Re: Apple: Patch Management

2019-12-13 Thread Apple CA via dev-security-policy
On Monday, December 9, 2019 at 2:03:20 PM UTC-8, Matt Palmer wrote: > On Fri, Dec 06, 2019 at 07:08:46PM -0800, Apple CA via dev-security-policy > wrote: > > On Saturday, November 23, 2019 at 3:28:10 PM UTC-8, Matt Palmer wrote: > > > [aside: this is how incident reports should be done, IMHO] > >

Re: Apple: Patch Management

2019-12-09 Thread Matt Palmer via dev-security-policy
On Fri, Dec 06, 2019 at 07:08:46PM -0800, Apple CA via dev-security-policy wrote: > On Saturday, November 23, 2019 at 3:28:10 PM UTC-8, Matt Palmer wrote: > > [aside: this is how incident reports should be done, IMHO] > > > > On Fri, Nov 22, 2019 at 07:23:27PM -0800, Apple CA via

Re: Apple: Patch Management

2019-12-06 Thread Apple CA via dev-security-policy
On Monday, November 25, 2019 at 5:32:12 PM UTC-8, Apple CA wrote: > On Saturday, November 23, 2019 at 3:28:10 PM UTC-8, Matt Palmer wrote: > > [aside: this is how incident reports should be done, IMHO] > > > > On Fri, Nov 22, 2019 at 07:23:27PM -0800, Apple CA via dev-security-policy > > wrote:

Re: Apple: Patch Management

2019-11-25 Thread Apple CA via dev-security-policy
On Saturday, November 23, 2019 at 3:28:10 PM UTC-8, Matt Palmer wrote: > [aside: this is how incident reports should be done, IMHO] > > On Fri, Nov 22, 2019 at 07:23:27PM -0800, Apple CA via dev-security-policy > wrote: > > We did not have an accurate understanding of how the vulnerability

Re: Apple: Patch Management

2019-11-23 Thread Matt Palmer via dev-security-policy
[aside: this is how incident reports should be done, IMHO] On Fri, Nov 22, 2019 at 07:23:27PM -0800, Apple CA via dev-security-policy wrote: > We did not have an accurate understanding of how the vulnerability scanner > worked. Our understanding of its capabilities lead us to believe it was >

Apple: Patch Management

2019-11-22 Thread Apple CA via dev-security-policy
On November 22, Apple submitted an incident report: https://bugzilla.mozilla.org/show_bug.cgi?id=1598829, which is reposted below. Incident Report 1. How your CA first became aware of the problem (e.g. via a problem report submitted to your Problem Reporting Mechanism, a discussion in