3 ms·
TACK is really cool, but is it still pushed to the vendors? (Or even, are the vendors interested?). I've seen patches floating on github, but alas, not that muc
by syjer 13y ago
TACK is really cool, but is it still pushed to the vendors? (Or even, are the vendors interested?). I've seen patches floating on github, but alas, not that much activity lately.
- tptacek 13y agoThe vendor space, considered seriously, consists of Google, Mozilla, Apple, and Microsoft. Of those four, Google is pushing hardest for CA-compromise countermeasures. Google's current preferred solution is Certificate Transparency. I don't love CT, for reasons very similar to those that the typical HN reader would come up with after reading it, but it's still a step forward. We sponsored development of some TACK code last summer, but none of the browser vendors are itching to integrate TACK. Google has nice things to say about it, but "backburnered" would be a fair summary of where it stands right now.
- syjer 13y agoThank you for the information on the current situation. Well, not to be an opportunist, but let's hope that this kind of incidents will move the adoption of TACK a little bit faster.