When a Signed Java JAR file is not Proof of Trust

[SysAdMini]

http://eromang.zataz.com/2013/03/05/when-a-signed-java-jar-file-is-not-proof-of-trust/

Today, Malware Domain List, reported strange behaviours regarding a Java app executed with the latest version of Java 6.

[dlipman]

I didn't know GoDaddy was a CA.

[SysAdMini]

I didn't know GoDaddy was a CA.

Me too.

[dlipman]

I guess they do.

http://www.godaddy.com/ssl/code-signing-certificate.aspx

I hope its not like Comodo.  I remember a time when we had to have Kishor revoke Comodo certificates used with malware.