Re: An alternate perspective on Symantec

2017-06-08 Thread Gervase Markham via dev-security-policy
On 07/06/17 06:14, userwithuid wrote: > 2. Having Symantec inform their subscribers, as David mentions, is a great > idea. I believe Ryan has pointed out, here or elsewhere, why "must notify customers" requirements are problematic. Gerv ___

Re: An alternate perspective on Symantec

2017-06-06 Thread userwithuid via dev-security-policy
Inspired by David's message, 2 suggestions for the Symantec plan: 1. Mozilla - and ideally Google as well - should clearly and explicitly communicate in the official statement on this that the "new" Symantec will still be strictly monitored even after the current remediation plan has been

Re: An alternate perspective on Symantec

2017-06-06 Thread David E. Ross via dev-security-policy
On 6/6/2017 12:10 PM, Peter Kurrasch wrote: > Over the past months there has been much consternation over Symantec and > the idea of "too big to fail". That is a reasonable idea but makes > difficult the discussion of remedies for Symantec's past behavior: How > does one impose a meaningful

An alternate perspective on Symantec

2017-06-06 Thread Peter Kurrasch via dev-security-policy
Over the past months there has been much consternation over Symantec and the idea of "too big to fail". That is a reasonable idea but makes difficult the discussion of remedies for Symantec's past behavior: How does one impose a meaningful sanction without causing Symantec to fail outright since