Hacker News Reader

Comment by Vaushite | Hacker News Reader

No, it's not limited to strongly worded posts. The external consequences are usually immediate bankruptcy of the CA after the investigation concludes. An untrusted CA has absolutely no business model whatsoever, and may have to refund its former customers.

View on HN

> The external consequences are usually immediate bankruptcy of the CA after the investigation concludes.

It would seem that we have different definitions of "wind-down". Everyone in the business operated with this consequence already on the table and it did not seem to provide the desired outcome.

So you want jail time for people whose certificates get revoked? Or what else could there possibly be? Deterrence doesn't actually prevent mistakes and accidents, that's why bridges still collapse even with the consequences you described on the table. And I haven't seen it on HN yet, but Dread, the front page of the dark web, covering many illegal topics, where the potential consequence of a private key leak is death, leaked their private key.

And whose jail? Is India going to allow extradition to the US for this? I doubt it. The company has strong ties to the government and provides services to the BJP’s pet Aadhaar system as well as the military. Unless their failures harm the government extensively, I don’t think you will see any accountability.

Like it or not, CA infrastructure is global, and there’s no single set of laws that can or should govern it.

Reply on news.ycombinator.com