<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>heavenlyhash</author><text>Everyone: Read this.  At least the threat models.&lt;p&gt;Do not assume all software you currently use gets these things right.</text><parent_chain></parent_chain></comment><story><title>The Update Framework</title><url>https://theupdateframework.github.io/</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>wtbob</author><text>From the spec:&lt;p&gt;&amp;gt; Delegated trust can be revoked at any time by the delegating role signing new metadata that indicates the delegated role is no longer trusted.&lt;p&gt;This is a mistake, as it means that a client must receive the new metadata in order to be made aware of the revocation.  The correct approach is either to delegate trust for a particular time period (determining how long is a risk-based decision), or to specify an online trust check (this fails safe).</text><parent_chain></parent_chain></comment><story><title>The Update Framework</title><url>https://theupdateframework.github.io/</url></story>