The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 |
Newsgroups: mozilla.dev.security.policy
From: Eddy Nigg <eddy_n...@startcom.org>
Date: Wed, 27 Jan 2010 19:28:00 +0200
Subject: Re: CNNIC Root Inclusion
On 01/27/2010 07:11 PM, Nelson Bolyard:
> On 2010-01-27 06:18 PST, Eddy Nigg wrote: Technical in the sense of policies and CA practices. It's not a >>> Even though this is mostly a technical forum, > It is? political forum... > I've seen MANY rants in past years from people who got infected by signed Sure, I think that the issues mentioned are a bit broader and haven't > malware. They were under the mistaken impression that signed software is > software that has been certified by the CA to be virus-free. Of course, > as we know, that's not what a code signing cert means at all. It merely > provides trustworthy identification of the source of the software, and > does not attest to the quality of the software. much to do with code signing certificates per se. Distribution of malware usually starts at a web site, and this is what the links below say. >> http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client... I nowhere seen anything about signed software, this is your (wrong) >> http://www.siteadvisor.com/sites/cnnic.net.cn >> http://en.wikipedia.org/wiki/China_Internet_Network_Information_Cente... > I cannot determine, from the information presented on those pages, if CNNIC assumption. > I think we need to be very careful to avoid getting caught in the trap of That's why I requested to have this handled at the proper channels. > thinking of certificates as attestations of morality or competence, and > thinking of CAs as judges of morality or competence. If we allow the role > of CAs to become defined as being those judges, they will CERTAINLY FAIL. > So, let's define their role as doing something at which they can succeed, > namely attesting to binding of keys to vetted identities. Though I think a discussion specially by the affected parties might be interesting to have in order to understand more about it. And obviously there might be members willing to voice their opinion what should be done... -- Signer: Eddy Nigg, StartCom Ltd. You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
| |||||||||||||