Comment by aaomidi
3 years ago
> but the tldr is that all SCT-checking clients have to be able to respond to ecosystem changes very quickly.
This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway.
I'd like to see a separate package, similar to Mozilla's `ca-certificates`, but for CT that can be updated independently of the actual useragent.
> This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway.
People should do this, but in practice it often doesn't happen - as witnessed by the Appmattus library fiasco earlier this year.
> I'd like to see a separate package, similar to Mozilla's `ca-certificates`, but for CT that can be updated independently of the actual useragent.
Considering how slowly updates to the various ca-certificates packages propagate, this would be absolute disaster for CT.