<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
On 01/02/2009 10:45 PM, Martin Paljak:
<blockquote
cite="mid:A333B5A4-0E76-44AE-9173-CB92BD8AA144@paljak.pri.ee"
type="cite">On 02.01.2009, at 15:16, Eddy Nigg (StartCom Ltd.) wrote:<br>
<blockquote type="cite">Martin, failures and disclosing them serves
the purpose to improve and prevent them. I'm responsible for disclosing
one of the listed above, which however doesn't mean that public
certification is a total failure. It speaks rather for the dedication
and also the ability of the industry to control and improve itself.
<br>
</blockquote>
Of course disclosure is good. But as you have interests in one CA I
have to take your opinion as probably biased ;)
<br>
<br>
</blockquote>
<br>
Right! And as such I have an interest that my work isn't de-valued by
other CAs. Such is the interest of many CAs and hence there is a real
interest that we (CAs) are able to upheld the promises we make as a
collective. That's why incidents such as I reported are extremely bad
and must not happen. I'm active in different forums out of my biased
interest to make and keep PKI reliable.<br>
<br>
Disclaimer: Mistakes can happen, negligence must not however.<br>
<br>
<blockquote
cite="mid:A333B5A4-0E76-44AE-9173-CB92BD8AA144@paljak.pri.ee"
type="cite"><br>
"Nothing to see here, move along, EV fixes everything". Yes -
technically, within the boundaries set by the established CA business,
everything is OK and will be even better with EV. But I try to question
the existing, current approach of CA-s doing business under the name
"trust business". CA-s should deal with certification and users should
be dealing with trust issues and decisions. PKI as we know it now is
not an implementation I like as a (loud minority) user.
<br>
</blockquote>
<br>
Well, the minority of the Netizens have the ability to make the
decisions you like them to make. I'm not sure about you, but how many
CP/CPS of CAs have you read recently before making a decision if to
trust?<br>
<br>
<blockquote
cite="mid:A333B5A4-0E76-44AE-9173-CB92BD8AA144@paljak.pri.ee"
type="cite">Good question. As "you can do anything with OpenID" I
believe it is left open - you can do whatever if you want if you
consider it useful.
<br>
<br>
</blockquote>
Sure, that's why we are here, aren't we? :-)<br>
<br>
<br>
<div class="moz-signature">
<table cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>