Re: Skipping DNS resolutions with ORIGIN frame

On Mon, Jul 17, 2017 at 10:40 AM, Emily Stark <estark@google.com> wrote:

> Do you mean literally comes with a single SCT? Or complies with the
> client's CT policy (which might require multiple SCTs)? Is it reasonable to
> assume that all clients implementing ORIGIN will also implement CT?
>

Thanks Emily.

I think you're right that we mean SCT policy. I also wonder if we shouldn't
say something like "if the origin doesn't meet the client's  ct/revocation
requirements it[*] MUST be ignored" rather than having the client do the
DNS lookup.. it seems to me like that could leak some domain names for
little value.

[*] it here means the origin in the origin frame... not blacklisting that
origin from the whole client :)


>