Re: Website owner survey data on identity, browser UIs, and the EV UI

2019-10-01 Thread Paul Walsh via dev-security-policy
On Sunday, September 22, 2019 at 7:49:14 AM UTC-7, Gijs Kruitbosch wrote: [snip] > On 22/09/2019 00:52, Kirk Hall wrote: > > (1) *97%* of respondents agreed or strongly agreed with the statement: > > "Customers / users have the right to know which organization is running a > > website if the

Re: Website owner survey data on identity, browser UIs, and the EV UI

2019-10-01 Thread Paul Walsh via dev-security-policy
On Saturday, September 21, 2019 at 6:19:29 PM UTC-7, Ryan Sleevi wrote: > On Sat, Sep 21, 2019 at 7:52 PM Kirk Hall via dev-security-policy < > dev-security-policy@lists.mozilla.org > > wrote: > >> To remedy this, Entrust Datacard surveyed all of

Re: DigiCert OCSP services returns 1 byte

2019-10-01 Thread Wayne Thayer via dev-security-policy
On Tue, Oct 1, 2019 at 3:34 AM Rob Stradling wrote: > > I propose that you update [4] to say that Mozilla won't treat > non-compliance with [4] as an "incident" whilst it remains the case that > the BRs are inconsistent with [4]. > > I could simply move [4] to a "recommended practice" (SHOULD)

Re: Audit Reminders for Intermediate Certs

2019-10-01 Thread Kathleen Wilson via dev-security-policy
Forwarded Message Subject: Summary of October 2019 Outdated Audit Statements for Intermediate Certs Date: Tue, 1 Oct 2019 14:00:16 + (GMT) CA Owner: Government of Taiwan, Government Root Certification Authority (GRCA) - Certificate Name: 行政院醫事憑證管理中心 (HCA) SHA-256

Re: DigiCert OCSP services returns 1 byte

2019-10-01 Thread Rob Stradling via dev-security-policy
On 01/10/2019 00:45, Wayne Thayer via dev-security-policy wrote: > I've initiated a CAB Forum ballot [1] to resolve the inconsistency that Rob > identified. Thanks Wayne. I've offered to endorse. > I also want to acknowledge the feedback from Google on the timing of this. > I can appreciate the