Many HSMs do not force you to use unique labels for keys. So it's somewhat understandable if a human mixed up some keys during a non-standard or deviated process. This doesn't explain how so many different keys were "generated" so poorly or why no one cared about mismatched signatures.
And the discussion mentioning wrap/unwrap testing kind of feeds directly into the fear that either:
1. These weak keys were created outside the HSM and then imported.
2. These weak keys were meant to be the wrap keys somehow. Like, if they hadn't paid for some of the wrap/unwrap features on one of their HSMs and so were using easy-for-humans keys to handle the wrap/unwrap operations so they could more easily move keys between HSMs.
baud147258 19 minutes ago [-]
> Like, if they hadn't paid for some of the wrap/unwrap features on one of their HSM
Also depending on the FIPS configuration of their HSM, some functionality like wrap/unwrap might not be available
tomrod 13 minutes ago [-]
Makes me wonder where the certs are with private keys 1-255 that weren't in these 8.
jwineinger 42 minutes ago [-]
Do I, as a US-based English speaking person, need to have CAs from India and other places trusted by default in my browsers/devices? My gut says no and it just represents unnecessary risk, but I'm also not fully aware of how interleaved cert issuers are with cross signing and such.
tptacek 40 minutes ago [-]
eMudhra is (was?) a global CA and had subsidiaries serving the US market. Your browser also doesn't have a nationalist configuration; the same browser serves people all over the world.
The problem isn't foreign companies; it's bad CAs.
seki285 30 minutes ago [-]
No, the problem is foreign companies. Foreign nations have interests and as a US citizen I want to only trust other US citizens with my security, so should any other citizen anywhere else e.g. India can rely on India.
bunderbunder 16 minutes ago [-]
As a US citizen, I don't love this mindset. The US has relatively lax rules around cybersecurity and consumer protection. Some other countries are even worse. Furthermore, I continue to participate in a relatively borderless global Internet. Unconditionally placing identity politics ahead of those realities is a strange and impractical choice for a great many people.
rpdillon 7 minutes ago [-]
There are good and bad operators everywhere. It's naive to think they follow along nationalistic lines.
> only trust other US citizens with my security
I'm not sure what you mean, but this doesn't seem to be a coherent concept.
petcat 2 minutes ago [-]
I think the point is that it's much easier to sue other US citizens than it is to sue some Indian company. The latter would require State Department involvement, whereas the former I could probably just do in my local court.
paaloeye 18 minutes ago [-]
Is it paranoia, stupidity, or ignorance? I really hope it's the last one.
Suggested Google prompt: “How does WebPKI work; explain to a US-citizen ONLY by an US-citizen".
mintplant 13 minutes ago [-]
I just had a horrifying vision of a world where we have to purchase separate certificates from local certificate authorities in each country where we want to make a website available. shudder
cvhc 19 minutes ago [-]
Millions of non-US citizens (foreign workers in the country and outsource workers) build American software. Too bad :doge:
whynotmaybe 19 minutes ago [-]
And what about when you, as a US citizen, are in India?
Vaushite 22 minutes ago [-]
So if you want to visit an Indian website, your browser should say "no! US websites only!"?
mathisfun123 14 minutes ago [-]
> as a US citizen I want to only trust other US citizens with my security
man fox news has really done a number on people's brains.....
paaloeye 31 minutes ago [-]
Very bad argument. WebPKI and the internet are the global infrastructure.
For the sake of argument, what unnecessary risk do you have in mind?
throwaway7356 25 minutes ago [-]
If you use the internet, yes.
If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.
tonymet 3 minutes ago [-]
On windows & Mac OS, I turn off sill sounding certs in the cert store. You don’t need that many to use your regular apps.
maxnoe 27 minutes ago [-]
Many US institutions seem to have used eMudhra as a cert provider, including Cornell, and the U of Michigan, Maryland and Chicago.
Check InCommon Certificate Service.
qurren 38 minutes ago [-]
Until some website of some service you're using embeds an Indian-sourced JavaScript required for its support chat and you're unable to get a refund on a defective product you purchased.
Or worse, you were billed incorrectly by some US-based service, their support chat loads Indian assets, and they threaten to hit your credit score and send debt collectors after you if you don't pay up.
nofunsir 13 minutes ago [-]
US consumer protection laws do not and CANNOT require US citizens to trust foreign agents. Period. There are other ways to extract a lawful refund.
