DigiCert: Threat of legal action to stifle Bugzilla discourse (bugzilla.mozilla.org)

Article summary

DigiCert sent a letter to Sectigo, threatening legal action over statements made by Sectigo's Chief Compliance Officer on Bugzilla, which DigiCert claimed were false and misleading. Sectigo's General Counsel responded, stating that the statements were protected by the First Amendment and were made to facilitate discussion and debate. The incident has sparked a discussion about the importance of open and honest debate in the WebPKI community. DigiCert has since stated that their intention was to defend the integrity of the forum, not to chill debate.

Main themes

• WebPKI community
• Free speech and debate
• Certificate authorities
• Legal threats and action
• Industry self-regulation
• Trust and integrity

What commenters say

• DigiCert's threat of legal action is seen as an attempt to stifle scrutiny and discussion of public CA practices, which is damaging to the WebPKI community.
• The WebPKI community relies on open and honest debate to self-regulate and improve industry practices, and legal threats undermine this process.
• Removing DigiCert from trust stores would be a drastic measure that could have significant consequences for innocent parties, including customers who rely on their certificates.
• DigiCert's actions may be seen as a form of bullying, and the company may face consequences, including loss of trust and business, if they continue to prioritize their own interests over the integrity of the WebPKI community.
• The incident highlights the need for a more progressive approach to removing certificate authorities from trust stores, one that balances the need to protect the community with the need to minimize disruption to innocent parties.
• Some argue that DigiCert's size and influence make them too big to fail, and that removing them from trust stores would be impractical and potentially harmful to the broader internet ecosystem.
• Others argue that DigiCert's actions demonstrate a lack of commitment to the principles of the WebPKI community, and that they should be held accountable for their behavior.
• The incident has sparked a broader discussion about the role of certificate authorities in the WebPKI ecosystem, and the need for greater transparency and accountability in the industry.