Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

it seems more ad-hoc, bounty-driven , rather than systematic. is that a fair perspective?


I wish there were bounties :-)

There is systematic checking - e.g. crt.sh continuously runs linters on certificates found in CT logs, I continuously monitor domains which are likely to be used in test certificates (e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=1496088), and it appears the Chrome root program has started doing some continuous compliance monitoring based on CT as well.

But there is certainly a lot of ad-hoc checking by community members and academics, which as Sleevi said is one of the great things that CT enables.


Thanks for highlighting that— and for the efforts to assemble this project. Honestly before this post about the CT logs i hadn’t been aware of systematic auditing being done.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: