Hacker News Reader

Comment by wolvoleo | Hacker News Reader

No it does not. How does social media upheaval make internal analysis impossible?

I was involved in the an incident like this, and the intense pressure for public immediate action led to the (firing or resignation) of multiple people who were actually needed for the investigation.

Something that could have been fully analyzed with those people in a couple weeks ending up taking two years with an independent outside auditor.

The independent auditor would have been needed either way, but if we gave the original crew the opportunity to respond, THEN fired them, the outside auditor could have just verified the story much more quickly.

> the intense pressure for public immediate action led to the (firing or resignation) of multiple people who were actually needed for the investigation.

That just sounds like a management failure. You don’t actually have to cave.

Exactly. Besides that, firing people on the spot solves nothing and only makes it harder to recover.

The only reason there would be to fire people immediately would be if it would have been done deliberately with malicious intent but in this case there is no evidence of that.

People fired on the spot can't point out risks that were told to management and ignored.

Scape goats work better when they can't defend themselves.

You where involved in the biggest fuckup by orders of magnitude your whole industry ever did in it's existance? I'm interested to hear the story.

C'mon now, this isn't even the biggest IT disaster this week.

Im talking about the CA industry. Maybe industry is the wrong word?

StartCom, Symantec, CNNIC, and DigiNotar were bigger. Or do you only count pure incompetence as ‘fuckup’?

They weren't really bigger. Anyone can compromise eMudhra's certs. DigiNotar was hacked by a state-sponsored actor (Iran) and they created a few malicious certs.

The trust was gone and it's good that they closed up shop, don't get me wrong. But it's not like anyone who knows IT could create certificates in their name, in this case the impact is really a lot bigger. Especially to the world as a whole, the DigiNotar issue mainly affected users in Iran.

because they are more interested in saving the image on social media than doing the right thing.

Which is their job. The "right thing" if that is to shut down the CA will be managed by the CAB, there is no need for eMudhra to shut themselves down when that will be done for them. The "right thing" for eMudhra is to fight to continue to exist, even when that is not a likely outcome. It's like prosecutor vs defense in a trial, the defense is expected to explain why they are not guilty, even if they know they are guilty.

Reply on news.ycombinator.com