<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class="">If you buy physical stuff on the basis of NewEgg reviews, you will make pretty good buys.</div><div class=""><br class=""></div><div class="">NewEgg has meta reputation for good curation of reviews, and reviews on NewEgg have reputation by being on NewEgg.</div></blockquote>So NewEgg is a trusted third party: I believe the reviews because NewEgg curates them, and I believe that NewEgg does a good (and, importantly) honest job. OK.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">What curation do CAs do? Having CA authorities in the middle does not make the connection to the real world</div></div></blockquote><blockquote type="cite" class=""><div class="">better, it makes it worse.</div></blockquote>If you ask them, they check that someone claiming to be <a href="http://newegg.com" class="">newegg.com</a> really *is* <a href="http://newegg.com" class="">newegg.com</a>. Oh, they let a whole bunch of fakers through - and of course they accept zero liability when you rely on them? You shouldn't trust just ordinary certs - you should look for those special EV certs for which they charge a whole bunch extra - and still accept no liability. (Is anyone really still buying EV certs? It occurs to me that I haven't seen the green outline in quite some time.)</div><div><br class=""></div><div>In any case, whatever curation they do (and there is <span style="font-style: normal;" class="">*some* - several CA's have been blacklisted by the major browser makers for not doing their jobs right) seems to be accepted by most people in most circumstances. And for the most part, it works. It's only those of us who are in the biz who realize just how fragile all this is.</span></div><div><span style="font-style: normal;" class=""><br class=""></span></div><blockquote type="cite" class=""><div class="">If NewEgg and its reviewers were strongly pseudonymous, and their product links were hashes to immutable data or a third party signature to mutable data, it would work even better.</div></blockquote>Realistically ... in what way? Would it be more convenient? Easier for NewEgg too curate? What kinds of attacks, mounted by whom, would these prevent? Who would profit enough from mounting such attacks to make it worthwhile to do so?<br class=""><div class=""><br class=""></div><div class="">Note that sellers on Amazon have allegedly actually bought their own products so that they could (a) pump up the numbers; (b) appear as legitimate reviewers of those actual products. Would your proposals do anything to prevent this?</div><div class=""><br class=""></div><div class=""><div class=""> -- Jerry</div></div><div class=""><br class=""></div></body></html>