Subject: Re: [TLS] fyi: (HTTP) Strict Transport Security and HASMAT (was: Eleven out of every ten SSL certs aren't valid)

From: =JeffH <[email-masked]>
Date: Thu, 01 Jul 2010 11:30:07 -0700

> Chrome also has an STS preloaded list, although it's not a roaring success:
 >
 > http://dev.chromium.org/sts

Yep, and I'd pointed to it at the end of my prior msg.

FWIW, I wouldn't expect such a feature to take of wildly from the start. 
Rather, I expect it to slowly build over time, and I expect the same for usage 
of the security policies (e.g. HSTS) themselves, for a variety of reasons.

E.g. if one just starts emitting HSTS to conforming browsers without testing 
one's site, one just might get DOS'd.

Also, the number of HSTS-implementing browsers in the wild is presently small, 
but will grow with time and bolster the value-prop of setting this sort of policy.

=JeffH
PayPal Internet Standards and Governance Team