IcePenguin 2 hours ago [-]
eMudhra's recent response regarding their Intermediate CA private key compromise, citing social media activity and investor relations as blockers to technical investigation and analysis: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c39
> "There are a lot of questions here. As most of you can imagine, we have been subject to intense social media scrutiny and analysis by investors/customers over the last few days and it has made doing any meaningful analysis of the event pretty much impossible."
> "The Mozilla Root Program sent the attached questions to eMudhra on the 20th October at 20:31 UTC. eMudhra was asked to provide an initial response within 24 hours. After the deadline passed on October 21st, eMudhra asked for a further 24 hours to respond. As of the time of writing on Friday 23rd, Mozilla has not received a response to these questions."
jmspring 54 minutes ago [-]
I hadn't heard of this Intermidate CA provider. I guess I've been a bit lax on keeping myself updated in the PKI space. That said, given the country it is based, it doesn't surprise me about the general lack of quality and seriousness about what they did and how it's been exposed.
I may get downvotes, but this just screams amateur hour.
paaloeye 28 minutes ago [-]
Somewhat liberal use of the verb "may"
dsr_ 45 minutes ago [-]
The downvote is for generalizing to a country.
15155 36 minutes ago [-]
Is it possible to make a broadly-accurate generalization about work ethic in a given country? (There are no Foxconn-style suicide nets in the United States that I am aware of - so perhaps?)
Do some countries possibly value quality or responsibility as a desirable property more than others at a cultural level? (Is "German Engineering" a real thing?)
Why do 419-style scams seem to emanate from a few specific countries? Why is piracy on the high seas more prevalent in Somalia than the United Kingdom?
lukan 24 minutes ago [-]
"Is it possible to make a broadly-accurate generalization about work ethic in a given country? "
It is, but those generalisations are usually debatable and will then lead to nationalistic debates that are allmost always flame war style, with people shouting over each other who is from the worst nation. Which is why many flag anything, that smells like leading towards this.
fatty_patty89 4 minutes ago [-]
>It is, but those generalisations are usually debatable and will then lead to nationalistic debates that are allmost always flame war style, with people shouting over each other who is from the worst nation. Which is why many flag anything, that smells like leading towards this.
So we should just close our eyes and not say accurate information, got it
VirusNewbie 20 minutes ago [-]
Is it work ethic or is it nepotism/corruption?
I mean if I'm going to make really large generalizations about Software Engineering talent by country, Swiss people are the absolute bottom of the barrel maybe followed by the cheap outsourcing countries next, but ymmv.
I'm also sure i've worked with a lot more very good Indian engineers than German engineers here in America, but that might have more to do with who immigrates here.
15155 10 minutes ago [-]
> Swiss people are the absolute bottom of the barrel maybe followed by the cheap outsourcing countries next
By virtue of population, a generalization may or may not hold more weight. Anecdotes are also tricky to really apply broadly: it's simply impossible for you to have encountered that many Swiss software engineers because few exist - few Swiss people exist. In 2019, for instance, there were over 300,000 Indian H-1B petitions, to Switzerland's total of 202.
> I'm also sure i've worked with a lot more very good Indian engineers than German engineers here in America, but that might have more to do with who immigrates here.
Relative quality of life in Germany is objectively better in India by pretty much every metric, so there's an automatic/inherent bias - it's probable that more Indians wish to immigrate to the United States. (More than 10% of the Indian population doesn't have access to modern toilet facilities, for instance.) The competition for U.S. immigrant visas is far higher amongst Indians simply by the numbers, so there may also be a filtering function at play.
icedchai 21 minutes ago [-]
It is poor form. But if you've ever worked with one of the WITCH companies, these statements come as no surprise.
moi2388 41 minutes ago [-]
If you ever dealt with indian software companies you would also know it to be an accurate statement, however
"Sectigo has completed the revocation of the affected cross-signed CA Certificates. A new CRL and OCSP responses have been published and are making their way to our CDN edge nodes right now.
