3 ms·

Domain validated code signing certs are super high on my wish list. My domain is a better indicator of my trustworthiness than my name.

wongarsu 7y ago
For me the primary value of code signing doesn't come from knowing that the signer Donald McRonald would never build malware, it comes from knowing that if this was malware I would have a clear path to finding out who created it and having that person persecuted. And since no malware writer wants to go to jail I can be reasonably certain that the signed software is innocent. Domains don't have the same property, owning a domain under a false name is trivial.
- tialaramex 7y ago
  You probably have excess faith in real world identities, whether Donald McRonald or McRonald Enterprises Ltd of Yorkshire, England. For about $100 someone can, from the comfort of their apartment in Moscow, or on a beach in New Zealand or wherever they want, create a totally legitimate business in many countries such as the UK and United States despite never having even visited. For their money all the paperwork will be done by local lawyers who won't ask any awkward questions about who they actually are or why they suddenly want to have a business in their country which has zero physical presence. The lawyer can arrange for post sent "to" this company to be delivered to an office which can scan and forward it to the owners by email if they want though that'll cost an extra fee per year. The people working in the office know no more than a postman does, so persecuting (I hope you meant prosecuting? But either way) them achieves nothing for you. Thus, even if you've 100% checked this is a real company or person in your country your "clear path" can end in a cul-de-sac. Human names don't even need somebody to pay some dodgy lawyer a fee to do the paperwork, you can just lie. In the UK for example you're allowed to change your name at will. Using this to commit crimes is itself illegal, but that doesn't actually help you find someone.

wongarsu 7y ago

For me the primary value of code signing doesn't come from knowing that the signer Donald McRonald would never build malware, it comes from knowing that if this was malware I would have a clear path to finding out who created it and having that person persecuted. And since no malware writer wants to go to jail I can be reasonably certain that the signed software is innocent. Domains don't have the same property, owning a domain under a false name is trivial.

tialaramex 7y ago
You probably have excess faith in real world identities, whether Donald McRonald or McRonald Enterprises Ltd of Yorkshire, England. For about $100 someone can, from the comfort of their apartment in Moscow, or on a beach in New Zealand or wherever they want, create a totally legitimate business in many countries such as the UK and United States despite never having even visited. For their money all the paperwork will be done by local lawyers who won't ask any awkward questions about who they actually are or why they suddenly want to have a business in their country which has zero physical presence. The lawyer can arrange for post sent "to" this company to be delivered to an office which can scan and forward it to the owners by email if they want though that'll cost an extra fee per year. The people working in the office know no more than a postman does, so persecuting (I hope you meant prosecuting? But either way) them achieves nothing for you. Thus, even if you've 100% checked this is a real company or person in your country your "clear path" can end in a cul-de-sac. Human names don't even need somebody to pay some dodgy lawyer a fee to do the paperwork, you can just lie. In the UK for example you're allowed to change your name at will. Using this to commit crimes is itself illegal, but that doesn't actually help you find someone.