Discuss mailing list

[Julian DeMarchi <julian AT jdcomputers.com.au>]

On 05/31/2012 09:10 AM, Jamyn Shanley wrote:
> On Wed, May 30, 2012 at 5:52 PM, Julian DeMarchi
> <julian AT jdcomputers.com.au> wrote:
>> cacert _is_ getting their CA into browsers very soon, unlike Open
> 
> Define "very soon"? My understanding is that they are a long way off
> from acceptance in Firefox and other browsers, possibly years.

http://en.wikipedia.org/wiki/CAcert.org#Inclusion_status

You are correct. But the CA is included in most linux OSes.

>> It _is_ perfectly acceptable for a registra to use a cacert.
> 
> So you are formally saying that SSL warnings in most modern browsers
> is acceptable policy for an OpenNIC registrar?

Indeed I am when they are using a cacert.

>> I run a few OSS sites which all use cacerts.
> 
> These are registrar/tld sites, not just "any" site. I would think the
> goal is to garner trust with the user and reassure them that things
> are all working normally, that there are no errors or problems with
> the network, etc. I'm not even trying to debate whether or not "paid"
> SSL certificates are a ripoff. Sure they are. We all know that. But
> the question is whether or not OpenNIC is fine with their core
> infrastructure generating errors to the average user. Based on that
> response, the answer is yes?

Go to rapidSSL and get me a cert for reg.for.free. I bet they laugh. We
are an alternative DNS, we should be throughing our support behind
cacert. In the end I'm going to setup an OpenNIC CA for registra's, and
have this info on the new site.

--julian