Re: Status of the bugzilla bug list

2020-05-29 Thread westmail24--- via dev-security-policy
Good subject. I am, as ordinary user still dont know, can I trust of root certs of Entrust or no because this question more than 1 time opened in CA/Incident Dashboard under mark 'trust'. ...Now this bugs I can no search. ___ dev-security-policy

Re: Status of the bugzilla bug list

2020-05-22 Thread Wayne Thayer via dev-security-policy
I'd just like to add or reinforce a few points based on my approach to managing open incident bugs: * I have leaned heavily to the side of leaving bugs open if there is the potential for additional questions, and always if there are any incomplete remediations. This means that bugs do tend to

Re: Status of the bugzilla bug list

2020-05-19 Thread Ryan Sleevi via dev-security-policy
On Tue, May 19, 2020 at 2:22 PM Matthias van de Meent wrote: > I agree that for any one bug, this metadata is not anything to make > decisions over, but when looking over e.g. the last 3 years, you can > start making more informed guesses on the metadata only. E.g. when you > find that a CA has

Re: Status of the bugzilla bug list

2020-05-19 Thread Matthias van de Meent via dev-security-policy
On Tue, 19 May 2020 at 16:22, Ryan Sleevi wrote: > > On Tue, May 19, 2020 at 5:53 AM Matthias van de Meent > wrote: >> >> One of the reasons I did this research was to check the track record >> of CAs with regards to compliance and solving compliance issues. As >> you might expect, this is

Re: Status of the bugzilla bug list

2020-05-19 Thread Ryan Sleevi via dev-security-policy
On Tue, May 19, 2020 at 5:53 AM Matthias van de Meent < matthias.vandeme...@cofano.nl> wrote: > Hi Ryan, > > On Tue, 19 May 2020 at 00:47, Ryan Sleevi wrote: > > > > Hi Matthias, > > > > We're aware of this. Could you explain what issue or issues this > > presents to you? > > One of the reasons

Re: Status of the bugzilla bug list

2020-05-19 Thread Matthias van de Meent via dev-security-policy
Hi Ryan, On Tue, 19 May 2020 at 00:47, Ryan Sleevi wrote: > > Hi Matthias, > > We're aware of this. Could you explain what issue or issues this > presents to you? One of the reasons I did this research was to check the track record of CAs with regards to compliance and solving compliance

Re: Status of the bugzilla bug list

2020-05-18 Thread Ryan Sleevi via dev-security-policy
Hi Matthias, We're aware of this. Could you explain what issue or issues this presents to you? Understanding that different projects can and do use different workflows to address their needs, it's not immediately clear to me what impact, if any, this might have for you, and it's unclear why the

Re: Status of the bugzilla bug list

2020-05-18 Thread Matthias van de Meent via dev-security-policy
2 PM > To: Mozilla > Subject: RE: Status of the bugzilla bug list > > I think your list of 23 is wrong. For example, bug 1550645 is just waiting > for Mozilla closure. It looks like 1605804 is in the same boat. I believe my list is correct. As I said, the specific list contains is

RE: Status of the bugzilla bug list

2020-05-18 Thread Jeremy Rowley via dev-security-policy
) -Original Message- From: dev-security-policy On Behalf Of Jeremy Rowley via dev-security-policy Sent: Monday, May 18, 2020 1:52 PM To: Mozilla Subject: RE: Status of the bugzilla bug list I think your list of 23 is wrong. For example, bug 1550645 is just waiting for Mozilla closure

RE: Status of the bugzilla bug list

2020-05-18 Thread Jeremy Rowley via dev-security-policy
Subject: Status of the bugzilla bug list All, I have looked at the list of open bugs in the CA compliance dashboard [0], and I was unpleasantly suprised. There's a total of 75 open issues at the moment of writing, of which 31 have not seen an update in 4 weeks, and of which again 23 [1

Status of the bugzilla bug list

2020-05-18 Thread Matthias van de Meent via dev-security-policy
All, I have looked at the list of open bugs in the CA compliance dashboard [0], and I was unpleasantly suprised. There's a total of 75 open issues at the moment of writing, of which 31 have not seen an update in 4 weeks, and of which again 23 [1] are not waiting for a planned future CA or Mozilla