Re: Apple: Patch Management

2019-12-09 Thread Matt Palmer via dev-security-policy
On Fri, Dec 06, 2019 at 07:08:46PM -0800, Apple CA via dev-security-policy wrote: > On Saturday, November 23, 2019 at 3:28:10 PM UTC-8, Matt Palmer wrote: > > [aside: this is how incident reports should be done, IMHO] > > > > On Fri, Nov 22, 2019 at 07:23:27PM -0800, Apple CA via

Re: [FORGED] Re: How Certificates are Verified by Firefox

2019-12-09 Thread Jakob Bohm via dev-security-policy
On 2019-12-09 11:44, Ben Laurie wrote: On Wed, 4 Dec 2019 at 22:13, Ryan Sleevi wrote: Yes, I am one of the ones who actively disputes the notion that AIA considered harmful. I'm (plesantly) surprised that any CA would be opposed to AIA (i.e. supportive of "considered harmful", since it's

Re: [FORGED] Re: How Certificates are Verified by Firefox

2019-12-09 Thread Ben Laurie via dev-security-policy
On Wed, 4 Dec 2019 at 22:13, Ryan Sleevi wrote: > Yes, I am one of the ones who actively disputes the notion that AIA > considered harmful. > > I'm (plesantly) surprised that any CA would be opposed to AIA (i.e. > supportive of "considered harmful", since it's inherently what gives them > the

Re: [FORGED] Re: How Certificates are Verified by Firefox

2019-12-09 Thread Ben Laurie via dev-security-policy
On Mon, 2 Dec 2019 at 20:28, Wayne Thayer wrote: > Why not "AIA chasing considered harmful"? The current state of affairs is > that most browsers [other than Firefox] will go and fetch the intermediate > if it's not cached. This manifests itself as sites not working in Firefox, > and users