Re: Self-signed security certificates.. (oh, the evil)
- From: Roedy Green <look-on@xxxxxxxxxxxxxxxxxxxx>
- Date: Sat, 10 Sep 2005 03:24:54 GMT
On Sat, 10 Sep 2005 01:53:20 GMT, Andrew Thompson
<SeeMySites@xxxxxxxxxxx> wrote or quoted :
>Most specifically, can anybody here attest that they
>*paid* for a code signing certificate before they had
>seen it work for a project?
Think "What is a certificate from Thawte for?". They are helping
someone determine if a program they found on the net was indeed truly
written by Canadian Mind Products, all without checking back to the
CMP website.
Thawte vouches : yes it was him. They are also indirectly vouching
that Roedy Green and Canadian Mind Products really exist . CMP is a
real company. They are in the phone book. Roedy has a passport. They
are also vouching that CMP is flush enough to part with $400 US a year
for the cert, no little fly by night. :-)
Let us say I am too cheap or poor to buy a cert and use a self signed
one. Well, it is obvious that whomever created the cert is the
person who created the CMP website. People trust whomever runs that
website just as much as they trust the company Canadian Mind Products.
So there really should not be an issue of trusting the identity of
that cert ON MY WEBSITE. Now elsewhere, there is nothing to stop
someone form taking one of my downloads, screwing with the code, and
resigning with a fake certificate using my name.
The problem is people don't realize this and are overly afraid of my
phony cert on my website.
I have been creating ASP PAD XML file descriptors for all my code
which invites people to download and redistribute my downloads.
Ideally I would like to sign those with a real certificate.
--
Canadian Mind Products, Roedy Green.
http://mindprod.com Again taking new Java programming contracts.
.
- Follow-Ups:
- Re: Self-signed security certificates.. (oh, the evil)
- From: Andrew Thompson
- Re: Self-signed security certificates.. (oh, the evil)
- References:
- Self-signed security certificates.. (oh, the evil)
- From: Andrew Thompson
- Self-signed security certificates.. (oh, the evil)
- Prev by Date: Re: Self-signed security certificates.. (oh, the evil)
- Next by Date: Re: moving from J2SE to the J2EE world? how?
- Previous by thread: Re: Self-signed security certificates.. (oh, the evil)
- Next by thread: Re: Self-signed security certificates.. (oh, the evil)
- Index(es):
Relevant Pages
|
