Episode 680: Bugzilla Bloodbath Redux

In this episode, Tim and Jason revisit the "Bugzilla bloodbath," the surge of public CA compliance incidents on Mozilla's Bugzilla, which has become the official WebPKI incident reporting platform. A normal year brings around 100 bugs, but there are now 138 open at once and several hundred opened this year. Almost all are reported by third parties, which suggests security researchers are using AI-assisted automation to scour public CA behavior in CT logs, CPS documents and root hierarchies. We discuss why the volume is a healthy sign of the system working as designed, why finding these issues before attackers do is a good thing, and why we hope the backlog will eventually run out and return to normal levels.