NOnelsonS...@nobolyardspam.me> wrote:
> On 2010-01-27 09:28 PST, Eddy Nigg wrote:
> > On 01/27/2010 07:11 PM, Nelson Bolyard:
> >> On 2010-01-27 06:18 PST, Eddy Nigg wrote:
> > I think that the issues mentioned are a bit broader and haven't
> > much to do with code signing certificates per se. Distribution of
> > malware usually starts at a web site, and this is what the links below
> say.

> http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client...

> >>> http://www.siteadvisor.com/sites/cnnic.net.cn

> http://en.wikipedia.org/wiki/China_Internet_Network_Information_Cente...

> >> I cannot determine, from the information presented on those pages, if
> CNNIC
> >> was itself the source (the signer) of the signed software,

> > I nowhere seen anything about signed software, this is your (wrong)
> > assumption.

> Well, if that's the case, then the protests being lodged against CNNIC as
> an issuer of SSL server certs are all the more absurd.  The issuance of
> an SSL server cert doesn't attest to the morality or competence of the
> business dealings of the operator of the SSL server.  It only attests
> to the pairing or "binding" of the certified name to the certified public
> key.

> >> I think we need to be very careful to avoid getting caught in the trap
> of
> >> thinking of certificates as attestations of morality or competence, and
> >> thinking of CAs as judges of morality or competence.  If we allow the
> role
> >> of CAs to become defined as being those judges, they will CERTAINLY
> FAIL.
> >> So, let's define their role as doing something at which they can
> succeed,
> >> namely attesting to binding of keys to vetted identities.

> > That's why I requested to have this handled at the proper channels.
> > Though I think a discussion specially by the affected parties might be
> > interesting to have in order to understand more about it. And obviously
> > there might be members willing to voice their opinion what should be
> done...

> But my point is that any arguments that are based on the presence of
> malware
> are irrelevant and should not be considered in whether or not
> the CA acted properly as a CA.  If the CA's cert properly indicated the
> name of the party who should be held responsible for the malware, then
> IMO the CA did its job admirably and should not be punished for the job
> it did as a CA.

> _______________________________________________
> dev-security-policy mailing list
> dev-security-pol...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-security-policy