Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory.
Like it seems your disagreement is that you're pointing out there are systems today that trust WebPKI CAs but don't validate CT/SCTs. I'd agree that that's an issue and I want those systems to join the world where CT exists.
As I said, in a world with CAA records and CT logs, this isn't an issue. If your CA wants to be in root trust stores, you have to put your certs in CT logs. CAA records are "advisory" in the sense that we mandate that root-trusted CAs obey CAA records and that they write cert issuance to CT logs, so a trusted CA that violates CAA records has to tell on itself in a very detectable way.
I'm just not sure that I can see a world where all devices that rely on TLS/PKI are capable of CT SCT validation. Look at the issues we have around stale root stores still happening when we have validity periods of literally decades. Some of these clients out there simply won't ever be able to keep their trusted log store updated.
Similarly to vaccines, part of the magic is that you don't need "all", you just need "most".
Right now CT support is rough for things outside of browsers; it's a pretty fair bet that if you pick up a command line tool or library, it is not checking SCTs, and that makes those workflows vulnerable. If we flipped that, and the average command line tool or library did validate by default, it would dramatically alter the risk calculus for attackers.
For a scenario like this it doesn't help a given client what % of the ecosystem does SCT validation or not, all that matters is whether that client does it.
I agree that more SCT validation across the ecosystem reduces the value of a mis-issued certificate to an attacker, but a lot of value still remains.
If 90% of clients did SCT validation, an attacker can still succeed against the 10% that don't, there's no herd immunity.
> In a world [where] CT logs and CAA records [exist]
And we are in that world. CT logs and CAA records exist. They are around. What you are implying you said is:
> In a world with CT logs and CAA records [and everyone/everything reads and validates them]
We are not in that world, and we probably won't enter that world for the next 15 to 20 years because we are also in a world where folks expect networked devices to be able to communicate (mostly) securely without constantly communicating with a centralized set of clearinghouses arbitrating "what is secure".
As we are discovering, our flawed systems may need broader rethinking, especially if we want secure communication (with all the epistemological ball of yarn that comes with it) without constant total centralization, which seems to be the approach-of-least-resistance lately.
Yeah — science is seemingly only just getting into the question of how much of an inner life bumblebees and other solitary bees might have.
There's a lot of surprising things about them, like puzzle solving, some evidence of a capacity for play and the ability to select food not just for nutrition but for apparent enjoyment.
Owls don't really have to be smart. They just need to be quick, ferocious, and murderous. Evolution only selects for intelligence when necessary as it's metabolically expensive.
So, would most people, and this would mean that very little housing would be built, very little health care provided, and very little food grown or harvested.
well I'd be willing to help build housing, provide health care, and grow food as needed given the stability it provides
right now my contract is more or less "we'll keep paying you if you continue providing us with the arbitrary value we require" which is certainly more difficult to reckon with
Code that has been tested and hardened for years? Code that is now being audited and patched quickly with the help of LLMs? Why would I worry more about such a code base than something new and not time tested?
Essentially I wanted fgciwrap to be able to accept arbitrary response bodies without headers, so I could use it with programs that weren't actually made for cgi. Lighttpd supports this but apparently that's an happy accident.
reply