Re: [Trans] Gossip: Unsticking a client caught with potential evidence of log misbehavior

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Thu, 22 October 2015 22:49 UTC

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Ben Laurie <benl@google.com>, Tom Ritter <tom@ritter.vg>, Linus Nordberg <linus@nordu.net>
In-Reply-To: <CABrd9SSeb=sHYDphJSWvF+ROBEdsrfDfOLSTyHDHuRvOz_RobA@mail.gmail.com>
References: <CA+cU71m0wpnD1ZYOTtr=oW+1BjquFxyagtMt+wgCgC_PD0PE-g@mail.gmail.com> <CABrd9SQd2RETKQWe9-_KCHufAWjBhs2k008vEz-5cyM_gbY4Qw@mail.gmail.com> <E1812BE0-BD94-4050-95DB-C0483303AFF2@isoc.org> <CABEqWMC=pJUMEn8DxxTn6VTBs9hpayC-ZVUwcGdvg=PEw-Q=Rg@mail.gmail.com> <CALzYgEfsEOyuo9Ez2JqoMJ=WzZ3mFY+eTe6L2F6ZSLJEiVJAJQ@mail.gmail.com> <CA+cU71=YMq3jJhdnv_CqmteUhRnnxYmbpjQ=hN0DhFbBoy+ERg@mail.gmail.com> <CALzYgEcnW-Gm5jjv3cGj-MTPO9TA2u8sVpuJU8ML8dPi-ynKRA@mail.gmail.com> <87fv142urp.fsf@nordberg.se> <CA+cU71=s9fkKxYF47mYRnejLexsE2x924Dm+sU=fckzKKPdE4A@mail.gmail.com> <CABrd9SSeb=sHYDphJSWvF+ROBEdsrfDfOLSTyHDHuRvOz_RobA@mail.gmail.com>
User-Agent: Notmuch/0.20.2 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-pc-linux-gnu)
Date: Thu, 22 Oct 2015 18:48:42 -0400
Message-ID: <87611ybjud.fsf@alice.fifthhorseman.net>
MIME-Version: 1.0
Content-Type: text/plain
Archived-At: <http://mailarchive.ietf.org/arch/msg/trans/4gNUHwixYW0JqQgqEC-fLRXzRfs>
Cc: Katriel Cohn-Gordon <me@katriel.co.uk>, Robin Wilton <wilton@isoc.org>, Eran Messeri <eranm@google.com>, "trans@ietf.org" <trans@ietf.org>
Subject: Re: [Trans] Gossip: Unsticking a client caught with potential evidence of log misbehavior
Precedence: list

On Thu 2015-10-22 06:23:35 -0400, Ben Laurie wrote:
> On Thu, 22 Oct 2015 at 03:16 Tom Ritter <tom@ritter.vg> wrote:
>> On 21 October 2015 at 08:52, Linus Nordberg <linus@nordu.net> wrote:
>> > Impractical since the browser would have to know which domain that
>> > example.com has delegated its SCT Feedback to.
>>
>> This is an engineering problem I don't see a neat solution to. So
>> obviously the solution is a new HTTP header! SCT-Feedback:
>>
>> https://uncle-neds-discount-hanggliding-and-sct-feedback-correlator.website/google.com/
>> ;)
>
> Quite so.

I can't tell how much people are kidding around here -- i see Tom's
winky emoticon, at least.

But which version of the site should get to declare where the delegation
should happen -- the version that has the bogus cert with SCTs from the
colluding logs, or the "real" version?

     --dkg

[Trans] Gossip: Unsticking a client caught with p… Tom Ritter
Re: [Trans] Gossip: Unsticking a client caught wi… Ben Laurie
Re: [Trans] Gossip: Unsticking a client caught wi… Robin Wilton
Re: [Trans] Gossip: Unsticking a client caught wi… Katriel Cohn-Gordon
Re: [Trans] Gossip: Unsticking a client caught wi… Eran Messeri
Re: [Trans] Gossip: Unsticking a client caught wi… Tom Ritter
Re: [Trans] Gossip: Unsticking a client caught wi… Eran Messeri
Re: [Trans] Gossip: Unsticking a client caught wi… Ben Laurie
Re: [Trans] Gossip: Unsticking a client caught wi… Linus Nordberg
Re: [Trans] Gossip: Unsticking a client caught wi… Tom Ritter
Re: [Trans] Gossip: Unsticking a client caught wi… Ben Laurie
Re: [Trans] Gossip: Unsticking a client caught wi… Ben Laurie
Re: [Trans] Gossip: Unsticking a client caught wi… Daniel Kahn Gillmor
Re: [Trans] Gossip: Unsticking a client caught wi… Tom Ritter
Re: [Trans] Gossip: Unsticking a client caught wi… Ben Laurie
Re: [Trans] Gossip: Unsticking a client caught wi… Ben Laurie