We will continue monitoring and evaluating this bug for further updates from Emudhra."
spockz 30 minutes ago [-]
Yes that if reactive. But I think GP meant what their responsibility in this is given that they signed and thereby vouched for an intermediate ca that now has become untrustworthy.
tonymet 3 minutes ago [-]
Once encoded, the low quality private key would have been indistinguishable from a high quality one. So I put some of the blame on the tooling. I’ve generated loads of certs and private keys, and never thought to decode the private factor out to make sure it’s a sensible number. In other words, I could see myself making this exact mistake (well not now that we all know how humiliating it is).
So tooling bears some of the blame, unless I’m misunderstanding the mistake that was made.
Tomdarkness 33 minutes ago [-]
What kind of leverage do these browser CA programs have with eMudhra given they are no longer issuing TLS certificates?
If eMudhra just don't comply with Mozilla/Chrome, is there anything they can actually do?
bauruine 11 minutes ago [-]
Their RSA root certificate is still trusted. They could say they want that removed and the questions would instantly stop.
bradfa 31 minutes ago [-]
The browsers could kick ALL their keys out and break all of eMudhra's customers websites. Those customers could sue.
nraynaud 28 minutes ago [-]
I have to say that if one of the RSA public keys was really 4, I have to tip my hat, stumbling on a perfect square of an even number, that’s really a score.
starkrights 4 minutes ago [-]
It was ECC private keys, not RSA public.
bauruine 16 minutes ago [-]
They where ECC keys
skeledrew 1 hours ago [-]
If you can't take the heat...
jdiff 21 minutes ago [-]
They are already attempting to flee the kitchen as quickly as they can, unfortunately the rest of the planet that's still in the kitchen isn't keen on letting them escape the grease fire they started.
tamimio 48 minutes ago [-]
When an engineer (or engineering firm) found that it caused a bridge collapse due to negligence, they are taken accountable, sometimes even prison times if harm or death happened. We rarely see the same in tech world for some reason, there’s still this green pass and the idea that tech are auxiliary and all its mistakes are just reset a password. That company should be accountable, the damage is far from over as these certs that made by stupid people could be anywhere from IoT to critical infrastructure.
iamnothere 13 minutes ago [-]
If you want formal engineering outcomes, you need formal engineering standards. But in the same way that redoing a home bathroom doesn’t require the same multimillion dollar process as building a bridge, not all software projects can fall under the same umbrella. Any scheme like this has to take into account where certification is actually needed and what the goals and costs are.
And guess what: this already exists. DO-178C for aviation, ISO 26262 for automotive, IEC 62304 for medical, etc. But these standards are specialized to the industry because, no surprise, there is no appropriate one-size-fits-all software development approach. You can’t just say “software must be bug-free” and leave it at that. That’s been shown to be impossible. Even formally verified software can have spec bugs.
There’s already formal standards that CAs must meet, and they get audited too. Maybe those standards aren’t rigorous enough. But even with those standards, what authority is going to punish a CA who breaks them, other than browser/OS vendors? If it damages the host nation, you might see something. But if the host nation is complicit, and used the rogue CA for intel purposes—or if the company has political connections—then I don’t think you’re getting the punishment you want.
It makes sense to have these heavy standards when you’re talking about software whose failure could immediately cost actual lives. I’m hesitant to expand it elsewhere as it could threaten the viability of open source and software freedom in general. Nobody should ever need a license to run a compiler or deploy an application to their own server.
bob1029 25 minutes ago [-]
Accountability is rarely something that a person or organization will spontaneously adopt of their own free will. It generally has to be forced from the outside by way of additional consequences.
Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. I would hesitate to call the wind-down of a business unit a "consequence" in this context because it's the default outcome. Everyone was already playing that game. We need an additional layer of pressure to encourage good behavior.
throwaway7356 10 minutes ago [-]
> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum.
No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.
Vaushite 20 minutes ago [-]
No, it's not limited to strongly worded posts. The external consequences are usually immediate bankruptcy of the CA after the investigation concludes. An untrusted CA has absolutely no business model whatsoever, and may have to refund its former customers.
bob1029 12 minutes ago [-]
> The external consequences are usually immediate bankruptcy of the CA after the investigation concludes.
It would seem that we have different definitions of "wind-down". Everyone in the business operated with this consequence already on the table and it did not seem to provide the desired outcome.
