Conversation

TELL 2: Containment comes second.

Bug 2073581: after the key-size problem was reported, 11 more non-conforming certificates were issued before issuance stopped. eMudhra’s own report says it should have stopped sooner.

Then the weak-key incident. Mozilla sent questions on 20 Oct and asked for a first response within 24 hours. eMudhra asked for 24 more. Last we checked, still nothing no concrete evidence has been furnished.

The reason given: scrutiny made analysis “pretty much impossible”. Chrome’s reply: scrutiny is the predictable cost of the failure, not a reason to wait.

Contain, preserve evidence, answer. In parallel, not in sequence.