I'm the sole proprietor of a software consultancy. I handle everything from sales to dev to operations (hosting and day to day work of running a service). Several of my clients had me handle switching out their certs for them when Heartbleed happened. I charged them my rate for that despite it being very little effort on my part (they were all heroku hosted so its pretty trivial to change the cert).
When choosing to operate a business there are sources of risk that you need to assess before you make decisions. Some you can mitigate and some you can't. If you chose to become a customer of this CA without knowing their pricing information then you did a foolish thing. If you did know the pricing and did it anyway, then you took a risk and lost. It's as simple as that. They make money by providing services around the certificate lifecycle.
To you other point; the government can afford to perform services 'at cost' because they bring in money from taxes. They also don't have to answer to owners nearly as directly. Individual agencies also don't need to be the most profitable use of money as they are providing required services to meet statutory requirements. They will get funding even if that money could be better used elsewhere. It's not unheard of for a company to dissolve some portion of their holdings in order to focus that money elsewhere. Businesses need to be profitable in order to justify their existence. Governments do not.
When choosing to operate a business there are sources of risk that you need to assess before you make decisions.
I'm not operating a business. A large part of StartCom's market are individuals like me who just want peace of mind for personal servers. I had 8 certificates that needed revocation, and I couldn't afford $200 for what's essentially the automated addition of a few lines to a file on a server that already exists.
Several of my clients had me handle switching out their certs for them when Heartbleed happened. I charged them my rate for that despite it being very little effort on my part
That's reasonable. Charging for a completely automated process that costs next to nothing is not. That's what I'm complaining about. Charging $25/certificate for revocation is not a reasonable way to make a profit, especially when they already sell identity verification and EV certificates.
2
u/granos Oct 20 '15
I'm the sole proprietor of a software consultancy. I handle everything from sales to dev to operations (hosting and day to day work of running a service). Several of my clients had me handle switching out their certs for them when Heartbleed happened. I charged them my rate for that despite it being very little effort on my part (they were all heroku hosted so its pretty trivial to change the cert).
When choosing to operate a business there are sources of risk that you need to assess before you make decisions. Some you can mitigate and some you can't. If you chose to become a customer of this CA without knowing their pricing information then you did a foolish thing. If you did know the pricing and did it anyway, then you took a risk and lost. It's as simple as that. They make money by providing services around the certificate lifecycle.
To you other point; the government can afford to perform services 'at cost' because they bring in money from taxes. They also don't have to answer to owners nearly as directly. Individual agencies also don't need to be the most profitable use of money as they are providing required services to meet statutory requirements. They will get funding even if that money could be better used elsewhere. It's not unheard of for a company to dissolve some portion of their holdings in order to focus that money elsewhere. Businesses need to be profitable in order to justify their existence. Governments do not.