GTS - OCSP serving issue 2020-04-09

2020-04-14 Thread Andy Warner via dev-security-policy
ing and CRL data was correct during the same period. No additional improvements are outstanding at this time. -- Andy Warner Google Trust Services smime.p7s Description: S/MIME Cryptographic Signature ___ dev-security-policy mailing list

Re: DigiCert OCSP services returns 1 byte

2019-09-23 Thread Andy Warner via dev-security-policy
year misses the much shorter timeline that needs to be honored for CAA. -- Andy Warner Google Trust Services On Mon, Sep 23, 2019 at 3:57 PM Kurt Roeckx wrote: > On Mon, Sep 23, 2019 at 02:53:26PM -0700, Andy Warner via > dev-security-policy wrote: > > > > 1. The new text added t

Re: DigiCert OCSP services returns 1 byte

2019-09-23 Thread Andy Warner via dev-security-policy
the severity of the issue.  -- Andy Warner Google Trust Services On Monday, September 23, 2019 at 9:21:26 AM UTC-7, Dimitris Zacharopoulos wrote: > On 2019-09-23 5:00 μ.μ., Ryan Sleevi via dev-security-policy wrote: > > No. That’s the more dangerous approach which I’ve tried repeatedly to >

Re: DigiCert OCSP services returns 1 byte

2019-09-20 Thread Andy Warner via dev-security-policy
alance convergence versus a rush to decisions that may adversely affect the ecosystem or be a challenge to live with for years. -- Andy Warner Google Trust Services On Friday, September 20, 2019 at 1:20:02 PM UTC-7, Curt Spann wrote: > This is a great discussion and I want to thank everyone fo

Re: Google Trust Services - CRL handling of expired certificates not fully compliant with RFC 5280 Section 3.3

2019-09-13 Thread Andy Warner via dev-security-policy
oogle Trust Services considers this matter fully addressed. We will of course continue our ongoing internal review program, but no other work or information is outstanding at this point. -- Andy Warner Google Trust Services On Friday, August 30, 2019 at 2:39:51 PM UTC-4, Andy Warner wrote: > Th

Google Trust Services - CRL handling of expired certificates not fully compliant with RFC 5280 Section 3.3

2019-08-30 Thread Andy Warner via dev-security-policy
This is an initial report and we expect to provide some additional details and the completion timeline after a bit more verification and full deployment of in-flight mitigations. We are posting the most complete information we have currently to comply with Mozilla reporting timelines and will fo

Re: Google Trust Services - Minor SCT issue disclosure

2018-08-24 Thread Andy Warner via dev-security-policy
evolving the code to the point it became more complicated than it needed to be. On Thu, Aug 23, 2018 at 9:40 AM Ryan Sleevi wrote: > > > On Thu, Aug 23, 2018 at 8:50 AM, Andy Warner via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: >> >> * NOTE:

Re: Google Trust Services - Minor SCT issue disclosure

2018-08-23 Thread Andy Warner via dev-security-policy
tools to further ensure that we have strong knowledge of the pedigree of all code and how it was built and deployed. On Thu, Aug 23, 2018 at 10:55 AM Nick Lamb wrote: > On Thu, 23 Aug 2018 05:50:05 -0700 (PDT) > Andy Warner via dev-security-policy > wrote: > > > May 21st 20

Re: Google Trust Services - Minor SCT issue disclosure

2018-08-23 Thread Andy Warner via dev-security-policy
usion rules and have more flexible tests. I want to discuss this with the engineer who implemented the changes to ensure they agree with how I would summarize the changes. Update to follow. On Thu, Aug 23, 2018 at 8:57 AM Alex Gaynor wrote: > Hi Andy, > > Just so I follow, this is some

Google Trust Services - Minor SCT issue disclosure

2018-08-23 Thread Andy Warner via dev-security-policy
Please note, Google wrote this report for internal use immediately after the issue. We intended to post it to m.d.s.p at that time, but securing internal approvals took a while and the posting ended-up on the back burner for a bit. It was a minor issue, but we want the community to be aware of i

Re: CAs not compliant with CAA CP/CPS requirement

2017-09-09 Thread Andy Warner via dev-security-policy
Google Trust Services published updated CP & CPS versions earlier today covering CAA checking. I'd suggest checking all CAs again tomorrow. Given the range of timezones CA operational staffs operate across, some may not have had a chance to publish their updates yet. In terms of the 'rush' I su

Re: Incidents involving the CA WoSign

2016-09-03 Thread Andy Ligg
manager of StartCom Europe that Eddy announced this in CABF mail list. Regards, Andy On 2016/9/3 16:17, Percy wrote: I did an analysis of the new StartCom website and determined that it was designed and implemented solely in China. http://www.percya.com/2016/09/startcom-operated-solely-in

Re: Firefox security too strict (HSTS?)?

2015-11-05 Thread Andy
It might for you but maybe something between you're system and hers is different so it works for you but not for her as my sig line says iam a computer tech i build sell service and consult. sometimes you can have to 2 identical systems side by side and one will work fine and the other has proble