News for hackers. Stuff that matters.

A comment on Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate. Parent comment

Re:Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate by bradleyjg on Monday November 14, 2016 @06:09PM (#12954199)
The Chrome team was able to fix this within 24 hours by remotely disabling CT enforcement in Chrome. (When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system.)

After reading the blogpost, it seems like it was working as intended. Why "fix" it?

[ Parent | on HN ]
Re:Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate by agwa on Monday November 14, 2016 @07:01PM (#12954486)
The expiration was designed back when Certificate Transparency was only required to make Extended Validation certificates display a green bar. The intention was never to make certificates fail entirely when a Chrome build was more than 10 weeks old. Now that CT is being used for more than just a green bar, the log list expiration is being revisited.
[ Parent | on HN ]