(With apologies for the off-topic drift)
On 27/09/2016 12:49, Peter Gutmann wrote:
Jakob Bohm <jb-mozi...@wisemo.com> writes:
This tells me that Firefox OCSP defaults are *insecure* and reaffirms my
impression that Firefox has completely dropped the ball on CRL handling
(Since the security-on setting is for OCSP only).
No, it tells me that the Firefox developers applied common sense (OK, the
people doing Firefox *crypto* applied common sense, the people doing the
Firefox UI are another story altogether).
(Some) People who "do" Firefox UI read this group. If you have
concrete/constructive suggestions, please file bugs or write to more
topical mailing lists - especially if you think there are things we
should do "frontend"-wise to improve the security of end users.
~ Gijs
_______________________________________________
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy
