<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Eric,<br>
<br>
Eric Norman wrote:
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap=""><!---->
Right. Just about everyone already knows that.
</pre>
</blockquote>
How do I know what everybody knows? ;-)<br>
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap="">But it's not relevant to the point. One of the
key phrases above is "correct places".
</pre>
</blockquote>
Mhhh...<br>
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap="">
Which of those 100 or so trust anchors should I
delete? </pre>
</blockquote>
Mod them down to about 40 or so...<br>
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap="">Some folks will say "Start with all of 'em".
</pre>
</blockquote>
Well, that's funny..."Some folks" don't trust CAs, but trust some home
grown OpenID server run by haK0rz.ru to spill all their spam onto your
forum...YEAH! I love it...please punch me somewhat harder...please...<br>
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap="">
They're just self-asserted claims, fer Pete's sake!
</pre>
</blockquote>
How do YOU know? I'm sure you have some concrete examples (not that all
CAs do such a great job always....but still...)
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap="">
What can I do to include my notion of trustworthiness
instead of having to rely on blind faith in some
system programmer at Mozilla or wherever?
</pre>
</blockquote>
You can invest a lot of time and work to include your notion or indeed
trust in the work others are doing:
<a class="moz-txt-link-freetext" href="http://www.mozilla.org/projects/security/certs/policy/">http://www.mozilla.org/projects/security/certs/policy/</a> <br>
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap="">
That's part of the real problem. For further commentary,
I'll just refer you to what Peter Williams is saying.
He seems to have his brain partly wrapped abound the
problem (albeit maybe not the total solution).
</pre>
</blockquote>
In general I agree with the statement from Peter...<br>
<blockquote cite="mid:84a6b01e2a8c363ee77774475180d556@doit.wisc.edu"
type="cite">
<pre wrap="">Especially this:
On Jul 21, 2007, at 1:37 PM, Peter Williams wrote:
</pre>
<blockquote type="cite">
<pre wrap="">What we need now are protocols hooks and UI concepts that implement
these raw technologies in a fashion that consumers can manage – and
thus impose their view of trustworthiness on the world – as they see
it.
</pre>
</blockquote>
<pre wrap=""><!---->
I will assert one thing that you can take as "Gospel",
if you so choose. This is not a problem that technology
can totally solve, but it can make a contribution. </pre>
</blockquote>
Well, the technology can't solve the trust problem, it can provide the
protocol hooks, as Peter said...Perhaps due policies can help to
provide the frameworks needed.<br>
<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Jabber: <a class="moz-txt-link-abbreviated" href="mailto:startcom@startcom.org">startcom@startcom.org</a></font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>