[elliot07]

Can someone ELI5 what the actual impact of this is? Is there security concerns I'm not seeing here?

[SteveNuts]

As far as I can tell there's zero real world impact here, I think they just want to maintain a stellar track record for any reported bug that would affect the certificate issuance in any way.

Basically, had it been a second, a day, a month, doesn't matter - they still treated it seriously. That sort of thing goes a long way towards building trust.

[blfr]

Trust with whom? To me acting like an automaton lowers trust.

The suggestion to invalidate millions of certs over a second longer validity sounds like terrible judgement.

[mcpherrinm]

The security concerns of this particular bug are essentially zero. The meta question is if there are other related bugs that may not have been caught. We should stamp out bug classes, not individual bugs.

[pdpi]

It's a brown M&Ms sort of situation. It's a low-impact situation, but the appropriate response is to audit how the mistake was made and figure out what failed for it to slip through — which might lead to insight into other latent problems.

[mweberxyz]

There is zero actual security impact.