Subject: Re: [httpwg/http-extensions] Expect CT: includeSubDomains (#322)

From: HTTP issue updates <[email-masked]>
Date: Fri, 14 Apr 2017 13:15:12 -0700

I've intentionally omitted `includeSubdomains` in Expect-CT. Though I acknowledge that it would be useful to site owners, I don't think we should add it because it considerably increases the size of the footgun, by offering the ability to require CT for subdomains that have never even demonstrated to the UA their CT compliance.

(I also suspect that most site owners would primarily use it as a tool to learn about all their subdomains, which is a use that is somewhat orthogonal to Expect-CT's actual purpose.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/322#issuecomment-294228168

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 14 Apr 2017 14:50:53 -0700

Closed #322.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/322#event-1043841935

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 14 Apr 2017 14:50:53 -0700

That's a reasonable approach, if anyone else needs this they could re-open this issue.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/322#issuecomment-294243494