Subject: RE: [Asrg] Cert-based Spam Fighting (rant)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 12 Mar 2003 08:54:58 -0800

> <rant>
> I'm all for the use of PKI to solve the world's problems... but... 
> the fact is that the current implementations of S/MIME in off the 
> shelf email products is worse than any implementation I've ever seen.

Please support that accusation with facts.

Netscape, Microsoft and Lotus have interoperated for at least five
years. If you have evidence of incompatibility then please state
the errors so they can get fixed.

There may be some problems with the products of some of the self
styled 'PKI product vendors', some of whom insisted on using obscure
features. However there has never been a problem amongst the
major application vendors that did not get addressed swiftly
once identified.

PKI works fine, just stay clear of X.500 and LDAP.

	Phill

---

From: [email-masked]
Date: Wed, 12 Mar 2003 14:39:51 -0500

> the errors so they can get fixed.

<RANT>
And *HOW* many years did Microsoft products *interoperate* before somebody
pointed out the completely b0rked implementation of basic constraints?

How many years did a lot of SNMP products *interoperate* before major holes
in the ASN.1 parser were revealed?
</RANT>

Software that interoperates with things that play nice isn't secure, it's only
interoperable.  For security, you need the *additional* constraint that it
refuse to talk to things that are trying to lead it astray.

-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech