Reason for not publishing list

[serverco]

The way the above has been quoted it makes it look as if I'm an official part of Let's Encrypt and I'm talking about "Our security officers". Can I just point out I have no connection to Let's Encrypt other than a user of their services the same as most people here. The original quote ( if you go back up the thread) is;

@jsha

Here's our methodology to fill in the main part of our blacklist: We started with the Alexa top 1k domains. This was both too aggressive and not aggressive enough. There were a number of domains in that list that we didn't consider high enough risk to prevent issuance.

Our security officers manually reviewed the list to trim the list, ending with less than 200 "names." They're from all categories - banks, shopping, software, online services, and more.

At the same time, we added the notion of "permute." Specifically, there are a number of domains, like "google" or "hotmail," where domain.TLD exists and is registered to the same entity in almost all TLDs. However, in smaller TLDs the domain.TLD may not have enough traffic to wind up in the Alexa top 1k. So we introduce the notion of "permuting" a domain: If we believe a domain to be in this category, we blacklist it in each TLD.

I think it's the case that we've been over-inclusive about which domains get the "permute" treatment for the blacklist. I'll talk with other folks on the team about doing another pass to see which domains really should get that treatment.

@tlussnig

On the other hand we can start an topic to build the list.

Personally I think that's more appropriate that continuing the topic here, if people want to discuss that - as this topic is about "Reasons for not publishing list"