MERIDIAN · INC-0417 · #core restricted · 12 participants · message retention: off
stovepipe · 10:02 UTC Ostvik’s bulletin is out. OTS-SB-0031. It’s in the folder.
stovepipe · 10:04 UTC For the record, my employer is one of the forty-one participating organizations. I am now on both sides of this.
Adeyemi · 10:11 UTC Four of us are. I saw a draft Thursday night. Nobody asked me what I thought of it.
Beck · 10:30 UTC Read it as if you could sign with R2.
Ferrante · 10:57 UTC Hour 0. The package that installs PQ1 is signed under R2.
Ferrante · 10:59 UTC And the FAQ. “A device that updates automatically will take the new root without intervention.”
Kroll · 11:04 UTC What you are reading into that.
Ferrante · 11:12 UTC Anybody who can sign under R2 can ship a package that looks exactly like that one, with their own root in it. And this morning forty-one companies told every device owner to let it install.
Adeyemi · 11:15 UTC There’s no other way onto a device. R2 is the only thing it trusts.
Ferrante · 11:16 UTC I know. So every day R2 still works, so does a package like that.
Beck · 11:20 UTC stovepipe. Can your fleet tell you which package a device took.
stovepipe · 11:27 UTC The hash of whatever installed. I can match it against Ostvik’s. Only for devices we manage.
Beck · 11:28 UTC Do it. Anybody here with a fleet does the same.
Kroll · 11:29 UTC “On the basis of guidance from government partners.” Somebody gave them a deadline.
Ferrante · 11:40 UTC They didn’t print it. Ten days is how long the manufacturers say they need. Nothing in there says how long R2 has.
Kroll · 11:41 UTC That is a guess.
Ferrante · 11:44 UTC It’s Sunday.
stovepipe · 12:50 UTC Managed-fleet numbers since hour 0. 9.2 million devices report PQ1 installed. Every transition package so far matches Ostvik’s hash.
stovepipe · 12:53 UTC The pumps in my three hospitals are in paragraph four. R2 is in read-only memory. They will trust it until somebody throws them away.
Kroll · 13:20 UTC “Every participant signs with the same build of the same FN-DSA implementation, nib 4.2.1.” Who wrote it.
Adeyemi · 13:34 UTC It’s open source. It’s been around for years. All the HSM vendors already ship it.
Adeyemi · 15:02 UTC I’ve been on with Ostvik’s operations people for an hour. The signing service was down at nine Eastern because every manufacturer in the country hit submit at the same time. It’s back. At the rate they’re signing now they’ll have all 2.4 million by Tuesday night.
Beck · 15:05 UTC And Day 10.
Adeyemi · 15:09 UTC Doesn’t move. I asked. Their words were “the date is a commitment to the manufacturers.”
Adeyemi · 15:11 UTC If the signing’s done Tuesday, everything that took PQ1 goes on believing R2 for another week with nothing left to wait for. That’s a week of Ferrante’s package.
stovepipe · 15:21 UTC Then any image that isn’t re-signed can’t ship to anything that took PQ1. A vendor finds a bug on Friday. Their customers have to wait.
Adeyemi · 15:24 UTC Then they re-sign faster. They’re already four days ahead.
Beck · 15:30 UTC Write it.
Kroll · 15:41 UTC Not from here. A channel of competitors that nobody has disclosed, asking the group to move a date every one of their competitors has to meet. Send it from your company, on your letterhead, as your company’s request.
Kroll · 15:44 UTC And leave out the reason. “Anybody who can sign under R2” is not something you send to forty-one organizations on a Sunday. Argue the schedule.
Adeyemi · 16:38 UTC Sent. From us, under my name, to the group chair and to Ostvik.
The pace of re-signing since hour 0 indicates that all supported images will be available under PQ1 well before Day 10. We request that the Transition Group consider moving R2 distrust for PQ1-enabled devices to the first business day after re-signing is complete.
Adeyemi · 20:02 UTC Forty-one companies did item two this morning without them. Do we still need them?
Beck · 20:11 UTC Item three stands.
stovepipe · 21:40 UTC I am pulling the PQ1 transparency log as it is written. 812,000 signatures so far. If anything on my fleet accepts a PQ1 signature that is not in the log, Lost and Found will see it.
Adeyemi · 21:51 UTC Ours starts tonight. It’s a third the size of yours and it’s mostly laptops.
Adeyemi · 23:52 UTC Ostvik replied.
Thank you for your letter and for your continued partnership. The Transition Group shares your sense of urgency. Day 10 reflects the shortest period in which every participating manufacturer can re-sign, test, and redistribute its supported images, and the Group has no plans to revise it at this time. We will continue to keep participants informed.
Kroll · 23:58 UTC “At this time.” That’s not a no. Write again when you have a number they gave you.
Adeyemi · 01:45 UTC Their live blog, four minutes ago. “More than 1.1 million artifacts had been signed under the new root since 6 a.m., well ahead of schedule.”
Beck · 01:46 UTC Send it again. Put their number in the first line.