Re: Vulnurability Disclosure - How does it happen?

2024-05-23 Thread 'Ben Wilson' via dev-security-policy@mozilla.org
Amir, To answer the last question first, Chunghwa Telecom did not disclose this recent attack, but I don't think we have sufficient information from the article to determine the effects of the breach on the CA operations. So without more information, it might be premature to answer the question,

Re: Recent Entrust Compliance Incidents

2024-05-10 Thread 'Ben Wilson' via dev-security-policy@mozilla.org
00 UTC with all > certificates being revoked by 2023-11-26 14:50 UTC, but I don't think > that's correct if that was the case. > > On Friday, May 10th, 2024 at 5:27 PM, 'Ben Wilson' via > dev-security-policy@mozilla.org wrote: > > Here are draft summaries of the additional hist

Re: Recent Entrust Compliance Incidents

2024-05-10 Thread 'Ben Wilson' via dev-security-policy@mozilla.org
gi?id=1802916 > https://bugzilla.mozilla.org/show_bug.cgi?id=1804753 > https://bugzilla.mozilla.org/show_bug.cgi?id=1867130 > > On Tue, May 7, 2024 at 7:59 AM 'Ben Wilson' via > dev-security-policy@mozilla.org > wrote: > > > > Dear Mozilla Community, > > > > Ove

Recent Entrust Compliance Incidents

2024-05-07 Thread 'Ben Wilson' via dev-security-policy@mozilla.org
Dear Mozilla Community, Over the past couple of months, a substantial number of compliance incidents have arisen in relation to Entrust. We have summarized these recent incidents in a dedicated wiki page: https://wiki.mozilla.org/CA/Entrust_Issues. In brief, these incidents arose out of

Re: comment on Entrust_Issues wiki page

2024-05-06 Thread 'Ben Wilson' via dev-security-policy@mozilla.org
All, I hadn't announced this page yet, hoping to reference it in an email currently undergoing internal review. But thanks for your comment. I'll see about posting the email as soon as I can. Thanks, Ben On Mon, May 6, 2024 at 3:58 PM Mike Shaver wrote: > The page lists the following issue: > >

Re: Public Discussion of Acquisition of e-commerce monitoring GmbH by AUSTRIA CARD-Plastikkarten und Ausweissysteme GmbH

2024-04-30 Thread 'Ben Wilson' via dev-security-policy@mozilla.org
Hi Amir, Here is a quick update on this issue, while I continue working on a summary of the discussion concerning the acquisition of e-commerce monitoring by AUSTRIA CARD. Since June 1, 2022, section 3.2 of the Mozilla Root Store Policy (MRSP) has required that ETSI auditors be members of the