It seems to me that, considering WoSign and StarCom were when it happened actually the same entity, the things that went wrong should be weighed equally against them. So if only what has happened is relevant, it makes no sense to deal with them separately.
If however what they propose/promise to do is also relevant, then it does make sense to see if they should be treated differently. For that may be where the two differ. CU Hans _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
