Subject: [Trans] Mozilla's basic take on Binary Transparency

From: Richard Barnes <[email-masked]>
Date: Tue, 28 Mar 2017 15:21:37 -0400

As I said at the mic, there's some work going on at Mozilla to implement a
form of Binary Transparency, leveraged on top of CT.  Here's the outline:

https://wiki.mozilla.org/Security/Binary_Transparency

---

From: Ben Laurie <[email-masked]>
Date: Wed, 29 Mar 2017 12:48:49 +0100

> https://wiki.mozilla.org/Security/Binary_Transparency

Cool! Are you planning to build this from scratch, or use Trillian (
https://github.com/google/trillian)?

>
>
>
>
> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>
>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 29 Mar 2017 11:35:31 -0400

On Wed, Mar 29, 2017 at 7:48 AM, Ben Laurie <[email-masked]> wrote:

>> As I said at the mic, there's some work going on at Mozilla to implement
>> a form of Binary Transparency, leveraged on top of CT.  Here's the outline:
>>

I'm no longer in a position to speak for Mozilla, but I think the idea was
not to deploy any new logs, but instead just to use the CT logs that exist.

--Richard

---

From: Ben Laurie <[email-masked]>
Date: Thu, 30 Mar 2017 14:06:18 +0100

> not to deploy any new logs, but instead just to use the CT logs that exist.

Hmm. This is not really a scaleable solution. And is exactly why we're
building Trillian.

I realise that its attractive to layer on top of CT, because then you get a
whole ecosystem around the logs for free. But that ecosystem isn't really
interested in your problem. What we really need is for a common ecosystem
around log correctness (i.e. verifying single view, etc), whilst allowing
for independent logs for independent things.

This is one reason I rather like the proposal to do "gossip" by including
STHs in other logs (even logs that are logging different things).