Discussion
gods eMudhra are now trying to well actually the Google root programme team
our failure was not the only control that did not operate
uuuuh no, pretty sure it is your fault that the private key was 4
also trying to claim it is the Relying Parties (i.e. end-users) who are at fault for being vulnerable
good lord what a thread https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c43
@q
> A client that checks revocation only for the end-entity certificate, a common configuration, finds nothing to check.
why is this a common thing?
and if the crl fetch fails why is that just ignored?
@tthbaltazar@chaos.social @q@glauca.space when we did things like OCSP Must Staple in certificates, people would DDoS websites by DDoSing their CA's OCSP responder
@tthbaltazar@chaos.social @q@glauca.space We're slowly pushing things down to (a) revocations are delivered centrally and (b) certificates are short lived enough it becomes tractable to have a local cache of every relevant revocation
Install Fedizen
Get the full app experience
![210561 ✨ [Q]](https://mastodon-data.content.as207960.net/accounts/avatars/108/220/736/453/606/716/original/c8b2ed3c5237c336.jpg "210561 ✨ [Q]")
oh its gets better, they try to place the blame on clients for not checking revocation whilst actively blocking certain User-Agents from getting the CRL
fucking amateur hour over there