-----BEGIN PGP SIGNED MESSAGE----- Commenting on a quote from a magazine about MS's new code-download/wintrust stuff Alan Olsen wrote:
As a web developer, I have some problems with this scheme. Giving Microsoft access to virtually every OLE control on the Web does not make me more secure. Sounds like a way to rip off ideas from the rest of the development world. If someone has a control that might compete with a Microsoft product, it could be shelved and/or delayed for "further security testing".
I think you've been badly misled on this one. I've just been through all of the related specs from the MS INetSDK. While they are still incomplete in places, they look pretty workable to me. In particular the certainly don't suggest that MS would be involved in signing anything. To quote from the beta docs: The present tools therefore allow any user of this development release to authorize themselves as a "Software Publisher" for test purposes and to sign their code, allowing for extensive testing of the tools and code used but not actually providing a secure infrastructure. In future releases, the tools will require software publishers to obtain certificates from companies whose function is to verify the identity of the publishers, providing end-users with a high level of assurance about the authenticity and origin of code that they receive.
Java has a decentralized mechanism for security. No one group controls what is a "certified" control and what is not. You write the code and compile it and that is that. Furthermore, you are not stuck with Microsoft approved platforms. (I wonder if there will ever be a version of Explorer for the Mac.)
The current version (2.0) is already available on the Mac and the 3.0 alpha versions appear to be about equally buggy on both the Win32 and Mac platforms. (I haven't, on the other hand, heard any news of Unix versions. Perhaps Bristol and/or Mainsoft will cover that port.) ================ Here's my quick overview of the specifications in question for those interested. Microsoft is providing the following components: - - A generic trust management called (ever originally) WinTrust. WinTrust provides an API to ask whether a given subject is trusted to perform a specific action. The API is extensible in that multiple 'Trust Providers' can be installed and each can define the types of subjects and actions they manage. The docs define the role of a 'Trust Administrator' who can configure the rules used by the trust provider services be neglect the give the details. - - An implementation of a trust provider called the 'Windows Software Publishing Trust Provider' This provider supports subjects which are executable images and the action of 'being published software'. The decision to trust is based on a PKCS #7 embedded within the executable containing a signed digest from the author and a chain of X.507 certs back to some configurable set of CAs. If the executable is not verified the user is prompted with the offer to approve it manually. - - A set of developer tools for creating your certificate and signing executables. Note that the beta includes a hard-coded root CA key and all certs must trace back to it. The existing library for munging executable images has also been enhanced to support adding, removing, enumerating and retrieving certs from an image as well as reading the stream that should be included in digest calculations. - - A single function solution for browsers and other applications to download, verify, install, and create a class factory for an OLE object given an URL. In the web case the HTML <OBJECT> tag is used to embed an OLE object in a page. The browser tries to create it based on the CLSID attribute (which contains a DCE-ish uuid.) If it fails it calls CoGetClassObjectFromURL() passing in the URL from the CODE attribute of the same tag. This function does all the magic including the WinTrust call from above. (Apparently there will also be support for an 'Internet Search Path' if the CODE attribute isn't specified.) Then of course there is the MS CryptoAPI but that's a discussion for another day. - -Blake (who hasn't worked for Microsoft for years now) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMU/Dirmr67p11D8rAQGHnQP/YI+EjCIcpBF3HQznruVBUkGsZls1ZVTf SRvPJN7n+HrtvQ4WFSyAawsPnhRH183GTrtWAy+yhmmuzA6/Br/+rNJ/q0jSIlZw w+RUsni9H9a7NsO1Y9xPQq//SHODYC0K+1vB6tU8XE56lZf9F0IZ4iP4El4PUWxD 7kXMboN1Nf0= =5eH2 -----END PGP SIGNATURE-----