Before I reply, can I say that this level of informed and considered
debate is _exactly_ what I was looking for? Thanks to everyone who has
participated so far.
On 15/05/15 19:49, Ryan Sleevi wrote:
> - By introducing a demarcation of power/privilege by "government" or not
> (which still suffers from the definitional issue that you've entirely
> danced around :P), it ostensibly undermines the notion of global
I'm not sure that's so. It says that governments aren't global. If we
started name-constraining non-government CAs, it might well undermine
the notion of "global".
> (e.g. if
> you're required, by local jurisdiction, to only use CAs approved by
> Country A, then you can no longer apply for any arbitrary name but only
> those CAs approved by Country A can issue to)
I guess some jurisdiction could make that rule, but how does that relate
to what we are suggesting? Are you saying that if Mozilla
name-constrains government CAs, that would somehow encourage governments
to have "approved CA" lists for their citizens?
> - By introduction restrictions on what government CAs can do, it creates a
> different standard of openness. That is, it presumes corporations are
> trustworthy and governments are not (this is your first question, which is
> implicitly answered in the positive in any discussion pro-constraint), and
> corporations can openly participate while governments cannot.
I don't agree that name-constraining government CAs must necessarily be
interpreted as making a statement about their trustworthiness.
But I do also think that it is much more likely that people around the
world have divergent views of the trustworthiness of government X than
they do of random CA Y.
> - In the pro-constraint case, which again arguably answers the first
> question you pose by saying "Yes, there is a difference", it introduces
> the beginnings of technical control to introduce borders on the Internet,
> by (effectively) restricting what domains individuals can purchase, and
> further encouraging a centralization of names that are in government
> control.
If a government can make a law that "everyone has to use CA Foo", then
they can (if they want) just as easily make a law that "everyone has to
use a .ourcountry domain". If it were advantageous to them to do so,
wouldn't they do it already?
> 6) The effectiveness of the Internet as a public resource depends on
> interoperability (protocols, data formats, content), innovation and
> decentralized participation worldwide.
>
> - Name-constraining CAs has the effect of centralizing protocols
> (vis-a-vis DNS)
Not following you there either, I'm afraid :-(
> - Name-constraining CAs has the effect of discouraging interoperability by
> introducing multiple semi-subjective criteria into the discussion of trust
> ("What is a Government CA", "What is a government TLD")
I'm not sure that subjectivity is an interoperability issue. The fact
that the Government of Somwhereistan's certificate for .com is
recognised in IE and not in Firefox is an interoperability issue, of course.
>>> In case it's not clear, I think imposing name-constraints on CAs to be
>>> bad
>>> for the web and not a scalable solution, even if it appears attractive
>>> :)
>>
>> Again, expansion on these points would be appreciated :-)
>
> I'm sure just as you wish for me to expand on this, I wish to understand
> what specifically you're asking about.
How is it bad for the web? (You have started to expand on this already.)
How is it not a scalable solution?
> This conversation has been raised multiple times, and I've raised multiple
> objections and concerns each time it's been raised.
I hope (perhaps naively) that the outcome of this discussion will be
consensus, and a document outlining the reasoning, so we don't have to
discuss it again.
> For better or for
> worse, I've written fairly extensively on this list why it's a bad idea,
> and why various proposed modifications are equally problematic.
My apologies for having a short memory; feel free to reference earlier
posts you have made.
> I mean, the definitional issues alone should show how subjective this is.
I agree there are definitional issues; I don't agree that they are
collectively a showstopper.
> There are so many more important things to spend our time on with regards
> to improving trust. Simply embracing and encouraging greater transparency
> (e.g. through Certificate Transparency) could go a long way in
> establishing an objective basis for discussions about trustworthiness, and
> the quality of audits, and the compliance and adherence to technical
> requirements, rather than gut speculation and the jingoistic
> sentimentality it inevitably invites.
"Certificate Transparency is becoming a thing; therefore this move is
unnecessary, because if governments acted badly, we'd know" would be an
argument with reasonable weight.
Gerv
_______________________________________________
dev-security-policy mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security-policy
