On 02/25/2009 08:31 PM, Gervase Markham:
On 23/02/09 23:54, Eddy Nigg wrote:
How to prove? Does Mozilla buy domain names (or purchase certificates)
from time to time in order to govern its policies?
We rely on good citizens like you to let us know when there's a problem
:-) We don't regularly attempt to break the security of CA cert issuance
procedures, either.
That's a very bad idea if you RELY on that. Instead you should implement
a procedure and plan for random checking various issues. Remember the
bug with Equifax/Geotrust which issues directly from a CA root and how
surprised you were and how surprised I was that you were surprised? ;-)
I can't know what Mozilla knows or doesn't know!
Only CAs are relevant if at all. You don't expect that 200 domain names
were registered by going through anti-spoofing checking and measures, do
you?!
I don't understand what you are saying here. :-(
Outsh, sorry! That should have been 200 *million* domain names were
registered by going through some anti-spoofing checking and measures...
--
Regards
Signer: Eddy Nigg, StartCom Ltd.
Jabber: start...@startcom.org
Blog: https://blog.startcom.org
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
