Re: [art] Is CT single-use origins or not? (Re: On BCP 190)

[Adam Roach <[e-mail]>]

On 7/24/19 12:40, Jacob Hoffman-Andrews wrote:
> On Wed, Jul 24, 2019 at 9:15 AM Adam Roach <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>        Is the mechanism defined in the "Certificate Transparency
>          Version 2.0" document constrained to run on an origin on
>          which no other services are present?
>
>
> No, definitely not. In practice, that's how people have tended to 
> deploy it, mainly because origins are cheap, and CT's high 
> availability requirements mean you don't want your website maintenance 
> events to cause downtime for your CT log.


Thanks for the clear answer.

Given this information, I would to ask that we *not* focus on the 
question of whether single-use origins can reasonably have more lax 
restrictions than other origins, at least until we figure out the 
question of how to handle the CT document.

To be clear: I'd like the ART community to discuss this topic at some 
point, but I don't want to hold up the CT document on its conclusion. 
This is a request to *defer* the conversation, not a request to abandon it.

/a