Reason for not publishing list

[serverco]

One good reason for hiding such lists is usually security.

The list consists of "high risk" domains .....

@jsha

Here's our methodology to fill in the main part of our blacklist: We started with the Alexa top 1k domains. This was both too aggressive and not aggressive enough. There were a number of domains in that list that we didn't consider high enough risk to prevent issuance.

Our security officers manually reviewed the list to trim the list, ending with less than 200 "names." They're from all categories - banks, shopping, software, online services, and more.

At the same time, we added the notion of "permute." Specifically, there are a number of domains, like "google" or "hotmail," where domain.TLD exists and is registered to the same entity in almost all TLDs. However, in smaller TLDs the domain.TLD may not have enough traffic to wind up in the Alexa top 1k. So we introduce the notion of "permuting" a domain: If we believe a domain to be in this category, we blacklist it in each TLD.

If I had access to that list, and I was not a nice person, I'd look at the list of banks etc, and see where there were any gaps. Was there something that was close enough to a software or online service that would fool people, but not actually on the list, and could I get that domain. I'd then get a cert for that domain.

If the list is not published, I'd have to guess a few times, purchase those other domains etc. and it's much harder for me.