Re: Symantec Issues doc updated

2017-04-12 Thread Gervase Markham via dev-security-policy
On 11/04/17 23:07, Jakob Bohm wrote: > Please consider the fact that this is Easter week, and most of the > industry, including many people (on both the Browser and Symantec sides > of the process) are likely to be unavailable for precisely this week of > the entire year. > > In general, sending d

Re: Symantec Issues doc updated

2017-04-11 Thread Jakob Bohm via dev-security-policy
On 11/04/2017 18:53, Gervase Markham wrote: On 11/04/17 17:34, Ryan Sleevi wrote: Can you clarify what issues you believe this to be related? That is a fair question. And also hard work to answer :-) Given that Symantec has a routine habit of exceeding any reasonable deadline for response,

Re: Symantec Issues doc updated

2017-04-11 Thread urijah--- via dev-security-policy
>Within a few days of discovering these issues they shut down their >entire RA program. That seems pretty swift and comprehensive to me. The >fact that they didn't discover these issues for years is clearly a >problem, but it's not the same problem. I don't believe that's a fair characterizat

Re: Symantec Issues doc updated

2017-04-11 Thread Ryan Sleevi via dev-security-policy
On Tue, Apr 11, 2017 at 12:53 PM, Gervase Markham via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > > "to specifically address the > > GeoRoot audit status and remediation plan" - this was not reflected > within > > https://www.symantec.com/content/en/us/about/media/ > repo

Re: Symantec Issues doc updated

2017-04-11 Thread Gervase Markham via dev-security-policy
On 11/04/17 17:34, Ryan Sleevi wrote: > Can you clarify what issues you believe this to be related? That is a fair question. And also hard work to answer :-) > Given that Symantec has a routine habit of exceeding any reasonable > deadline for response, at what point do you believe it is appropri

Re: Symantec Issues doc updated

2017-04-11 Thread Ryan Sleevi via dev-security-policy
On Tue, Apr 11, 2017 at 6:49 AM, Gervase Markham via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > I have attempted to integrate the information provided by Symantec into: > https://wiki.mozilla.org/CA:Symantec_Issues > and started to draw some conclusions where that is war