9 ms·

If you look at the de-facto vulnerability disclosure standards where a company is contacted with details of a vulnerability and a timeline in which to fix it pr

by kevwil 8y ago

If you look at the de-facto vulnerability disclosure standards where a company is contacted with details of a vulnerability and a timeline in which to fix it privately before the security researcher goes public, you'll see that a hard stance gets things fixed properly. How many times has a company ignored the timeline, only to have the vulnerability fixed within hours of of it going public? These companies are capable of fixing this cert issue, and are being lazy. They have been warned, and have been given a generous deadline. Zero sympathy for missing it and suffering the consequences. Empty consequences will only teach them to ignore future problems.

move-on-by 8y ago
I don't think comparing this decision with a vulnerability timeline is very fair. But besides that, there are other motivations at work. I believe the core of this post is summed up by this one paragraph: > we believe that delaying the release of this change until later this year when more sites have replaced their Symantec TLS certificates is in the overall best interest of our users. They do not want to mess up the user experience. Which I can sympathize with, especially for a browser that does not have market share. Chrome on the other hand: > Around the week of October 23, 2018, Chrome 70 will be released, which will fully remove trust in Symantec’s old infrastructure and all of the certificates it has issued. [0] From my point of view this boils down to "We're going to let websites fail for Chrome first, which will get greater visibility, and then we'll follows suit once things have calmed down". If this is the true motivation, then I believe this is a wise decision as Chrome failures will get far more attention and action vs. Firefox failures. Edit: Just to add some numbers. Chrome is currently at 60% usage while Firefox is at 5%. That is a significant difference in error visibility. [0] https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist...
- mjevans 8y ago
  A coordinated stance would also be helpful, release both at the same time.
  - gsnedders 8y ago
    The Firefox release was already due to happen a few days after the Chrome one (this was just due to how the release cycles work out, rather than deliberate planning).
- retox 8y ago
  >while Firefox is at 5% That is a real shame and I sincerely hope they are able to return to a health 25-33% mindshare.
  - krageon 8y ago
    For a long time Chrome was objectively the best choice, because it simply had better performance on almost everything. With the recent changes to Firefox (Quantum), that is no longer true. I have good hope this means that it'll climb back to a bigger percentage.
  - move-on-by 8y ago
    While its usage is certainly low, I also believe that its usage is under-reported at 5%. Many Firefox users today are privacy conscious and use plugins that block the sites that collect this data. Firefox even has built-in tracking blocker.
tedunangst 8y ago
Burning people who could have just stuck with http and avoided the fuss will teach them a different lesson.
- moviuro 8y ago
  I didn't expect that from a dev of the "secure by default" OS. Also, the main offenders aren't the small players, we're talking about the top 1 million. Sure any lambda person could use http if they wanted - but would they make it to the top 1 million? Is the top 1 million so low a bar that it also contains one-person-orchestra that have no idea how to handle their site?...

by kevwil 8y ago

move-on-by 8y ago

I don't think comparing this decision with a vulnerability timeline is very fair. But besides that, there are other motivations at work. I believe the core of this post is summed up by this one paragraph: > we believe that delaying the release of this change until later this year when more sites have replaced their Symantec TLS certificates is in the overall best interest of our users. They do not want to mess up the user experience. Which I can sympathize with, especially for a browser that does not have market share. Chrome on the other hand: > Around the week of October 23, 2018, Chrome 70 will be released, which will fully remove trust in Symantec’s old infrastructure and all of the certificates it has issued. [0] From my point of view this boils down to "We're going to let websites fail for Chrome first, which will get greater visibility, and then we'll follows suit once things have calmed down". If this is the true motivation, then I believe this is a wise decision as Chrome failures will get far more attention and action vs. Firefox failures. Edit: Just to add some numbers. Chrome is currently at 60% usage while Firefox is at 5%. That is a significant difference in error visibility. [0] https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist...

mjevans 8y ago
A coordinated stance would also be helpful, release both at the same time.
- gsnedders 8y ago
  The Firefox release was already due to happen a few days after the Chrome one (this was just due to how the release cycles work out, rather than deliberate planning).
retox 8y ago
>while Firefox is at 5% That is a real shame and I sincerely hope they are able to return to a health 25-33% mindshare.
- krageon 8y ago
  For a long time Chrome was objectively the best choice, because it simply had better performance on almost everything. With the recent changes to Firefox (Quantum), that is no longer true. I have good hope this means that it'll climb back to a bigger percentage.
- move-on-by 8y ago
  While its usage is certainly low, I also believe that its usage is under-reported at 5%. Many Firefox users today are privacy conscious and use plugins that block the sites that collect this data. Firefox even has built-in tracking blocker.

tedunangst 8y ago

Burning people who could have just stuck with http and avoided the fuss will teach them a different lesson.

moviuro 8y ago
I didn't expect that from a dev of the "secure by default" OS. Also, the main offenders aren't the small players, we're talking about the top 1 million. Sure any lambda person could use http if they wanted - but would they make it to the top 1 million? Is the top 1 million so low a bar that it also contains one-person-orchestra that have no idea how to handle their site?...