Vaushite 2 minutes ago [-]
So you want jail time for people whose certificates get revoked? Or what else could there possibly be? Deterrence doesn't actually prevent mistakes and accidents, that's why bridges still collapse even with the consequences you described on the table. And I haven't seen it on HN yet, but Dread, the front page of the dark web, covering many illegal topics, where the potential consequence of a private key leak is death, leaked their private key.
Vaushite 21 minutes ago [-]
That's because a bridge didn't collapse.
ktm5j 9 minutes ago [-]
We don't know that. No one knows what's potentially happened out in the wild because of these faulty certificates.
ForHackernews 40 minutes ago [-]
No one at OpenAI, Anthropic or Google will be held accountable for their various felony bots[0], Facebook encouraged an actual genocide[1], but HN commenters are baying for blood of some random Indian contracting firm that royally goofed up their SSL certs.
> There are a lot of questions here. As most of you can imagine, we have been subject to intense social media scrutiny and analysis by investors/customers over the last few days and it has made doing any meaningful analysis of the event pretty much impossible. The event happened on April 30 2025 and was done by set of people who have worked in the PKI industry for several years and worked with us for a while. There is a lot of digging we need to do to understand the circumstances, why, what, how to share a meaningful report that can hopefully benefit the community. I do not know why some community members think we wont be getting back on this bug. When we signed up for the browser program trust, we also signed up for disclosure obligations to the community which we will uphold.
ETA- HN rate-limiting won't let me reply, but to the commenter asking how all the pressure could delay a sober analysis:
I've never been involved with a mess like this, but I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.
--------------------
Edit2: Still ratelimited for the downvotes, but in response to @andor:
But there's 12 separate questions in this comment alone https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30 many of which are demanding detailed information and statistics that would need to be reconstructed from audit logs.
I imagine lawyers are involved because whatever answers they give will inevitably wind up as evidence in ensuing lawsuits. I'm sure anything publicly released needs to be cleared through several layers of review.
InsidiousWombat 1 hours ago [-]
If some social media nonsense makes it hard for you to do internal investigation on the problem that shows that you're organisationally incompetent in addition to whatever else in the process failed.
squidmaster 45 minutes ago [-]
[dead]
roblabla 1 hours ago [-]
> I've never been involved with a mess like this, but I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.
In any sane business, the people handling the screaming investors are different from the people handling the social media mess, and they are also different from the people doing the RCA.
That said, given the mess, I wouldn't be surprised if eMudhra only had one employee responsible for all those jobs...
altairprime 42 minutes ago [-]
> I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.
Such a business will not be long operating a CA, then: these sorts of requests are common and CA operations are done openly in public with all accidents openly admitted in plain view. If management can’t deliver an environment that prioritizes compliance over rage and blame, then termination of CA acceptance for the company they manage with such irrationality is a successful outcome for the process. I respect that there may be opposing corporate and/or cultural pressures, and I imagine that’s why they’re voluntarily exiting the CA business, but they’re at risk of having all issuances distrusted retroactively if they think that gives them the leeway to reply late.
28 minutes ago [-]
wolvoleo 1 hours ago [-]
No it does not. How does social media upheaval make internal analysis impossible?
thumbsup-_- 1 hours ago [-]
because they are more interested in saving the image on social media than doing the right thing.
Vaushite 18 minutes ago [-]
Which is their job. The "right thing" if that is to shut down the CA will be managed by the CAB, there is no need for eMudhra to shut themselves down when that will be done for them.
24 minutes ago [-]
ghostbrainalpha 59 minutes ago [-]
I was involved in the an incident like this, and the intense pressure for public immediate action led to the (firing or resignation) of multiple people who were actually needed for the investigation.
Something that could have been fully analyzed with those people in a couple weeks ending up taking two years with an independent outside auditor.
The independent auditor would have been needed either way, but if we gave the original crew the opportunity to respond, THEN fired them, the outside auditor could have just verified the story much more quickly.
bauruine 41 minutes ago [-]
You where involved in the biggest fuckup by orders of magnitude your whole industry ever did in it's existance? I'm interested to hear the story.
ForHackernews 38 minutes ago [-]
C'mon now, this isn't even the biggest IT disaster this week.
bauruine 34 minutes ago [-]
Im talking about the CA industry. Maybe industry is the wrong word?
mcmcmc 55 minutes ago [-]
> the intense pressure for public immediate action led to the (firing or resignation) of multiple people who were actually needed for the investigation.
