Comments on: ipsCA and Mozilla fail http://blog.ecorrado.us/2010/01/05/ipsca-and-mozilla-fail/ Ramblings about library technology, open source software, and other adventures! Fri, 28 Oct 2011 05:59:02 +0000 hourly 1 http://wordpress.org/?v=3.3 By: AdC http://blog.ecorrado.us/2010/01/05/ipsca-and-mozilla-fail/comment-page-1/#comment-41181 AdC Sun, 17 Jan 2010 07:29:53 +0000 http://blog.ecorrado.us/?p=807#comment-41181 ecorrado... even if Mozilla did get the cert immediately into the latest firefox, there are still major problems caused by ipsCA. IE8 + latest mozilla only account for a small amount of users of these certs. Our web logs show 30% of IE users are still on IE6. How long would it take for someone to update their mozilla also? Basically ipsCA acted as if it would be no problem to get a cert on every desktop on the planet in a couple months. Incredible. They needed to start a couple years ago, get the cert into windows first (root cert updates, which btw aren't deemed critical updates), or into a windows service pack (e.g. XP SP3 etc). they also needed to get it into every major piece of software that ships a bunch of root certs, such as mozilla, chrome, a bunch of java distrs etc etc etc. So the fact they only generated that cert a couple months before d-day, just really shows what turkeys they are. I'm with Mozilla on this one, it doesn't engender a sense of trust. ecorrado…

even if Mozilla did get the cert immediately into the latest firefox, there are still major problems caused by ipsCA.

IE8 + latest mozilla only account for a small amount of users of these certs. Our web logs show 30% of IE users are still on IE6. How long would it take for someone to update their mozilla also?

Basically ipsCA acted as if it would be no problem to get a cert on every desktop on the planet in a couple months. Incredible.

They needed to start a couple years ago, get the cert into windows first (root cert updates, which btw aren’t deemed critical updates), or into a windows service pack (e.g. XP SP3 etc). they also needed to get it into every major piece of software that ships a bunch of root certs, such as mozilla, chrome, a bunch of java distrs etc etc etc.

So the fact they only generated that cert a couple months before d-day, just really shows what turkeys they are. I’m with Mozilla on this one, it doesn’t engender a sense of trust.

]]> By: ecorrado http://blog.ecorrado.us/2010/01/05/ipsca-and-mozilla-fail/comment-page-1/#comment-40794 ecorrado Wed, 06 Jan 2010 18:28:33 +0000 http://blog.ecorrado.us/?p=807#comment-40794 AdC: I don't think ipsCA isn't at fault, but what reasonable explanation is there for a ~14 month long process? I don't see absolutely any. Yes, people are jumping ship (as I have at my place of work), but they are jumping because of Mozilla's unreasonable time-frame. As Mike Volk pointed out even a 14 day timeframe is not really reasonable (although I'm okay with some time to get into a security update). It seems to me that Mozilla is saying it's my ball and if you don't like it I'm taking it with me and going home. This is the antithesis of what Open Source should be about in my opinion, and because of this attitude I am contemplating changing my default browser to Google Chrome. I'm not a really a huge fan of Google, but I am quickly becoming not a fan of Mozilla as well. Any allegiance I may have had is waining fast. AdC: I don’t think ipsCA isn’t at fault, but what reasonable explanation is there for a ~14 month long process? I don’t see absolutely any. Yes, people are jumping ship (as I have at my place of work), but they are jumping because of Mozilla’s unreasonable time-frame. As Mike Volk pointed out even a 14 day timeframe is not really reasonable (although I’m okay with some time to get into a security update).

It seems to me that Mozilla is saying it’s my ball and if you don’t like it I’m taking it with me and going home. This is the antithesis of what Open Source should be about in my opinion, and because of this attitude I am contemplating changing my default browser to Google Chrome. I’m not a really a huge fan of Google, but I am quickly becoming not a fan of Mozilla as well. Any allegiance I may have had is waining fast.

]]> By: AdC http://blog.ecorrado.us/2010/01/05/ipsca-and-mozilla-fail/comment-page-1/#comment-40790 AdC Wed, 06 Jan 2010 16:11:21 +0000 http://blog.ecorrado.us/?p=807#comment-40790 As I understand it, there are other reasons Mozilla has problems with ipsCA, such as issuing certs with embedded nulls, non-compliant OPCSA servers, and issuing certs that expire after the root etc. This root expiry therefore compounded the issue. I reminded ipsCA their root would expire last Jan in a support ticket (query about what would happen to my certs). They have known about the issue since the cert was generated 11 years ago. Why did they wait til the last minute to generate a new root (sep 09)???? It's commercial suicide. I don't expect to see them round much longer. Do a search, see how many customers are jumping ship. As I understand it, there are other reasons Mozilla has problems with ipsCA, such as issuing certs with embedded nulls, non-compliant OPCSA servers, and issuing certs that expire after the root etc.

This root expiry therefore compounded the issue.

I reminded ipsCA their root would expire last Jan in a support ticket (query about what would happen to my certs). They have known about the issue since the cert was generated 11 years ago. Why did they wait til the last minute to generate a new root (sep 09)????

It’s commercial suicide. I don’t expect to see them round much longer. Do a search, see how many customers are jumping ship.

]]> By: Mike Volk http://blog.ecorrado.us/2010/01/05/ipsca-and-mozilla-fail/comment-page-1/#comment-40763 Mike Volk Wed, 06 Jan 2010 01:06:56 +0000 http://blog.ecorrado.us/?p=807#comment-40763 This is a real screw up on Mozilla's part. When Verisign can renew certs with a pair of phone calls to a client there is NO REASON that a RENEWAL even at a ROOT level should be such an issue. This is really a simply replacement of a file from a source that you supposedly already trusted. 14 days would be too long. At most this is a 24-48 hour process. This is a real screw up on Mozilla’s part. When Verisign can renew certs with a pair of phone calls to a client there is NO REASON that a RENEWAL even at a ROOT level should be such an issue. This is really a simply replacement of a file from a source that you supposedly already trusted.
14 days would be too long.
At most this is a 24-48 hour process.

]]>