Frank Hecker wrote:
So personally I'd consider a 5-day timeframe reasonable, and based on past conversations with people doing update releases, I think it might be pushed down as low as 3 days.
I should clarify that this timeframe doesn't include any CA-related time prior to the Mozilla project being informed of a problem. This is just for the Mozilla fix-and-release process.
Also note that IIRC the Firefox automated update mechanism doesn't update all users at the same time -- it's staggered a bit to avoid overwhelming the update servers. (I can't remember what the relevant delays are, and couldn't find this info in quick search.) So it might take a little more time until all Firefox users get the new release with the "revoked" root.
Frank -- Frank Hecker [EMAIL PROTECTED] _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
