Subject: [httpwg/http-extensions] Expect-CT reports should indicate failure mode (report only or enforcing) (#417)

From: HTTP issue updates <[email-masked]>
Date: Sun, 12 Nov 2017 16:20:03 +0000 (UTC)

>From an operational perspective, site operators need to be able to distinguish if Expect-CT failure  caused access to the site to be denied. In any organisation of non-trivial size it's likely that there will be a mixture of sites with report-only and enforcing policies. Thus, not all reports are equal. A failure of enforcing Expect-CT needs to be treated with urgency and perhaps an immediate action. Failures of report-only policies are not urgent and can be reviewed from time to time during normal working hours.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/417