Re: WISeKey Root Renewal Request

2015-09-09 Thread David Keeler
On 08/05/2015 10:53 AM, Kathleen Wilson wrote: > WISeKey has applied to include the "OISTE WISeKey Global Root GB CA" > root certificate, turn all all three trust bits, and enable EV > treatment. This SHA-256 root cert will eventually replace WISeKey's > SHA-1 root cert that was included in NSS via

Re: Remove Roots used for only Email and CodeSigning?

2015-09-09 Thread Richard Barnes
On Wed, Sep 9, 2015 at 11:43 AM, Hubert Kario wrote: > On Tuesday 08 September 2015 11:08:50 Peter Bowen wrote: > > On Tue, Sep 8, 2015 at 11:04 AM, Kurt Roeckx wrote: > > > On Tue, Sep 08, 2015 at 10:58:39AM -0700, Kathleen Wilson wrote: > > >> 28. Remove Code Signing trust bits. As of Firefox

Re: Remove Roots used for only Email and CodeSigning?

2015-09-09 Thread David E. Ross
On 9/9/2015 8:43 AM, Hubert Kario wrote: > On Tuesday 08 September 2015 11:08:50 Peter Bowen wrote: >> On Tue, Sep 8, 2015 at 11:04 AM, Kurt Roeckx wrote: >>> On Tue, Sep 08, 2015 at 10:58:39AM -0700, Kathleen Wilson wrote: 28. Remove Code Signing trust bits. As of Firefox 38, add-ons are >>>

Firefox security too strict (HSTS?)?

2015-09-09 Thread gulati . au
Dear Moz, sorry to barge in on this topic, which I presume is an existing unpopular topic. I want to ask about Firefox security implementation, possibly HSTS? Firefox seems to implement strict-er security in comparison to Chrome. Our IT department have been making changes to implement SSO inclu

Re: Remove Roots used for only Email and CodeSigning?

2015-09-09 Thread Hubert Kario
On Tuesday 08 September 2015 11:08:50 Peter Bowen wrote: > On Tue, Sep 8, 2015 at 11:04 AM, Kurt Roeckx wrote: > > On Tue, Sep 08, 2015 at 10:58:39AM -0700, Kathleen Wilson wrote: > >> 28. Remove Code Signing trust bits. As of Firefox 38, add-ons are > >> signed using Mozilla's own roots. There do

Re: Remove Roots used for only Email and CodeSigning?

2015-09-09 Thread Kurt Roeckx
On Tue, Sep 08, 2015 at 12:22:27PM -0700, Ryan Sleevi wrote: > On Tue, September 8, 2015 11:04 am, Kurt Roeckx wrote: > > As already pointed out, this is probably at least used by java on > > most Linux distributions. > > When you say "Java", it would be helpful to clarify. > > Oracle/Sun opera