On Sat, Dec 29, 2018 at 10:24 AM Lee <[email protected]> wrote: > > It does not seem like a productive discussion will emerge if the ontology > > is going to be honest/dishonest participants. > > I think it's an excellent distinction. An honest subscriber won't > deliberately attempt to spread malware. But I like the idea of CAs > revoking certs for sites deliberately trying to do harm.. even tho I > get the impression that few actually revoke certs for that reason. >
It's not, because it presumes to know the ineffable in order to make a judgement. Beyond the simple fact that more harm is done, immediately and long term, by revoking for 'malware' (as the example was given, as problematic as it may be), it suggests that a site that gets compromised, or has its key compromised, is either not an honest subscriber or 'deserves' it. It incorrectly frames the discussion around protecting people from themselves, which as highlighted, is not solely the goal, nor is it reasonable to suggest 'they deserved to get compromised'. In many cases that Jakob tried to pose as honest (and the corollary, dishonest), might be cast across another axis of intentional and unintentional. An honest subscriber may be unintentionally affected by a CA, whose misissuance may have been intentional or unintentional. And that's mostly unknownable[1]. [1] https://www.youtube.com/watch?v=PBnO9dw3n6A _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
