undefined | Better HN

0 pointsgojomo11y ago0 comments

It looks to me like the Chromium team did choose the size of the lifeboat: it's a Google-designed feature (CRLSet) based on another Google-designed feature (auto updates).

0 comments

tptacek11y ago

Then you simply don't understand what the CRLset revocation system is, or why it works the way it does.

gojomoOP11y ago

Then correct me, don't insult me.

Isn't CRLSet a Google invention? Doesn't it depend on Chrome software updates?

All I know about it, I read from Langley's writings. Is there a better reference?

Who set the implemntation limits, if not Google?

Maybe those limits are justifiable, but that doesn't leave someone who's left unprotected, by what seem like arbitrary policy cutoffs, feeling any better.

tptacek11y ago

Your feelings aren't material to the issue at hand. You're not supposed to feel good about CRLsets.

Google didn't invent this idea. It was suggested by the CABForum.

CRLsets are static, practically hardcoded revocations that every installation of Chrome receives. The idea that https://yourblog.com should expect specific consideration in Chrome updates is about as reasonable as suggesting that we revert back from the DNS to host files.

1 more reply

j / k navigate · click thread line to collapse

0 comments

tptacek11y ago

Then you simply don't understand what the CRLset revocation system is, or why it works the way it does.

gojomoOP11y ago

Then correct me, don't insult me.

Isn't CRLSet a Google invention? Doesn't it depend on Chrome software updates?

All I know about it, I read from Langley's writings. Is there a better reference?

Who set the implemntation limits, if not Google?

Maybe those limits are justifiable, but that doesn't leave someone who's left unprotected, by what seem like arbitrary policy cutoffs, feeling any better.

tptacek11y ago

Your feelings aren't material to the issue at hand. You're not supposed to feel good about CRLsets.

Google didn't invent this idea. It was suggested by the CABForum.

1 more reply

j / k navigate · click thread line to collapse