The DigiNotar hack, however, was larger -- criminals acquired only nine certificates from Comodo -- and more serious in that the Dutch government relied on DigiNotar to secure its websites.
And then there are the boasts made by an unidentified hacker who has claimed responsibility for both the Comodo and DigiNotar breaches.
On Monday, that hacker -- known only as "Comodohacker" -- also asserted that he had penetrated four other CAs, or certificate authorities, including GlobalSign, a U.S.-based CA much more widely used than DigiNotar.
Tuesday, GlobalSign suspended certificate sales and said it had launched an investigation into Comodohacker's claims. A day later the New Hampshire company said it had hired Fox-IT, the forensics firm that is still digging into the DigiNotar hack for the Dutch government.
If Comodohacker's claims are accurate, and there are other CAs besides DigiNotar that have issued unauthorized SSL certificates, Apple's sluggishness is even more inexcusable, Henry said.
"We may be looking at the tip of the iceberg," said Henry. "If there are four other CAs [involved] as this guy claims, we could be in a hell of a mess in the next few months. We'll be playing catch-up, but that seems to be more difficult for Apple than for Microsoft, or Google and Mozilla."
But Henry didn't limit his criticism to Apple.
"What about smartphones ?" he asked. "I'm not aware of a single carrier or vendor that has pushed out a browser update for this."
Neither Google nor Apple have said anything about plans for updating Android or iOS to follow the road taken by most desktop browsers. The companies declined to comment Tuesday for a story written by IDG News Service reporter Robert McMillan. (Like Computerworld, IDG News is part of IDG.)
According to Web metrics company Net Applications, about three-out-of-four Mac OS X users run Safari as their primary browser.
Until Apple updates Mac OS X, users should browse with Chrome or Firefox, Henry said. Neither requires Mac OS X to be updated to block all DigiNotar certificates.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His email address is email@example.com.
Read more about browsers in Computerworld's Browsers Topic Center.