in reply to (OT) SSL Certificates: Self-Signing and Alternative Solutions
Is what your $1000/yr buys you from VeriSign. That is to say that if they screw up(and it can be demonstrably assigned to them), allowing credit card info to be hacked, your idenity to be 'spoofed' by someone else, etc, that they have resources to PAY.
Let's not forget that the core statement of most Open Source licenses says: NO WARRANTY. In other words, if something goes wrong, you suffer damage to your systems, your reputation, your business you're out of luck.
Hopefully, some of the 1K also goes to things like R&D, testing on systems, infrastructure maintenance, and internal and external security. Things like background checks on the employees who actually handle the secured servers; bonded security guards on their data centers; good locks on the doors; good salaries to attract talented, if mercenary, people.
A 'non-profit' or 'open-source' sounds nice, but you're dependent on the 'good will' of the people maintaining and contributing to the system. What happens when a 'fund-raiser' falls short one year? Cheaper locks, no background checks on the guards, cheaper or fewer CPU's, thinner pipes?
Eventually a non-profit is going to have to charge fees anyway to maintain a secure system, or to validate people perhaps contributing their systems.
Profit my be an evil motive to some, but it is at its core an incentive to do things right. The Soviet Union spent 70 years learning that the hard way. Profit also supplies a pool of 'cash' to get things done without having the worry about a fundraiser. A track record of profits can also get banks to loan you money to upgrade your infrastructure.
|
|---|