3 ms·

> Imagine an ecosystem where apps were signed with domain validated certificates, which would be free (or very cheap), instant, and better than what we currentl

by dwaite 5y ago

> Imagine an ecosystem where apps were signed with domain validated certificates, which would be free (or very cheap), instant, and better than what we currently have, and it definitely feels like entrenched interests are working to keep things from improving. The goal is to validate and associate a legal entity with a developer account, not a domain name. In addition to being required to do such things in many jurisdictions for tax reasons, in event of subsequent abuse the stores want to ban an organization - not a $10 domain name.

webmobdev 5y ago
in event of subsequent abuse the stores want to ban an organization A corporate shouldn't get to be the gatekeeper of anything - regulators / courts in a democratic system should decide such things so that the corporates can't abuse their position against a smaller entity. And CAs should be held accountable by the regulators too - a simple regulation like asking CAs to collect legal ID and certificate of registrations before issuing certificates to any person or entity can take care of this. Thus, if any illegal ill-practice is detected in any software, the regulators or the law can be informed and the developer / entity easily identified and necessary legal action can be taken.
donmcronald 5y ago
I know this is old, but... > The goal is to validate and associate a legal entity with a developer account, not a domain name. I'm saying that goal has failed. Setting up a company has a low, fixed cost for bad actors and there's plenty of malware signed by EV code signing certificates. > not a $10 domain name IMO domain names are worth a lot more than $10 once you start building a brand on them. For example, cars.com values their domain at $800 million dollars [1]. Obviously they couldn't sell it for that, but that's what they consider the brand value to be. I can start a "legal entity" for much, much less than the value I attribute to my domain. For small developers and good actors, I think being able to build identity around a domain based brand would be useful. Or, if it's _really_ about accountability, all code signing certificates should be issued to individuals who have validated their identity through a notary. And not using the terrible system the current CAs are using where some poor bastard in a developing country is expected to verify identity documents from a bajillion different legal jurisdictions. I guess I just hate the high pricing and terrible, terrible product that code signing certificates have become. 1. https://domaingang.com/domain-news/cars-com-domain-was-valued-at-872-million-dollars/ https://domaingang.com/domain-news/cars-com-domain-was-value...

by dwaite 5y ago

webmobdev 5y ago

in event of subsequent abuse the stores want to ban an organization A corporate shouldn't get to be the gatekeeper of anything - regulators / courts in a democratic system should decide such things so that the corporates can't abuse their position against a smaller entity. And CAs should be held accountable by the regulators too - a simple regulation like asking CAs to collect legal ID and certificate of registrations before issuing certificates to any person or entity can take care of this. Thus, if any illegal ill-practice is detected in any software, the regulators or the law can be informed and the developer / entity easily identified and necessary legal action can be taken.

donmcronald 5y ago

I know this is old, but... > The goal is to validate and associate a legal entity with a developer account, not a domain name. I'm saying that goal has failed. Setting up a company has a low, fixed cost for bad actors and there's plenty of malware signed by EV code signing certificates. > not a $10 domain name IMO domain names are worth a lot more than $10 once you start building a brand on them. For example, cars.com values their domain at $800 million dollars [1]. Obviously they couldn't sell it for that, but that's what they consider the brand value to be. I can start a "legal entity" for much, much less than the value I attribute to my domain. For small developers and good actors, I think being able to build identity around a domain based brand would be useful. Or, if it's _really_ about accountability, all code signing certificates should be issued to individuals who have validated their identity through a notary. And not using the terrible system the current CAs are using where some poor bastard in a developing country is expected to verify identity documents from a bajillion different legal jurisdictions. I guess I just hate the high pricing and terrible, terrible product that code signing certificates have become. 1. https://domaingang.com/domain-news/cars-com-domain-was-valued-at-872-million-dollars/ https://domaingang.com/domain-news/cars-com-domain-was-value...