> Playing a tape never changes the file. The player remembers your place separately, the way a real tape stays wound where you left it.

Um, I remember tapes and players working differently.

For example, playing a tape changed the tape's state. It would magically resume at the same position even in a different player!

That quoted part seems comically contradictory

> as if an actual state of war exists

"as if"

And there is a simple solution: stay off the internet and keep yourself to your national network. There is nobody stopping people from that.

> You're right, some of the questions are fairly straightforward and should be easy to answer -- I would argue they already did provide an initial response here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

The comment you link to is from 19th. How could that provide an initial response to a mail send to them on the 20th? That does not make sense unless they have a time machine.

> But there's 12 separate questions in this comment alone https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30 many of which are demanding detailed information and statistics that would need to be reconstructed from audit logs.

But that is not the set of questions that were ignored for the deadline.

> I imagine lawyers are involved because whatever answers they give will inevitably wind up as evidence in ensuing lawsuits. I'm sure anything publicly released needs to be cleared through several layers of review.

If they want to lawyer up, they should better be removed from trust stores where trust is more important than admitting the absolute minimal amount possible to lawyer up for lawsuits.

Or they could try to regain some trust, but it looks like they don't want that as a closer look might find more issues, like the other post about their broken login process.

> Or they could try to regain some trust

Why? They've already announced they're quitting the CA business. I assume their priority is avoiding getting sued into bankruptcy. Playing along with Google/Mozilla's star chamber can only harm them.

I'm lowkey impressed they've even said "we also signed up for disclosure obligations to the community which we will uphold" because it's all downside risk with zero benefit for their company.

> even ones it has no right signing

They have that right though? There is no monopoly to single CAs for a given domain.

Why should podunk CAs be trusted by default to sign google.com when that's not their intended purpose?

Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.

Right but there are probably 100-1000 important domains and a long tail of less important ones

Yes, US customers can rely on the US postal services to deliver US mail.

No need to use international services like the internet.

> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum.

No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.

If you use the internet, yes.

If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.

> He could have just made sure his customers got an emergency patch quietly.

I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an uncontrollably large group of unvetted people is worse.

> but it clearly prioritized Chainguard customers over the broader ecosystem.

I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates after the embargo was lifted and Chainguard noticed.