On 14/11/16 14:00, Peter Bowen wrote: > It is very easy to mint TCSCs at scale without violating the letter or > the spirit of the BRs and other requirements.
I guess I didn't mean to imply that it was hard or easy, only that it hasn't been done so far. But I did wonder about auditors witnessing key ceremonies - would that be a necessary component? Does that make things more complicated? > I think this is the right answer. Well, one can always say this but, policies aside, the impact of a change is measured by the amount of breakage it actually causes, and not by the amount that you can predict in advance. That doesn't mean it's not the right answer, it might just mean that our ability to predict the impact of changes is now much better but still less than perfect, and we have to accept that. > Yes, CT has helped provide a better > view into galaxy of CAs that is WebPKI, that was not its stated > purpose. CT was created to help domain registrants have visibility > into what is issued for their domain names. If domain holders want to > keep their certificates semi-private, then they need to be aware that > security is a moving target and their input on data-driven decisions > may be diminished. (And that because anyone can submit a cert to CT, this privacy may not be as total as they would like anyway.) Gerv _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
