See also "Chromodo", the Chrome fork by Comodo that introduces such incredible security features as turning off the same-origin policy, completely breaking the Internet security model.

While its fair to say that some CA's are not scum, so many of them have done shady things, and they are basically rent seekers for a product that they spend little on to verify things like identity etc.

Most certs are just money printing machines for the orgs in charge of them and I am not surprised they would want to fight back against LE.

Indeed. Their PCI-DSS compliance scanning service is completely useless. Service version fingerprinting only, regardless of binary patch level or actual vulns.

Yet somehow, the PCI SSC accepts their scan results as actionable for Level 1-3 compliance.

> Tarring all CAs with that brush strikes me as unduly harsh.

While I'm sure there are CAs who aren't as egregiously bad as Comodo, it's hard to get around the fact that they basically shouldn't exist as a class, and any CA that isn't working to put itself out of business is sort of hurting the Internet ecosystem.