3 ms·
Looks like they've failed to perform the revocation in time -- other users reported to Entrust >24h ago.
by cjbprime 7y ago
Looks like they've failed to perform the revocation in time -- other users reported to Entrust >24h ago.
- dlgeek 7y agoThey revoked it 7 minutes shy of the 24 hour deadline after my report. If other users reported it and they failed to act, that's a BR violation and they're required to provide an incident reports to the root programs via Mozilla's mechanisms. If they don't, and you have evidence of those reports, you should provide them to the root programs via the mozilla.dev.security.policy mailing list/group. There's already a thread about this issue, though not claiming that EnTrust was notified. (Based on timestamps, it's also possible they revoked in response to that thread).
- cjbprime 7y agoThanks. Here is the timestamp showing that it took more than 32 hours from reporting to revocation. https://twitter.com/FiloSottile/status/1219147543667453953?s=19 https://twitter.com/FiloSottile/status/1219147543667453953?s...