On Friday, 10 May 2019 19:00:11 UTC+2, Wayne Thayer wrote: ...
> I share the concern that option #2 sends a confusing message. As Jonathan > stated, why should we distrust a CA for all but the most important websites > they secure? I'd say that both "too big to fail" and "too important to fail" are not particularly good reasons for trusting something/somebody. It's understandable that as a browser you'd want to limit the collateral damage of distrusting a CA, but your first priority should definitely be limiting the possible damage from trusting a CA that has turned out not to be trustworthy. CU Hans _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
