RE: Certificate Revocation in Java

Ben,

Our charter here (as with the rest of the W3C) is concerned with the Open Web Platform, specifically technologies usually implemented in browsers to secure web applications (typically written in HTML + CSS + JavaScript).

While plugins like Java are a part of the Web, their behavior and features are proprietary, not specified by the W3C.

Thanks,

Brad Hill

From: Ben Wilson [mailto:ben@digicert.com]
Sent: Wednesday, March 06, 2013 8:40 AM
To: public-webappsec@w3.org
Subject: Certificate Revocation in Java

Is this within the scope of your charter / domain?
Malicious applet using stolen code signing cert still installs because Java has revocation checking turned off by default.
http://www.net-security.org/secworld.php?id=14557