Re: [Sks-devel] keyserver.cns.vt.edu updates

[Matthew Palmer]

On Fri, Oct 14, 2011 at 02:42:39AM -0400, Robert J. Hansen wrote:
> On 10/14/2011 1:39 AM, oakwhiz wrote:
> > In my opinion, you're better off with a self-signed certificate,
> > because you cannot trust the certificate authorities not to sign a
> > fake certificate for use in a man-in-the-middle attack.
> 
> Although there are certainly some unreliable CAs (Diginotar as an
> obvious example), I think it's a leap to go from that to saying there
> exist *no* reliable CAs.

We're getting a bit off-topic here, but the problem is that it only takes
one unreliable-but-widely-trusted CA to sign a cert for your site and you're
just as hosed as if there *aren't* any reliable CAs.  If, on the other hand,
you *can* tie down trust to a single CA certificate (say you're running a
closed system with known clients), then you can just create and use your own
local CA, and avoid the whole commercial CA scam to begin with.

- Matt