Hacker News Reader

While most of the doc focused on StartCom/WoSign, I thought this bit at the end was interesting:

> no longer accept audits carried out by Ernst & Young (Hong Kong).

To reject audits from E&Y.... It makes me wonder about the transparency and trust we put in the auditors as being a key part of CA validation process.

View on HN

Auditors and ratings agencies and their ilk are a fundamentally broken service in our society. On the one hand they have to make money and on the other they have to be honest. The two are simply not compatible, seemingly. Eg: ratings agencies happily giving top tier ratings to mortgages back in pre 2008.

Completely Agree!

When you think down this path, its why Certificate Transparency Logs make even more sense -- Yes, its still ideal that a CA operates in a "good" way, but using the Cert Logs you know everything they have signed, so a rouge actor has a limited ability to sign something they shouldn't, and as seen by Mozilla's document, they used the Cert Transparency logs as part of their evidence.

Reply on news.ycombinator.com