Hacker News Reader

Thank you, though the Qihoo relationship is not what I was referring to.

I actually meant executing two votes in the CA/B Forum. As the connection between WoSign and StartCom was only incidentally found while investigating the other issues, I am questioning if there may be more dark sheep in the herd of CAs... we may just haven't looked hard enough. Do the Audit Requirements include checking for such relationships?

View on HN

That's in all likelihood the same issue - Qihoo de facto owning two CAs who currently cast two separate votes in the CA/B Forum. Not sure if it would be a concern otherwise (i.e. if Qihoo were to own just one CA and not disclose that fact, I don't think that's relevant for the CA/B Forum, leaving aside the problem that they're also a member as a browser vendor ...)

I think the voting rules are part of the bylaws (and not the Baseline Requirements), so I'm not certain if that's something that's looked into during the audits.

Reply on news.ycombinator.com