On 11/07/2019 03:38, Matthew Hardeman wrote:
I used
the parallel to racism in finance because it's exceedingly well documented
that strong objective systems of risk management and decisioning led to
better overall financial outcomes AND significantly opened the door to
credit (aka trust) to otherwise improperly maligned and underserved
communities.
(for the avoidance of doubt: writing in a personal capacity - although I
work for Mozilla I have nothing to do with this decision.)
Financial credit really isn't "aka trust".
The "strong objective system of risk management and decisioning"
includes the ability to risk manage (e.g. in determining the amount of
credit, the interest rate, including a guarantor, including a security,
requiring certain types of insurance so the creditor doesn't lose out if
the debtor dies, ...), and there's no way for a trust store to "risk
manage" a CA in any of those ways. Mozilla can't limit issuance to a
certain number of certificates, or a certain set of domains, or set
financial penalties for misissuance, or ...
Additionally, the repayments to credit once an agreement is struck
provide complete information about current performance of the debtor,
which there isn't in the CA world. And should repayments stop, the
lender normally has some means of recuperating losses (whether that's
through the object which secured the loan, through the guarantor, or the
court/bailiff system), and the only people affected are the lender and
the debtor (and guarantor, if any). None of that is true for a trust
store, either, where the people affected by a "default" are the relying
parties.
If we're going to make a comparison to finance, this is more akin to
Mozilla being asked to sign up as guarantor for every CA, in a huge loan
that's being extended by all the users of their trust store. Any
financial adviser worth their salt will tell you never to be a guarantor
for anybody unless you're very, very sure of that person, because you
have effectively no recourse if the debtor leaves you holding the bag.
~ Gijs
_______________________________________________
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy
