> > On 2010-01-27 06:18 PST, Eddy Nigg wrote:

> >>> Even though this is mostly a technical forum,

> > It is?

> Technical in the sense of policies and CA practices. It's not a
> political forum...

> > I've seen MANY rants in past years from people who got infected by signed
> > malware.  They were under the mistaken impression that signed software is
> > software that has been certified by the CA to be virus-free.  Of course,
> > as we know, that's not what a code signing cert means at all.  It merely
> > provides trustworthy identification of the source of the software, and
> > does not attest to the quality of the software.

> Sure, I think that the issues mentioned are a bit broader and haven't
> much to do with code signing certificates per se. Distribution of
> malware usually starts at a web site, and this is what the links below say.

> >>http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client...

> >>http://www.siteadvisor.com/sites/cnnic.net.cn

> >>http://en.wikipedia.org/wiki/China_Internet_Network_Information_Cente...

> > I cannot determine, from the information presented on those pages, if CNNIC
> > was itself the source (the signer) of the signed software,

> I nowhere seen anything about signed software, this is your (wrong)
> assumption.

> > I think we need to be very careful to avoid getting caught in the trap of
> > thinking of certificates as attestations of morality or competence, and
> > thinking of CAs as judges of morality or competence.  If we allow the role
> > of CAs to become defined as being those judges, they will CERTAINLY FAIL.
> > So, let's define their role as doing something at which they can succeed,
> > namely attesting to binding of keys to vetted identities.

> That's why I requested to have this handled at the proper channels.
> Though I think a discussion specially by the affected parties might be
> interesting to have in order to understand more about it. And obviously
> there might be members willing to voice their opinion what should be done...

> --
> Regards

> Signer:  Eddy Nigg, StartCom Ltd.
> XMPP:    start...@startcom.org
> Blog:    http://blog.startcom.org/
> Twitter:http://twitter.com/eddy_nigg