That just sounds like a management failure. You don’t actually have to cave.
criddell 56 minutes ago [-]
That's what managers are for. They shield the people doing the work from all the external distractions.
andor 33 minutes ago [-]
Some of these questions shouldn't be that difficult to answer, and they were asked to provide an initial response anyways.
For example, further up in the bug tracker, they stated that there was an error in a script. If they were able to find an error, why can't they provide the script?
bauruine 1 hours ago [-]
Those are just more reasons to remove every cert they ever touched.
OptOutDesk 1 hours ago [-]
[flagged]
Rendered at 16:56:40 GMT+0000 (Coordinated Universal Time) with Vercel.
And the discussion mentioning wrap/unwrap testing kind of feeds directly into the fear that either:
1. These weak keys were created outside the HSM and then imported.
2. These weak keys were meant to be the wrap keys somehow. Like, if they hadn't paid for some of the wrap/unwrap features on one of their HSMs and so were using easy-for-humans keys to handle the wrap/unwrap operations so they could more easily move keys between HSMs.
Also depending on the FIPS configuration of their HSM, some functionality like wrap/unwrap might not be available
The problem isn't foreign companies; it's bad CAs.
> only trust other US citizens with my security
I'm not sure what you mean, but this doesn't seem to be a coherent concept.
man fox news has really done a number on people's brains.....
If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.
Check InCommon Certificate Service.
Or worse, you were billed incorrectly by some US-based service, their support chat loads Indian assets, and they threaten to hit your credit score and send debt collectors after you if you don't pay up.
> "There are a lot of questions here. As most of you can imagine, we have been subject to intense social media scrutiny and analysis by investors/customers over the last few days and it has made doing any meaningful analysis of the event pretty much impossible."
Mozilla Root Program's update, stating that eMudhra has not responded to investigatory questions within deadlines (and had provided an extension): https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c42
> "The Mozilla Root Program sent the attached questions to eMudhra on the 20th October at 20:31 UTC. eMudhra was asked to provide an initial response within 24 hours. After the deadline passed on October 21st, eMudhra asked for a further 24 hours to respond. As of the time of writing on Friday 23rd, Mozilla has not received a response to these questions."
I may get downvotes, but this just screams amateur hour.
Do some countries possibly value quality or responsibility as a desirable property more than others at a cultural level? (Is "German Engineering" a real thing?)
Why do 419-style scams seem to emanate from a few specific countries? Why is piracy on the high seas more prevalent in Somalia than the United Kingdom?
It is, but those generalisations are usually debatable and will then lead to nationalistic debates that are allmost always flame war style, with people shouting over each other who is from the worst nation. Which is why many flag anything, that smells like leading towards this.
So we should just close our eyes and not say accurate information, got it
I mean if I'm going to make really large generalizations about Software Engineering talent by country, Swiss people are the absolute bottom of the barrel maybe followed by the cheap outsourcing countries next, but ymmv.
I'm also sure i've worked with a lot more very good Indian engineers than German engineers here in America, but that might have more to do with who immigrates here.
By virtue of population, a generalization may or may not hold more weight. Anecdotes are also tricky to really apply broadly: it's simply impossible for you to have encountered that many Swiss software engineers because few exist - few Swiss people exist. In 2019, for instance, there were over 300,000 Indian H-1B petitions, to Switzerland's total of 202.
> I'm also sure i've worked with a lot more very good Indian engineers than German engineers here in America, but that might have more to do with who immigrates here.
Relative quality of life in Germany is objectively better in India by pretty much every metric, so there's an automatic/inherent bias - it's probable that more Indians wish to immigrate to the United States. (More than 10% of the Indian population doesn't have access to modern toilet facilities, for instance.) The competition for U.S. immigrant visas is far higher amongst Indians simply by the numbers, so there may also be a filtering function at play.
eMudhra intermediate CA compromise
https://news.ycombinator.com/item?id=50166579
1271 points | galadran | 3 days ago | 504 comments
--
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
https://news.ycombinator.com/item?id=50177916
935 points | hkc | 2 days ago | 460 comments
--
eMudhra to exit global SSL/TLS certificate business
https://news.ycombinator.com/item?id=50195110
1111 points | bo0tzz | 1 day ago | 713 comments
Can't wait to see all the exploits this will enable.
