> > On 01/27/2010 07:11 PM, Nelson Bolyard:

> > > On 2010-01-27 06:18 PST, Eddy Nigg wrote:

> > >>> Even though this is mostly a technical forum,

> > > It is?

> > Technical in the sense of policies and CA practices. It's not a
> > political forum...

> > > I've seen MANY rants in past years from people who got infected by signed
> > > malware.  They were under the mistaken impression that signed software is
> > > software that has been certified by the CA to be virus-free.  Of course,
> > > as we know, that's not what a code signing cert means at all.  It merely
> > > provides trustworthy identification of the source of the software, and
> > > does not attest to the quality of the software.

> > Sure, I think that the issues mentioned are a bit broader and haven't
> > much to do with code signing certificates per se. Distribution of
> > malware usually starts at a web site, and this is what the links below say.

> > >>http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client...

> > >>http://www.siteadvisor.com/sites/cnnic.net.cn

> > >>http://en.wikipedia.org/wiki/China_Internet_Network_Information_Cente...

> > > I cannot determine, from the information presented on those pages, if CNNIC
> > > was itself the source (the signer) of the signed software,

> > I nowhere seen anything about signed software, this is your (wrong)
> > assumption.

> > > I think we need to be very careful to avoid getting caught in the trap of
> > > thinking of certificates as attestations of morality or competence, and
> > > thinking of CAs as judges of morality or competence.  If we allow the role
> > > of CAs to become defined as being those judges, they will CERTAINLY FAIL.
> > > So, let's define their role as doing something at which they can succeed,
> > > namely attesting to binding of keys to vetted identities.

> > That's why I requested to have this handled at the proper channels.
> > Though I think a discussion specially by the affected parties might be
> > interesting to have in order to understand more about it. And obviously
> > there might be members willing to voice their opinion what should be done...

> > --
> > Regards

> > Signer:  Eddy Nigg, StartCom Ltd.
> > XMPP:    start...@startcom.org
> > Blog:    http://blog.startcom.org/
> > Twitter:http://twitter.com/eddy_nigg

> If we include this cert, PRC government can hijack any SSL session
> WITHOUT any warming to user.
> PRC government always monitor online activities of chinese pro-
> democracy people.
> You know what Google's happening.

> We need to protect the user whether this is political or not.