When an engineer (or engineering firm) found that it caused a bridge collapse due to negligence, they are taken accountable, sometimes even prison times if harm or death happened. We rarely see the same in tech world for some reason, there’s still this green pass and the idea that tech are auxiliary and all its mistakes are just reset a password. That company should be accountable, the damage is far from over as these certs that made by stupid people could be anywhere from IoT to critical infrastructure.

▲

iamnothere 3 hours ago | parent | next [-]

If you want formal engineering outcomes, you need formal engineering standards. But in the same way that redoing a home bathroom doesn’t require the same multimillion dollar process as building a bridge, not all software projects can fall under the same umbrella. Any scheme like this has to take into account where certification is actually needed and what the goals and costs are.

And guess what: this already exists. DO-178C for aviation, ISO 26262 for automotive, IEC 62304 for medical, etc. But these standards are specialized to the industry because, no surprise, there is no appropriate one-size-fits-all software development approach. You can’t just say “software must be bug-free” and leave it at that. That’s been shown to be impossible. Even formally verified software can have spec bugs.

There’s already formal standards that CAs must meet, and they get audited too. Maybe those standards aren’t rigorous enough. But even with those standards, what authority is going to punish a CA who breaks them, other than browser/OS vendors? If it damages the host nation, you might see something. But if the host nation is complicit, and used the rogue CA for intel purposes—or if the company has political connections—then I don’t think you’re getting the punishment you want.

It makes sense to have these heavy standards when you’re talking about software whose failure could immediately cost actual lives. I’m hesitant to expand it elsewhere as it could threaten the viability of open source and software freedom in general. Nobody should ever need a license to run a compiler or deploy an application to their own server.

▲

AlotOfReading 2 hours ago | parent [-]

26262 is a process standard (a voluntary one at that), not a software standard. It barely even talks about software outside a couple specialized sections. You can also think of the CA program as a process standard that comes with active enforcement.

▲

iamnothere 2 hours ago | parent [-]

The process of developing software has an impact on the outcome, especially if the software is tied in with physical systems. If you’re looking for software that meets specific criteria, built to an engineering standard, you need a formal process around it.

Also, a purely software-focused standard doesn’t make sense for CAs, as they also operate and maintain infrastructure. The failure with this CA was a process failure.

I probably emphasized software too much in my reply, but that’s usually where I see people call for standards to be forced on the “tech” industry.

	▲	AlotOfReading 2 hours ago \| parent [-]
		Sure, not going to disagree that processes affect outcomes. As someone who lives with standards-following-practices every day though, I always have to caution people that following the process is often a vastly different thing than improving the outcome. For example, (most) certified compilers are great from a process perspective, and awful if your goal is less buggy software. My opinion is that all the process in the world won't help if the people doing it don't care about the outcomes.

▲

bob1029 3 hours ago | parent | prev | next [-]

Accountability is rarely something that a person or organization will spontaneously adopt of their own free will. It generally has to be forced from the outside by way of additional consequences.

Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. I would hesitate to call the wind-down of a business unit a "consequence" in this context because it's the default outcome. Everyone was already playing that game. We need an additional layer of pressure to encourage good behavior.

▲

Vaushite 3 hours ago | parent | next [-]

No, it's not limited to strongly worded posts. The external consequences are usually immediate bankruptcy of the CA after the investigation concludes. An untrusted CA has absolutely no business model whatsoever, and may have to refund its former customers.

▲

bob1029 3 hours ago | parent [-]

> The external consequences are usually immediate bankruptcy of the CA after the investigation concludes.

It would seem that we have different definitions of "wind-down". Everyone in the business operated with this consequence already on the table and it did not seem to provide the desired outcome.

▲

Vaushite 3 hours ago | parent [-]

So you want jail time for people whose certificates get revoked? Or what else could there possibly be? Deterrence doesn't actually prevent mistakes and accidents, that's why bridges still collapse even with the consequences you described on the table. And I haven't seen it on HN yet, but Dread, the front page of the dark web, covering many illegal topics, where the potential consequence of a private key leak is death, leaked their private key.

	▲	iamnothere 3 hours ago \| parent [-]
		And whose jail? Is India going to allow extradition to the US for this? I doubt it. The company has strong ties to the government and provides services to the BJP’s pet Aadhaar system as well as the military. Unless their failures harm the government extensively, I don’t think you will see any accountability. Like it or not, CA infrastructure is global, and there’s no single set of laws that can or should govern it.

▲

throwaway7356 3 hours ago | parent | prev [-]

> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum.

No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.

▲

Vaushite 3 hours ago | parent | prev | next [-]

That's because a bridge didn't collapse.

▲

ktm5j 3 hours ago | parent [-]

We don't know that. No one knows what's potentially happened out in the wild because of these faulty certificates.

▲

Vaushite 2 hours ago | parent [-]

No one knows what's potentially happened out in the wild because of this comment you wrote. Imagine how crazy the world would be if people got punished based on fantasies.

▲

ktm5j 2 hours ago | parent [-]

If you think people are getting worked up because of fantasies then it's clear that you don't understand how big a deal this is. Even if no bad actors figured out that the entire SSL trust system was trivial to compromise during the year that these certs were valid.. it's going to be years before all client systems on the internet have their OS certificate trusts updated.

Sure browsers are safe, but countless other internet softwares aren't (curl, python, pip just to name a few I know off the top of my head). Pip has a big problem because even if the OS distrusts the eMudhra certs, it still does because it has its own trust store. This will be an attack vector (that now everyone knows about) for a while.

▲

Vaushite 2 hours ago | parent [-]

It's going to be great for right to repair.

▲

ktm5j 2 hours ago | parent | next [-]

This isn't something that let's you break into your own operating system.. It's only useful to trick someone into running malicious code. What it will be great for is supply line attacks.

▲

Vaushite an hour ago | parent [-]

It lets you MITM any TLS connection to a device that doesn't support certificate revision

	▲	ktm5j an hour ago \| parent [-]
		Okay fair point, but if you think that's a net-win then you are dreaming.

▲

ktm5j an hour ago | parent | prev [-]

You're one of those eMudhra people wasting time on social media trying to save face instead of responding to Mozilla, aren't you?

▲

ForHackernews 3 hours ago | parent | prev | next [-]

No one at OpenAI, Anthropic or Google will be held accountable for their various felony bots[0], Facebook encouraged an actual genocide[1], but HN commenters are baying for blood of some random Indian contracting firm that royally goofed up their SSL certs.

[0] https://www.felonybench.com/

[1] https://www.amnesty.org/en/latest/news/2022/09/myanmar-faceb...

▲

CreepyHunterX 3 hours ago | parent | prev [-]

[dead]