"Sectigo has completed the revocation of the affected cross-signed CA Certificates. A new CRL and OCSP responses have been published and are making their way to our CDN edge nodes right now.
We will continue monitoring and evaluating this bug for further updates from Emudhra."
So tooling bears some of the blame, unless I’m misunderstanding the mistake that was made.
If eMudhra just don't comply with Mozilla/Chrome, is there anything they can actually do?
And guess what: this already exists. DO-178C for aviation, ISO 26262 for automotive, IEC 62304 for medical, etc. But these standards are specialized to the industry because, no surprise, there is no appropriate one-size-fits-all software development approach. You can’t just say “software must be bug-free” and leave it at that. That’s been shown to be impossible. Even formally verified software can have spec bugs.
There’s already formal standards that CAs must meet, and they get audited too. Maybe those standards aren’t rigorous enough. But even with those standards, what authority is going to punish a CA who breaks them, other than browser/OS vendors? If it damages the host nation, you might see something. But if the host nation is complicit, and used the rogue CA for intel purposes—or if the company has political connections—then I don’t think you’re getting the punishment you want.
It makes sense to have these heavy standards when you’re talking about software whose failure could immediately cost actual lives. I’m hesitant to expand it elsewhere as it could threaten the viability of open source and software freedom in general. Nobody should ever need a license to run a compiler or deploy an application to their own server.
Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. I would hesitate to call the wind-down of a business unit a "consequence" in this context because it's the default outcome. Everyone was already playing that game. We need an additional layer of pressure to encourage good behavior.
No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.
It would seem that we have different definitions of "wind-down". Everyone in the business operated with this consequence already on the table and it did not seem to provide the desired outcome.
[0] https://www.felonybench.com/
[1] https://www.amnesty.org/en/latest/news/2022/09/myanmar-faceb...
> There are a lot of questions here. As most of you can imagine, we have been subject to intense social media scrutiny and analysis by investors/customers over the last few days and it has made doing any meaningful analysis of the event pretty much impossible. The event happened on April 30 2025 and was done by set of people who have worked in the PKI industry for several years and worked with us for a while. There is a lot of digging we need to do to understand the circumstances, why, what, how to share a meaningful report that can hopefully benefit the community. I do not know why some community members think we wont be getting back on this bug. When we signed up for the browser program trust, we also signed up for disclosure obligations to the community which we will uphold.
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c39
--------------------
ETA- HN rate-limiting won't let me reply, but to the commenter asking how all the pressure could delay a sober analysis:
I've never been involved with a mess like this, but I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.
--------------------
Edit2: Still ratelimited for the downvotes, but in response to @andor:
You're right, some of the questions are fairly straightforward and should be easy to answer -- I would argue they already did provide an initial response here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11
But there's 12 separate questions in this comment alone https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30 many of which are demanding detailed information and statistics that would need to be reconstructed from audit logs.
I imagine lawyers are involved because whatever answers they give will inevitably wind up as evidence in ensuing lawsuits. I'm sure anything publicly released needs to be cleared through several layers of review.
In any sane business, the people handling the screaming investors are different from the people handling the social media mess, and they are also different from the people doing the RCA.
That said, given the mess, I wouldn't be surprised if eMudhra only had one employee responsible for all those jobs...
Such a business will not be long operating a CA, then: these sorts of requests are common and CA operations are done openly in public with all accidents openly admitted in plain view. If management can’t deliver an environment that prioritizes compliance over rage and blame, then termination of CA acceptance for the company they manage with such irrationality is a successful outcome for the process. I respect that there may be opposing corporate and/or cultural pressures, and I imagine that’s why they’re voluntarily exiting the CA business, but they’re at risk of having all issuances distrusted retroactively if they think that gives them the leeway to reply late.
Something that could have been fully analyzed with those people in a couple weeks ending up taking two years with an independent outside auditor.
The independent auditor would have been needed either way, but if we gave the original crew the opportunity to respond, THEN fired them, the outside auditor could have just verified the story much more quickly.
That just sounds like a management failure. You don’t actually have to cave.
For example, further up in the bug tracker, they stated that there was an error in a script. If they were able to find an error, why can't they provide the script?