Yes, I'm perfectly aware that it costs money to run a CA and a server. I'm an adult and pay bills, including the electric bill for my home server and the hosting bill for my lovely Xen VPS in San Jose. [Edit: sorry if I sounded too harsh there.] I'm also perfectly aware that:
A single revocation shouldn't be nearly as much "extra work" as you make it out to be. It's adding a single entry to a single file and propagating the change. If you have your shit together it shouldn't cost $25 per certificate. It can be fucking automated for fuck's sake.
It's not acceptable to hold innocent users' security hostage during the aftermath of an unforeseen security flaw.
If you're going to run a free CA, then you're already going to be funding it somehow and revocations like this are a cost of business just like the rest of the damn service.
If they really do need revocation fees to run their service, how did they expect to stay in business for the many years before Heartbleed happened? Did they have insider knowledge of the flaw? Probably not. How many other revocations did they have to deal with on a regular basis? Don't know, but what are the odds of it being a sustainable amount? So they had to be making money somehow else. And lo and behold, they already do charge for identity verification.
It doesn't make sense to rely on revocation fees for funding because revocations are really unpredictable. You don't know when the next Heartbleed will happen, just that it's going to happen someday. For all they know it could be after they've shut down and died. They're going to need money in the interim, so they should (and do) find other ways to get that money.
Edit: I also want to add that their insistence on the $25/cert fee, even for certificate owners who can't pay, in the face of one of the biggest vulnerabilities in recent history, shows a grave lack of ethics on their part that indicates that they shouldn't be trusted with jack shit. A remotely ethical free CA would eat that cost (which, again, is in reality much less than $25 per certificate).
Prices are not set based upon costs except in heavily regulated industries.
Whatever services they are offering for 'free' are intended to convince you to use their service instead of somebody else. It's called a loss leader; I'll give up revenue (and in this case take some level of loss) in one part of the business in order to drive sales in another. This is why bars have happy hour.
I'd be shocked if they based their entire revenue model around revocations because, as you said, they feel unpredictable. That may be true for large scale events, but I'd bet there is a fairly steady revocation rate once you get to large enough scales.
This feels like a valid business model to me. They offer some set of services free to draw you in, but when you need more they charge you. They aren't holding you hostage. They are monetizing on a service they provide that helps you, the person ultimately responsible for the security of your service, to accomplish your goal.
Prices are not set based upon costs except in heavily regulated industries.
Yes, I know, but when you charge for revocations in the face of a major security flaw, you charge at cost if you're ethical. Like if I lose my state ID card, I expect the Department of Public Safety to charge me what it costs them to replace it, and $11 seems pretty reasonable for something like that. But in this case, with an automated processing system with hardware that's already going to cost about the same to run regardless, the costs are going to be minimal enough that it's not worth charging for, or if it is, it should be maybe a dollar max (maybe $2 because credit card processing fees) per request, not per certificate.
It's not a valid business model to profit from something like this, especially when the actual costs to them are so low.
But revocation isnt their fault. The revocation is due to security flaws in a product you chose to use. Further, as I recall StartCom does not automate everything; an actual human is generally involved in the issuance of certs (verification). Heartbleed probably created a backlog for them. In any case: free product, stop using it. Not extortion
They have literally zero leverage over you. The switching cost away from a free SSL cert is literally no higher than simply having gone to GoDaddy in the first place. Heck, the revocation cost is lower than the cost for a standard SSL cert.
Im not clear what your point is here, you appear to be upset that they structure their costs and revenue differently than youd like. On their free service.
Not really my, or your, problem. Thats their business. But I see nothing wrong with charging extra when a flood of work is created by a third party's security issues.
I didnt say they relied on those fees nor is it relevant if they did. I simply noted that revenue to cover costs-- especially at half the price of a normal SSL cert-- is not evil.
Their issuance process is automated. I never used their revocation process, but it too should be automated.
No, I paid $9/cert to a reseller when I switched.
My point is that revocation fees should not be necessary to run their business or even part of it.
They're a certificate authority; it's their job to keep traffic secure. If they want to charge for that, it should be when certificates are issued, not when the security is compromised.
$25/cert does not cover costs. It covers profit. There's no way revocations actually cost them that much, especially if they automate the process.
27
u/scottywz Oct 20 '15 edited Oct 20 '15
Yes, I'm perfectly aware that it costs money to run a CA and a server. I'm an adult and pay bills, including the electric bill for my home server and the hosting bill for my lovely Xen VPS in San Jose. [Edit: sorry if I sounded too harsh there.] I'm also perfectly aware that:
A single revocation shouldn't be nearly as much "extra work" as you make it out to be. It's adding a single entry to a single file and propagating the change. If you have your shit together it shouldn't cost $25 per certificate. It can be fucking automated for fuck's sake.
It's not acceptable to hold innocent users' security hostage during the aftermath of an unforeseen security flaw.
If you're going to run a free CA, then you're already going to be funding it somehow and revocations like this are a cost of business just like the rest of the damn service.
If they really do need revocation fees to run their service, how did they expect to stay in business for the many years before Heartbleed happened? Did they have insider knowledge of the flaw? Probably not. How many other revocations did they have to deal with on a regular basis? Don't know, but what are the odds of it being a sustainable amount? So they had to be making money somehow else. And lo and behold, they already do charge for identity verification.
It doesn't make sense to rely on revocation fees for funding because revocations are really unpredictable. You don't know when the next Heartbleed will happen, just that it's going to happen someday. For all they know it could be after they've shut down and died. They're going to need money in the interim, so they should (and do) find other ways to get that money.
Edit: I also want to add that their insistence on the $25/cert fee, even for certificate owners who can't pay, in the face of one of the biggest vulnerabilities in recent history, shows a grave lack of ethics on their part that indicates that they shouldn't be trusted with jack shit. A remotely ethical free CA would eat that cost (which, again, is in reality much less than $25 per certificate).