[zokier]

> with hints[2] that Chrome would end up enforcing something similar itself even if it wasn't part of the Baseline Requirements

Kinda undermines the idea of having a standards group if Google is going to strongarm the industry by doing their own thing anyways

[dragonwriter]

"Baseline Requirements" sort of implies that what is specified is minimum, rather than exhaustive, rules, and that specific applications will have additional rules.

[tialaramex]

And they all do.

Mozilla's rules are public so you can go read them, and indeed you can help write them. But most famously they required all CAs to disclose loads of stuff, and they require CAs to do lots of stuff in public where everybody can see it, not behind closed doors where we don't know what they're up to.

Google's rules include lots of stuff about their Certificate Transparency idea, which has helped no end.

Microsoft's rules famously include them getting a veto where they can order any CA to revoke a certificate or else leave their trust programme. They mostly use this to zap malware / phishing sites.

Apple's rules forbid having lots of roots at once. Although apparently this didn't apply to Symantec, or various other people. Huh.

[ctz]

The standards group in question is unfortunately impotent. Two totally reliable voting blocs: the browsers and the CAs. There are more CAs than browsers, so the result of every vote is in the favour of the CAs.

[schoen]

As was noted above, they have a constituency representation system so ballots have to pass with support from both constituencies, rather than an absolute majority of members.

[eli]

You wouldn't want a standards group that somehow mandates all clients must accept all valid certs, right?

[kibwen]

> Kinda undermines the idea of having a standards group if Google is going to strongarm the industry by doing their own thing anyways

In any industry where a single actor has a clear majority of the market share, you either vote with your feet (and implore all your friends to do so as well) to bring the powers back into equilibrium, or you cross your fingers and pray that Goliath is (and remains) benevolent.

[762236]

I expect the browser to look out for my interests as the user. How could the browser do that if it lets the CAs set the terms in the CAs' favor?