throwaway7356

> as if an actual state of war exists

"as if"

Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.

And there is a simple solution: stay off the internet and keep yourself to your national network. There is nobody stopping people from that.

> even ones it has no right signing

They have that right though? There is no monopoly to single CAs for a given domain.

Yes, US customers can rely on the US postal services to deliver US mail.

No need to use international services like the internet.

> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum.

No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.

If you use the internet, yes.

If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.

> He could have just made sure his customers got an emergency patch quietly.

I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an uncontrollably large group of unvetted people is worse.

> but it clearly prioritized Chainguard customers over the broader ecosystem.

I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates after the embargo was lifted and Chainguard noticed.

> The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy.

You already need compromised systems to install malware, signed or not. Not a real problem.

For TLS MitM you just need to use a shared network, wired or wireless.

> US models have it in the clouds.

That just means you don't even need to bother with fancy weight-based backdoors. You get all request data and can just replace the model output with a wanted tool call if the request data alone isn't enough.

> Traditionally, sharing an address space carried the GPL taint.

Clearly two different files don't share the same address space. So no problem.

Usually a human life is worth less. You can just look at court cases.

You can also check how much individual limbs are worth if you care. There are tables for that.

> These are companies that use hundreds of thousands of stolen credit cards to sign up for fake accounts.

You claim VISA and other credit card companies don't mind if merchants like DeepSeek steal hundreds of thousands of credit cards and use them? And still continue to give them merchant accounts to continue with that?

Isn't it more likely that some people are scaremongering?