Re: ssl authentication [was (another) WebKit port of Browse]

2008-07-13 Thread Martin Langhoff
On Mon, Jul 14, 2008 at 10:44 AM, Ivan Krstić <[EMAIL PROTECTED]> wrote: > On Jul 12, 2008, at 11:59 PM, Dirk-Willem van Gulik wrote: >> Which IDMR - the sun one with all the usual/heavily standardized >> industry protocols - or something OLPC specific ? > > > It's not a protocol, just a small Pyth

Re: ssl authentication [was (another) WebKit port of Browse]

2008-07-13 Thread Ivan Krstić
On Jul 12, 2008, at 11:59 PM, Dirk-Willem van Gulik wrote: > Which IDMR - the sun one with all the usual/heavily standardized > industry protocols - or something OLPC specific ? It's not a protocol, just a small Python script that does some XML-RPC nonsense from what I recall. -- Ivan Krstić <

Re: ssl authentication [was (another) WebKit port of Browse]

2008-07-12 Thread Dirk-Willem van Gulik
On 8 jul 2008, at 11:46, Carol Lerche wrote: > >> - change the "Registration" protocol to grab the public part of > the .. > There aren't any, unfortunately. I had to read idmgr to understand the > protocol - so read the source. It is a trivial xml-rpc. Which IDMR - the sun one with all the us

Re: [sugar] ssl authentication [was (another) WebKit port of Browse]

2008-07-08 Thread Ivan Krstić
On Jul 8, 2008, at 5:31 PM, Carol Lerche wrote: > This is an assertion, not an argument. It is also factually > incorrect. I have no interest in arguing with you; you're obviously free to ignore my advice. -- Ivan Krstić <[EMAIL PROTECTED]> | http://radian.org __

Re: [sugar] ssl authentication [was (another) WebKit port of Browse]

2008-07-08 Thread Martin Langhoff
On Tue, Jul 8, 2008 at 6:31 PM, Carol Lerche <[EMAIL PROTECTED]> wrote: > This is an assertion, not an argument. It is also factually incorrect. And needless to argue over it if we can get instead some working code. :-) m -- [EMAIL PROTECTED] [EMAIL PROTECTED] -- School Server Architect

Re: [sugar] ssl authentication [was (another) WebKit port of Browse]

2008-07-08 Thread Carol Lerche
Ivan writes:: While you may believe the setup you have in mind is easy and uncomplicated, the odds are *overwhelmingly*, **super-stunningly** stacked against you to make PKI work the way you want in production. The fact that TLS client certs, in particular, have zero commercial end-user deployment

Re: [sugar] ssl authentication [was (another) WebKit port of Browse]

2008-07-08 Thread Ivan Krstić
On Jul 8, 2008, at 2:46 PM, Carol Lerche wrote: > I am puzzled about the PKI infrastructure you envision. I envision > having a > private certificate authority that runs on the teacher's XO and > keeps its > keystore on a USB thumb drive. To summarize for those who haven't heard me rant about

ssl authentication [was (another) WebKit port of Browse]

2008-07-08 Thread Carol Lerche
> > I am puzzled about the PKI infrastructure you envision. I envision > having a > > private certificate authority that runs on the teacher's XO and keeps its > > keystore on a USB thumb drive. So my favorite CA tool is TinyCA > (currently > > version2) which is written in Perl. This works very