[{"url":"https://api.github.com/repos/mozilla/crlite/issues/comments/5999315092","html_url":"https://github.com/mozilla/crlite/issues/391#issuecomment-5999315092","issue_url":"https://api.github.com/repos/mozilla/crlite/issues/391","id":5999315092,"node_id":"IC_kwDOB9GFrc8AAAABZZZIlA","user":{"login":"jschanck","id":25615540,"node_id":"MDQ6VXNlcjI1NjE1NTQw","avatar_url":"https://avatars.githubusercontent.com/u/25615540?v=4","gravatar_id":"","url":"https://api.github.com/users/jschanck","html_url":"https://github.com/jschanck","followers_url":"https://api.github.com/users/jschanck/followers","following_url":"https://api.github.com/users/jschanck/following{/other_user}","gists_url":"https://api.github.com/users/jschanck/gists{/gist_id}","starred_url":"https://api.github.com/users/jschanck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschanck/subscriptions","organizations_url":"https://api.github.com/users/jschanck/orgs","repos_url":"https://api.github.com/users/jschanck/repos","events_url":"https://api.github.com/users/jschanck/events{/privacy}","received_events_url":"https://api.github.com/users/jschanck/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-10-05T17:09:26Z","updated_at":"2026-10-05T17:09:26Z","body":"> 1. When is the next full filter due? The current snapshot is 2 September; the Clubcards paper describes one about every 22 days.\n\nOctober 17. Full filters are published every 45 days.\n\n> 2. Is 37 of 108 in line with what your telemetry shows for `crlite_status` on recently revoked certs?\n\nIt's not possible to make a comparison with the telemetry that we collect.\n\n> 3. Are you tracking how many newly issued certificates still carry only 24h-log SCTs?\n\n32% of certificates validated by Firefox clients have an SCT from a static CT log. So 68% carry SCTs from RFC 6962 logs exclusively. I don't know how this corresponds with the actual percentage of certificates with/without an SCT from a static CT log. All of my data is influenced by browsing behavior.\n\n> 4. Is there a plan to carry uncovered revocations in a later delta once their coverage window closes, rather than waiting for the snapshot?\n\nNo, this problem will resolve itself once CAs begin embedding static CT SCTs by policy.\n\n> 5. The coverage list has 44 of the 68 logs currently qualified by Google and Apple; Cloudflare Raio, Geomys Trastevere and GoDaddy Aquamarine are absent. Intended? None of our 465 certs was logged only to those, but CAs are moving.\n\nWe manually review additions to CRLite's log list. I just approved several Trastevere and Aquamarine logs. CRLite will begin ingesting them shortly.\n\n> 6. Should \"all certificate revocations\" be read as desktop only, given Android's compat channel carries three reason codes?\n\nYes.\n","author_association":"COLLABORATOR","pin":null,"reactions":{"url":"https://api.github.com/repos/mozilla/crlite/issues/comments/5999315092/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null}]