Subject: Re: Certificate / CPS issues

From: "Haren Visavadia" <[email-masked]>
Date: Wed, 11 Jun 2003 08:07:45 +0100

> Why are keystore components written by Microsoft peculiarly unworthy
of
> trust?

There was a flaw in IE, although it has been fixed, the flaw allows the
attackers to delete certificates from the keystore without any user
notification.

How can trust IE, it there is some very serious flaws like this one?

You cannot.

Also, have heard about Microsoft's Anti-Trust.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 11 Jun 2003 13:07:29 +0200

Haren writes:

> There was a flaw in IE, although it has been fixed ...

Since it has been fixed, where's the problem?

> How can trust IE, it there is some very serious

There are very serious flaws in just about all software; I have not
encountered any exceptions outside the very tiny world of rigorously
verified software, such as that traditionally used by NASA (not anymore),
and even that could still contain a bug.

Most commercial software today is riddled with bugs, because people won't
buy software that is bug-free, but they will buy software that is
feature-rich.  So that's what vendors provide.

> Also, have heard about Microsoft's Anti-Trust.

Antitrust refers to prevention of abuse of monopolistic dominance of a
market; it has nothing to do with trust in the sense of, say, PKI.  Overall,
Microsoft is much more trustworthy than average in this latter domain,
because it has to be--many eyes are watching, and any loss of reputation
could be catastrophic.