rpcastagna

I dunno, if you look at the legacy of DigiNotar it seems like you're dealing with a lot of potential headaches for a couple thousand bucks that your customers hate paying you anyway.

(DigiNotar, of course, famously gave out a fraudulent * .google.com cert and is now defunct.)

As a CA you're assuming a whole lot of liability for not that much money (not that much at the scale of even a small business, anyway), and that just doesn't seem like it'd scale to a wildly profitable venture, especially considering the kinds of people who are actually well equipped to run a CA can probably make a lot more money doing basically anything else in web security. When you add up the contingency risks, the opportunity costs, and whatever actual day-to-day business expenses, it does seem like you'd be looking for other ways to make more comfortable profits.

That doesn't mean CAs should charge more or anything, just that I could accept that SSL certs for standard websites isn't what anyone with a good vision for their business is really trying to hold onto.

It's important to realize this post doesn't make any assertions about the fundamental merits of people who are rejected by Google.

(I'm a software engineer on Google Drive.)

The answer is no. To the point where it's actually a pain in the ass for us because developing any ML-assisted capabilities for G Suite requires us to only get training data from specific subsets of customers who are under special contract conditions.

If you buy G Suite from a reseller then they might be doing shady shit but we'd terminate their reseller account if we found out about it.

I know people like to bitch about this kinda shit on HN but honestly I and my coworkers spend so much time on protecting our customers' data from literally everyone -- including ourselves -- that I want the chance to bitch back about how hard my job is.

If it makes you feel better:

Hospitals of reasonable size typically have an on-site clinical engineering team that handles those kinds of situations. Important (that is, capital expense category) hospital equipment will typically emit all kinds of warnings and alarms way before anything's actually a problem, because everyone would rather rely on the on-site engineering spending a little extra time silencing false positives then leave anything to chance.

It's weird to me you would treat this state of affairs as a static and universally-holding position. I think it's obvious (with several current examples coming to mind) that investors and business partners can be branded as "toxic" in a way that overwhelmingly devalues any money they could actually offer. In the same way the police will take a stolen watch from you after you buy it -- without much recourse on your part! -- you and your company can definitely be torpedoed by taking bad money if public opinion shifts that sharply.

These are the risks of working at the national and global scale; they have to be there, otherwise the rewards couldn't (sustainably) be so great. Even ignoring the moral arguments, the fact that anybody is making them changes the game theory perspective as well. The only way to truly stay on top is to make sure most people want you there.

These experiences also exacerbate the perception that I referred to before that can basically be summarized as "every previous attempt at making this better ended up being completely terrible". A whole slew of people want to improve things, but a lot of the time they don't take that responsibility seriously enough -- or know, fully, what that entails -- and when they bail that leaves the next would-be "disruptor" at a disadvantage.

Healthcare industry insiders joke:

Any theory of the current state of medicine that involves a cardio-thoracic surgeon feeling like they are not completely irreplaceable, one-in-a-trillion geniuses/minor deities, put here on this planet to spare us lesser mortals (as scheduling allows) seems... improbable.