On 11/07/2019 03:38, Matthew Hardeman wrote:
I used
the parallel to racism in finance because it's exceedingly well documented
that strong objective systems of risk management and decisioning led to
better overall financial outcomes AND significantly opened the door to
credit (aka trust) to otherwise improperly maligned and underserved

(for the avoidance of doubt: writing in a personal capacity - although I work for Mozilla I have nothing to do with this decision.)

Financial credit really isn't "aka trust".

The "strong objective system of risk management and decisioning" includes the ability to risk manage (e.g. in determining the amount of credit, the interest rate, including a guarantor, including a security, requiring certain types of insurance so the creditor doesn't lose out if the debtor dies, ...), and there's no way for a trust store to "risk manage" a CA in any of those ways. Mozilla can't limit issuance to a certain number of certificates, or a certain set of domains, or set financial penalties for misissuance, or ...

Additionally, the repayments to credit once an agreement is struck provide complete information about current performance of the debtor, which there isn't in the CA world. And should repayments stop, the lender normally has some means of recuperating losses (whether that's through the object which secured the loan, through the guarantor, or the court/bailiff system), and the only people affected are the lender and the debtor (and guarantor, if any). None of that is true for a trust store, either, where the people affected by a "default" are the relying parties.

If we're going to make a comparison to finance, this is more akin to Mozilla being asked to sign up as guarantor for every CA, in a huge loan that's being extended by all the users of their trust store. Any financial adviser worth their salt will tell you never to be a guarantor for anybody unless you're very, very sure of that person, because you have effectively no recourse if the debtor leaves you holding the bag.

~ Gijs
dev-security-policy mailing list

Reply via email to