My impression is that "home value" is often a dodge that sounds better on paper than "I don't like change". You generally can't sue over hurt feelings, but if you can attach some kind of monetary value to it then the courts may take your case.
As you note home value is an extremely nebulous concept as it is tied to whatever people who currently do not live in the community might pay to buy a house. No matter what someone sells for they can always say "it would have sold for more if every single house was painted exactly the same shade of beige, you miscreants with your off white, ecru, and oatmeal houses have cost me tens of thousands of dollars!"
It is a shame that you cannot have a cert signed by multiple CAs.
(The format seems like it would allow it, but nothing supports it, and in practice CAs demand the ability to actually modify some fields, and then sign that.)
It is done with intermediate certs, though! It's a common method of establishing trust in new root certs: sign the intermediate with an already-trusted root cert, then wait for the community to adopt the new root cert over the years.
For example, the initial Let's Encrypt Authority X3 was signed by both their own (new, not-yet-universally-trusted) ISRG Root X1, and the universally-trusted third-party IdenTrust DST Root CA X3.
One crucial detail is that it isn't the same certificate. Rather, it is two separate certificates which just so happen to be using the same key pair, so the leaf cert is in essence signed by both intermediate certs at once.
I wonder if it would be possible to do the same thing on your own, actually: can a server present two completely separate cert chains to a connecting client - as long as the leaves use the same key pair? Technically AFAIK the only requirements should be 1) the key pair in use for the connection matches the cert, 2) the domain matches the cert's Subject, and 3) the cert is trusted, so at first glance it might be possible...
If the client uses "certificate_authorities" extension to list support CA's, a TLD server that holds multiple x509 certificates can present to the client the certificate signed by the clients trusted CA.
Of course, the browsers don't use the "certificate_authorities" because the list would be hilariously large for a TLS CLient Hello packet.
Web of trust required a lot of work by users and was pretty bad in practice. This isn't that.
This would effectively be the same "root CAs come pre-installed" but they would be notaries rather than root CAs, with a predefined trust policy (maybe minimum of 2 notaries per leaf certificate)
Users would still just see a green lock icon same as before, no action needed.
Another option: Use ACME together with ARI (RFC 9773). The client checks ARI data every hour. If the cert needs to be replaced – for example like in this scenario – the CA will inform the client, which in turn would then request a new cert.
I know it’s not convenient to automate for every kind of device though. I guess in some of those cases it might be better to have a load balancer in front of the device. Or use an alternative PKI.
Yeah, that's one of the complications. It would have to be ignored in processing, or multiple variants be presented at once (preferred).
Certificates are not the same as the public key; multiple certs sharing the same key is essentially the way around this. It's not as elegant as identical signing of the same cert, but it could work.
Identical signing of the same cert also runs into issues like "who gets to decide the serial number" and "how to deal with revocation lists: all of, or any of?".
And turning fields like issuer and serial into arrays risks someone accidentally using index 0 for one field and index 1 for another.
Combine that with the insane back-and-forth nightmare that the issuance process would turn into, and I have a very hard time seeing the benefit in it. After all, nobody is stopping you from requesting multiple certs independently, watching the revocation logs, and switching to the backup when required.
The point is limit the damage that distrusting badly-behaved CAs do. Right now there's a lot of blast damage as anyone using them suddenly has their stuff break. If multiple signatures were common, then a given CA could be distrusted without hurting as many others, so it would actually be a viable threat to keep them in line.
I think certificates should be like badges that you can collect – the more badges the higher the trust. So if you are a French company, maybe the tax office in France can sign your certificate to show that you indeed is a real company. If you are accepting card payments – Visa and Mastercard could sign your certificate. If you have a domain the TLD owner could sign your certificate to show that it's indeed your domain… And so on…
And then the browser could present these badges in a nice way to the user.
I just worry that this would just bring us back to the: "Pay $$$$$$ for a certificate, those pesky lets encrypt free certs are not expensive enough to give trust", BS that always happens.
Every time there is a CA issue, someone comes up with "this would be so much better if we'd make it more complex than it already is, as it would make it a bit more convenient to deal with the most recent issue".
I don't think that's the right way to think about it.
It's flagged because lots of "trusted" users flagged it.
Why did they do that? Some might have an aversion to politics in general. That has long been a strong strain here, with people seeing it as diluting the tech focus.
But for a lot, it's clearly more sinister. There has been a lot of partiality in tech recently to plainly fascist and other ultra-right-wing ideas, especially among the executives and capital. They like it, and want it to win, everywhere, and will reflexively do what they can to help it, including burying bad coverage.
I'm confused. Can you point me to the specific policy of this party, or other mainstream "far-right" parties who have a remigration policy that specifically excludes the deportation of white people who were not born there?
ICE has deported thousands of white people under the current administration, for instance. Their removal operations are indiscriminate, not racial. Several white people (some from Canada, some from the UK, some from Ireland) have made headline news after getting picked up by ICE ERO.
You're confused that I accurately described the origins and meaning of the term "remigration"? It is not merely closing borders and deporting immigrants without legal permission to be there. Calling for remigration absolutely is calling for ethnic cleansing. They're not shy about it, except when trying to convince non-racists that it's actually completely reasonable, and will only happen to criminals, the "worst of the worst", and those who haven't assimilated.
The rest is a large pile of missing the point, and bringing up things I did not say.
I did not say any one was doing it. I said people were calling for it.
For the leaders of the Örebro Party in particular, Wikipedia suffices:
> In a podcast segment about second generation immigrants involved in organised crime Allard stated "They will also be forced to leave, even if they are born in Sweden, because they have no natural connection to Sweden. They are not Swedish. They have not been interested in becoming Swedish."
(I am aware that Sweden is _Jus sanguinis_; it is entirely possible that second generation immigrants don't have citizenship; that merely makes it legal. And he does not explicitly make even that limiting argument.)
Note too that ethnicity is narrower than skin color; the lumping together of all European-extraction is a contingent feature of history, and is weaker than you might think. Kicking out non-Swedes would ethnic-cleansing, and would be even if the people being kicked out were white.
Nor does also deporting people for non-ethnic reasons make the rest of a remigration program not ethnic-cleansing. It's not the goal, but it's no big loss to these nationalists, because they're authoritarian race-collectivists willing to cause harm to get those people out.
> Calling for remigration absolutely is calling for ethnic cleansing
Again, I ask for a specific remigration policy that excludes the remigration of white people in the country illegally. This is the prerequisite that would make it a policy based on ethnicity-based deportation.
If it's indiscriminate, it is indiscriminate and therefore not based on ethnic background. Seems to me their explicit policies, both written and in practice, are indiscriminate.
This comment is playing a rhetorical trick, because remigration movements keep calling for the deportation of ethnic minorities who aren't violating any laws or rules. Many even want to specifically revoke the citizenship of ethnic minorities - at which point they'd become "illegals", so in the context of your request it'd still be indiscriminate.
reply