<story><title>The Update Framework</title><url>https://theupdateframework.github.io/</url></story><parent_chain></parent_chain><comment><author>heavenlyhash</author><text>Everyone: Read this.  At least the threat models.&lt;p&gt;Do not assume all software you currently use gets these things right.</text></comment>
<story><title>The Update Framework</title><url>https://theupdateframework.github.io/</url></story><parent_chain></parent_chain><comment><author>wtbob</author><text>From the spec:&lt;p&gt;&amp;gt; Delegated trust can be revoked at any time by the delegating role signing new metadata that indicates the delegated role is no longer trusted.&lt;p&gt;This is a mistake, as it means that a client must receive the new metadata in order to be made aware of the revocation.  The correct approach is either to delegate trust for a particular time period (determining how long is a risk-based decision), or to specify an online trust check (this fails safe).</text></comment>