Re:How not using Internet Explorer put me out of touch and c...
by jasomill on Friday July 13, 2012 @09:02PM
(#4242698)
It's possible that the reason Authenticode doesn't work like this is legal rather than technical: it was deployed at a time when Microsoft was already subject to considerable regulatory scrutiny for a wide variety of alleged anticompetitive practices, so, independent of motivation and technical merits, scary warnings about third-party code not "certified" by Microsoft may have been legally ill-advised.
My family taught me to always do the right thing, which, most of the time, is neither the most convenient nor the most profitable.
It should be trivial to provide a free binary signing service that required some steps to prove the person (or website) is the person asking the binary to be signed (much like Google asks me to upload a file or setup a DNS record) and match the file signature to the URL of the download. Let's not forget every one who would rely on it already paid for a license of Windows.
Of course, this would probably kill download sites, but the internet would be better off without them anyway.