Re: Symantec Issues doc updated

2017-04-12 Thread Gervase Markham via dev-security-policy
On 11/04/17 23:07, Jakob Bohm wrote: > Please consider the fact that this is Easter week, and most of the > industry, including many people (on both the Browser and Symantec sides > of the process) are likely to be unavailable for precisely this week of > the entire year. > > In general, sending

Re: Symantec Issues doc updated

2017-04-11 Thread Jakob Bohm via dev-security-policy
On 11/04/2017 18:53, Gervase Markham wrote: On 11/04/17 17:34, Ryan Sleevi wrote: Can you clarify what issues you believe this to be related? That is a fair question. And also hard work to answer :-) Given that Symantec has a routine habit of exceeding any reasonable deadline for response,

Re: Symantec Issues doc updated

2017-04-11 Thread urijah--- via dev-security-policy
>Within a few days of discovering these issues they shut down their >entire RA program. That seems pretty swift and comprehensive to me. The >fact that they didn't discover these issues for years is clearly a >problem, but it's not the same problem. I don't believe that's a fair

Re: Symantec Issues doc updated

2017-04-11 Thread Ryan Sleevi via dev-security-policy
On Tue, Apr 11, 2017 at 12:53 PM, Gervase Markham via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > > "to specifically address the > > GeoRoot audit status and remediation plan" - this was not reflected > within > > https://www.symantec.com/content/en/us/about/media/ >

Re: Symantec Issues doc updated

2017-04-11 Thread Gervase Markham via dev-security-policy
On 11/04/17 17:34, Ryan Sleevi wrote: > Can you clarify what issues you believe this to be related? That is a fair question. And also hard work to answer :-) > Given that Symantec has a routine habit of exceeding any reasonable > deadline for response, at what point do you believe it is

Re: Symantec Issues doc updated

2017-04-11 Thread Ryan Sleevi via dev-security-policy
On Tue, Apr 11, 2017 at 6:49 AM, Gervase Markham via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > I have attempted to integrate the information provided by Symantec into: > https://wiki.mozilla.org/CA:Symantec_Issues > and started to draw some conclusions where that is

Symantec Issues doc updated

2017-04-11 Thread Gervase Markham via dev-security-policy
I have attempted to integrate the information provided by Symantec into: https://wiki.mozilla.org/CA:Symantec_Issues and started to draw some conclusions where that is warranted. There are of course still open questions from myself, Ryan and others, and so the truth relating to some incidents is