cscott

8 ms·

31.
by cscott 18y ago
RapidSSL is owned by GeoTrust, which is owned by Verisign. You can read all about GeoTrust's certificate practices here: http://www.geotrust.com/resources/cps/pdfs/GeoTrustCPS-Versi... The results of their KPMG audit here: https://cert.
32.
by cscott 18y ago
If you want to be a CA, you need to get Microsoft and Mozilla (among others) to include you in their list. I can't find Microsoft's policy, but Mozilla's CA Certificate Policy is here: http://www.mozilla.org/projects/security/certs/policy/
33.
by cscott 18y ago
And this isn't even the first blog post to mention the fact that a CA gave out a cert to unauthorized person... Mike Zusman tested a group of CA issuers and received a cert for Microsoft's live.com and talked about it at Blackhat this year:
34.
by cscott 18y ago
Agreed. However, wouldn't an operational review of certificate issuance activity of the impacted CAs provide another level of assurance that the researchers were the only ones who successfully exploited this vulnerability? I would imagine t
35.
by cscott 18y ago
If all 6 impacted CAs stop signing MD5 signed certs today and no new CAs started, is the risk reduced to the possibility of prior discovery?
36.
by cscott 18y ago
There's an excellent article in the Harvard Business Review that breaks down the relationship between IT and the business depending on two factors: the reliability of IT and the need for IT innovation in the line of business. The result is
37.
by cscott 18y ago
We've implemented plain old MediaWiki in our division. It serves as a document and guidance distribution point to the wider corporate public, as well as an scratch pad for internal procedures and process. Due to the general lack of fine-gra
38.
by cscott 18y ago
The framework is nice, but the two recipes I tried from the site turned out horribly. Willing to accept that I'm an average cook - but the results from similar "standard" recipes were much better.