3 ms·

Is it really [going down the drain] though? I'd imagine there will be infinite ways to create costly enterpris-y offerings, be that via additional important-loo

by g09980 9y ago

Is it really [going down the drain] though? I'd imagine there will be infinite ways to create costly enterpris-y offerings, be that via additional important-looking seals, SLAs, EV, or something else. Or Postgres+friends would've destroyed Oracle ages ago.

gtsteve 9y ago
Furthermore, I don't believe there is a LetsEncrypt equivalent for code signing.
- jacobush 9y ago
  Also harder to implement. With letsencrypt you prove you control the domain and the DNS. How do you prove you control software?
  - nailer 9y ago
    It's the same process as EV - verify the public key is controlled by a real world legal entity. Validation process depends on the entity type, but usually a combination of government and private business registrars, and verification phone calls. Sometimes ID inspection for sole traders (since in their case the legal entity is a person).
    - jacobush 9y ago
      Yes, but this does not lend itself to automation, hence free as letsencrypt does.
      - nailer 9y ago
        Not entirely, but reducing EV verification times is my job at https://certsimple.com https://certsimple.com. There's a lot that can be done and most CAs tech to handle the problem is at least a decade old. Also: ACME for EV is coming.
        jacobush 9y ago
        Cool. I’ll send you an email.