Reluctant enforcers: certificate authorities as malware police

Learning the wrong lessons from Internet Exploder [sic] Previous posts have alluded to the role certificate authorities play— or at least are expected to play when operating effectively— in response to discovery of digitally signed malware. Part of the bargain for inclusion in the Windows code-signing ecosystem is that CAs have an obligation to revoke […]