3 ms·
https certificates leak all the time and we still use https. Something is better than nothing. Now, is it worthwhile to use code signing certs to try and certif
by kevingadd 5y ago
https certificates leak all the time and we still use https. Something is better than nothing. Now, is it worthwhile to use code signing certs to try and certify the identity of the author? Maybe not, it was slowly phased out for https. But we certainly need something because the alternative (just download and run whatever) was tried and definitely did not work out. We don't want grandma doing the equivalent of 'curl http://x http://x | sudo bash' 4 times a week.
- blablabla123 5y agoI don't get why companies that large would bother considering not using HSMs. Basically it's about public-key encryption, even if https is not ideal, it's quite a widespread implementation that can be sufficiently secure for many use cases
- kevingadd 5y agoMy understanding is that HSMs are a requirement, and the leaked certificate predates it.
- hulitu 5y ago> We don't want grandma doing the equivalent of 'curl http://x http://x | sudo bash' 4 times a week. That's why we have web browsers running untrusted remote code.
- Schroedingersat 5y agoYou put they keys in the owner's hands with a method of changing them that can only he done with physical access.