The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 |
Newsgroups: mozilla.dev.security.policy
From: Nelson Bolyard <NOnelsonS...@NObolyardSPAM.me>
Date: Wed, 27 Jan 2010 22:40:01 -0800
Local: Thurs, Jan 28 2010 1:40 am
Subject: Re: CNNIC Root Inclusion
On 2010-01-27 09:28 PST, Eddy Nigg wrote:
> On 01/27/2010 07:11 PM, Nelson Bolyard: Well, if that's the case, then the protests being lodged against CNNIC as >> On 2010-01-27 06:18 PST, Eddy Nigg wrote: > I think that the issues mentioned are a bit broader and haven't > much to do with code signing certificates per se. Distribution of > malware usually starts at a web site, and this is what the links below say. >>> http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client... >>> http://www.siteadvisor.com/sites/cnnic.net.cn >>> http://en.wikipedia.org/wiki/China_Internet_Network_Information_Cente... >> I cannot determine, from the information presented on those pages, if CNNIC > I nowhere seen anything about signed software, this is your (wrong) an issuer of SSL server certs are all the more absurd. The issuance of an SSL server cert doesn't attest to the morality or competence of the business dealings of the operator of the SSL server. It only attests to the pairing or "binding" of the certified name to the certified public key. >> I think we need to be very careful to avoid getting caught in the trap of But my point is that any arguments that are based on the presence of malware >> thinking of certificates as attestations of morality or competence, and >> thinking of CAs as judges of morality or competence. If we allow the role >> of CAs to become defined as being those judges, they will CERTAINLY FAIL. >> So, let's define their role as doing something at which they can succeed, >> namely attesting to binding of keys to vetted identities. > That's why I requested to have this handled at the proper channels. are irrelevant and should not be considered in whether or not the CA acted properly as a CA. If the CA's cert properly indicated the name of the party who should be held responsible for the malware, then IMO the CA did its job admirably and should not be punished for the job it did as a CA. You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
| |||||||||||||