoft when they refined it in 7.

Are you replacing IMAP and MAPI (mail delivery protocols, per your article) or SMTP, or both?

I think this will take a lot more than a single blow.