A popular idea for dealing with 'malformed' HTML is to have the browserswarn users about it (the most recent example I've run across is incomments here ), onthe theory that this will cause authors to make their HTML validate.Unfortunately, doing this is about as useful as showing error pukes towebsite visitors, and for the same reason: it is reporting the problemto the wrong person.

Almost everyone visiting your site is a visitor, not the site's author.It follows that

Everything you never wanted to know about PKI but were forced to findout [PDF]by Peter Gutmann is a set of slides about just that: a pile of the wartsand issues with PKI in general and the SSL model in specific.If you're interested in the whole field, his home page has links to enough additionalpapers to keep you reading for some time.

(From Chris Samuel ,and that in turn from Russell Coker .)

The common SSL model is that you verify someone's good nature bychecking to see that their certificate is signed by an approved CA.For example, if you are verifying that hosts you are connecting toare approved you would make up a CA certificate, then make up a bunchof host certificates and sign them with the CA certificate. When youconnect to a machine, you verify that its certificate is signed by yourCA certificate.

(Except that that's a simplification; you actually need to verify that