🚀 go-pugleaf

"Slow" <aputto@htomail.com.no.spam> writes:

> Sig files can be revoked, most code files use a sub cert so they can be
> individually revoked too. It is unlikly that any one would use a top level
> cert to sign code, as this makes it costly to revoke (you revoke everything
> else with it).

Does IE check for revocation? AFAIK it doesn't.
Lack of proper handling for revocation is the biggest "hole" in most
PKI implementations. It is a non-trivial problem in distributed
systems such as the internet, where no single super-authority exists.

> As a user of IE you can revoke trust to Microsoft certs and Microsoft
> Corporation as a signing authority.

I tried this once (IE 4 I think). I ended up having to reinstall IE.


> These are installed as trusted agencies in the IE setup process.
> Don't remove all the certs cause then SSL etc will fail !

I think this is the situation I ended up with - no trusted third
parties (why SHOULD I trust some huge corporation, which probably has
more than its free share of malcontented employees).

-- 
Jason Rumney <jasonr@altavista.net>