It is true, that without gossip, CT is dependent on browsers monitoring the log ecosystem, this is one reason why in the Chrome policy the one Google log is required.
I would argue, with the monitoring Google does and the one Google log policy that this risk is mitigated sufficiently, even without gossip. Gossip is needed, as is Firefox's own implementation of CT verification, which is actively in the works, but given the above mitigations I still believe this extra requirement is not necessary. Ryan _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
