> (In reply to esmedudoit from comment #14) (In reply to Daniel Veditz from comment #19)

I think it is abhorrently deceitful that you published that Ryan Duff reported this specific bug (1303127 CVE-2016-5284) when it is blatantly untrue. I find it very off putting and intellectually dishonest of you specifically (and not Liz Henry) that you specifically say this bug report had zero barring upon the resolution and patch. Unlike Nik Ungers report I did specify that this bug affected Tor Browser. Ryan did not file ANY Mozilla bug reports. I filed this bug report within the same hour that Ryan Duff posted his research.

I did not use 'chatter on the internet' to report this bug. We need to answer the question 'Given what's in the trees and what versions are shipping when, will any preloaded information expire before (or near to when) a new version will be available?', which would rely on a lot of external information. I think this may be more of a dashboard/external tool task. > commit changes that bump the expiry time manually.

> If we can't get automation fixed in time, we can as a last resort just Add a test that checks that our static pins don't prematurely expire. I think it's acceptable to increase the timespan on which this would be a problem from 'a few days after a new release' to maybe even a month or two after a new release (or more?). I think the concern was if a user had an old version of the browser and a site had since rolled over its keys and/or CA, it wouldn't work until the list expired. > I seem to recall some opposition to making the validity period too long > 6 weeks apart releases can be delayed by a week or more now. > The current limit was IIRC set during the time when releases were always (In reply to :Cykesiopka from comment #7)

Tor browser review 2016