> I've also seen a lot of confusion in the past over who is the source if
> signed software.  A lot of people assume that the certificate issuer,
> rather than the certificate subject, is the source of the signed software.

> Now, we come to the immediate cases to which Eddy provided links:

> >http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client...

> >http://www.siteadvisor.com/sites/cnnic.net.cn

> >http://en.wikipedia.org/wiki/China_Internet_Network_Information_Cente...

> I cannot determine, from the information presented on those pages, if CNNIC
> was itself the source (the signer) of the signed software, or was merely the
> issuer of certificates that were used by other subjects to sign malware.
> The middle of those 3 links says that CNNIC had links to another site,
> tech.sina.com.cn, which on its face seems to be another organization.
> This doesn't seem inconsistent with CNNIC's role as a CA.

> I think we need to be very careful to avoid getting caught in the trap of
> thinking of certificates as attestations of morality or competence, and
> thinking of CAs as judges of morality or competence.  If we allow the role
> of CAs to become defined as being those judges, they will CERTAINLY FAIL.
> So, let's define their role as doing something at which they can succeed,
> namely attesting to binding of keys to vetted identities.