Re: Remediation Plan for WoSign and StartCom

2016-10-17 Thread Percy
> I’m not sure what I could reasonably require (and enforce) of the CA in > regards to communicating with their customers. > I recall that my security blog about CNNIC got censored in China, so I'm not > sure what Mozilla can do about informing the CA's customers of this pending >

Re: StartCom & Qihoo Incidents

2016-10-17 Thread Jakob Bohm
On 18/10/2016 01:22, Kurt Roeckx wrote: On Tue, Oct 18, 2016 at 12:39:42AM +0200, Kurt Roeckx wrote: On Tue, Oct 18, 2016 at 12:22:21AM +0200, Jakob Bohm wrote: Over the past few years, this has caused the Mozilla root list to become less and less useful for the rest of the open source world,

Re: StartCom & Qihoo Incidents

2016-10-17 Thread Kurt Roeckx
On Tue, Oct 18, 2016 at 12:39:42AM +0200, Kurt Roeckx wrote: > On Tue, Oct 18, 2016 at 12:22:21AM +0200, Jakob Bohm wrote: > > > > Over the past few years, this has caused the Mozilla root list to > > become less and less useful for the rest of the open source world, a > > fact which at least

Re: Globalsign accidental intermediate revocation incident

2016-10-17 Thread Jakob Bohm
On 16/10/2016 09:59, Adrian R. wrote: Hello i read in the news (but not here on m.d.s.p) that a few days ago Globalsign revoked one of their intermediary roots and then un-revoked it (well, the revocation is accidental, but it was still a properly announced revocation, via signed CRL and

Re: StartCom & Qihoo Incidents

2016-10-17 Thread Jakob Bohm
On 18/10/2016 00:39, Kurt Roeckx wrote: On Tue, Oct 18, 2016 at 12:22:21AM +0200, Jakob Bohm wrote: Over the past few years, this has caused the Mozilla root list to become less and less useful for the rest of the open source world, a fact which at least some of the Mozilla-root-list-copying

Re: StartCom & Qihoo Incidents

2016-10-17 Thread Gervase Markham
On 15/10/16 00:32, Peter Gutmann wrote: > I would have expected some sort of coordinating action to provide a unified > response to the issue and corresponding unified, consistent behaviour among > the browsers, rather than the current lottery as to what a particular browser > (other than Apple