Subject: Re: [websec] #55: Clarify that the newest pinning information takes precedence

From: "websec issue tracker" <[email-masked]>
Date: Wed, 27 Mar 2013 22:54:57 -0000

#55: Clarify that the newest pinning information takes precedence

Comment (by [email-masked]):

 Ryan Sleevi has added text to the working copy that I believe resolves
 this ticket. Comments?

 https://code.google.com/p/key-pinning-
 draft/source/diff?spec=svn4f697cf66f747c18a5389922f484d9a1dbe85968&r=83bad3527ede8bb6ef52a8c220990ccd8762d9e7&format=side&path
 =/draft-ietf-websec-key-pinning.xml

-- 
-------------------------------+--------------------------------
 Reporter:  [email-masked]  |       Owner:  [email-masked]
     Type:  defect             |      Status:  assigned
 Priority:  major              |   Milestone:
Component:  key-pinning        |     Version:
 Severity:  -                  |  Resolution:
 Keywords:                     |
-------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/55#comment:2>
websec <http://tools.ietf.org/websec/>

---

From: Tom Ritter <[email-masked]>
Date: Wed, 27 Mar 2013 22:54:00 -0400

" The UA MUST evict all expired Known Pinned Hosts if at any time, an
expired Known Pinned Host exists in the cache"

I use rrdtool to keep 5 years of statistics for my server.  Once, I
accidentally set the date forward, to 2038, wiping out my statistics -
there was no way to recover, because rrdtool dutifully wiped all this
expired data.

Using the word 'evict' seems particularly dangerous, for both active
ntp attacks, and accidental wiping.

-tom

---

From: Yoav Nir <[email-masked]>
Date: Fri, 29 Mar 2013 01:35:13 +0000

The text works for me.

On Mar 27, 2013, at 6:54 PM, websec issue tracker <[email-masked]>
 wrote:

> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec