StartSSL's business model: making things free that don't cost them measurable money, and charging for transactions that cost them money.
An exception from that rule in the wake of Heartbleed would arguably have been appropriate, but the business model as such is in no way bad. If the whole SSL industry worked in a way that put price and cost in proportion, there would be no need for Let's Encrypt.
Comments
StartSSL's business model: making things free that don't cost them measurable money, and charging for transactions that cost them money.
An exception from that rule in the wake of Heartbleed would arguably have been appropriate, but the business model as such is in no way bad. If the whole SSL industry worked in a way that put price and cost in proportion, there would be no need for Let's Encrypt.
How does an automated revocation cost them money?
https://blog.cloudflare.com/the-hard-costs-of-heartbleed/