Hacker News new | past | comments | ask | show | jobs | submit
"out of proportion to SSL/TLS’s place in our business" is an insane comparison. They are saying they care so little about SSL/TLS to begin with that it's not fair.

It would be like me practicing surgery 1 hour a week and saying "well surgery only has a very small place in my 80-hour work week" in response to flagrant failure of medical care.

"We are bad at this job, but we don't do it often so don't think we are bad at other jobs".

Yeah, the proportion if anything is too small. This is the sort of company that should not be doing anything related to security.

You're reading it the wrong way, I think. Their certificate business is so small, 1% of revenue, that it's not worth trying to rescue it after the amount of attention it has been getting. It simply wouldn't be profitable.

The more telling thing to me is that they explain that THEIR core business is unaffected, but they don't explain that they fucked up so badly that everyone else had to step in and actively update their trust chains to work around eMudhra to avoid putting every single internet user at risk.

Quite frankly I doubt they understand how massively they've screwed up, or they are trying to hide it to avoid absorbing any blame for the fallout.