A response has Cache-Control: public, max-age=60, s-maxage=600. How long is it fresh in the browser and in a CDN?

The browser keeps it fresh for 60 seconds, and the CDN for 600 seconds. s-maxage applies only to shared caches, such as CDNs and proxies. In those caches it overrides max-age. The browser is a private cache, so it ignores s-maxage and uses max-age=60.

"Both 60 seconds, s-maxage only applies to private caches" is wrong because it has it backwards: s-maxage is for shared caches only.