Hacker News Reader

Comment by solatic | Hacker News Reader

I can't believe sibling commenters. As a citizen of country X, it should be easy to sympathize with the desire to only do business with other citizens of country X or businesses registered in country X. Why? Because if they wrong me in some way, then I can sue them in a court of law in country X.

All cross-border business is fundamentally import/export and comes with the same risk - that when I am wronged by someone in another country, I have no legal recourse. The exceptions to this rule (like airlines) are such enormous exceptions that there are literally international treaties (e.g. Montreal Convention) to enable it.

Nothing fundamentally US-centric about that point of view.

View on HN

You can want a nationalist Internet trust model, and 2027 is an extremely good year to build it, because the major browsers are all malleable.

What you cannot reasonably expect is for the entire Internet to operate on a "these countries good, these countries bad" model, for many reasons, including that the citizens of your preferred countries are wildly outnumbered.

This is a US website with a Let's Encrypt certificate.

Anyone who is not in the US saying, on here, "I do not need CAs that are not my national ones" would realize the problem before even posting.

I'm personally happy to assume the risk of trusting Let's Encrypt in spite of the lack of legal recourse.

Trying to equivocate between Let's Encrypt and eMudhra is crazy, as is trying to argue that they should both be trusted globally by default by everybody. I trust LE because of their track record. I had never heard of eMudhra before this.

The argument is not about who you, personally, are willing to trust. Nor about two specific CAs. It is about the fact that Let's Encrypt, which is US based, is an obvious necessity. As such, anyone not in the US should realize that they need to trust CAs that are outside of their national borders.

> anyone not in the US should realize that they need to trust CAs that are outside of their national borders

You say this, in 2026, when the EU is trying to move to an EU Sovereign Cloud Framework: https://commission.europa.eu/news-and-media/news/sovereign-c...

I have a deep problem with your usage of the word "need". EU citizens can make a free choice (or not) to trust US-based certificate authorities, and US citizens can make a free choice (or not) to trust EU-based certificate authorities. There are certainly many reasons why that should be the case. But in a world where we need to negotiate whether food safety standards in X economic block are sufficient for Y's citizens and vice versa, and this is literally the stuff of trade deals, the idea that US-based certificate authorities should be universally trusted because of little more than historical legacy is not the policy position of people who believe in free markets and free choices.

I think you're both talking past each other. You have a colorably legitimate preference, to (at least by default) trust only security anchors within a limited set of jurisdictions. Fair enough! I think it's clear why that kind of preference can't be a global default for the whole Internet, but you can have it right now just by copying this comment thread into Claude and saying "make my browser work this way". It's buried configuration in all the browsers, but it's configuration. You won't even have to build software.

And there is a simple solution: stay off the internet and keep yourself to your national network. There is nobody stopping people from that.

Reply on news.ycombinator.com