<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>During today’s call we discussed the definition of “browser” in the bylaws. This is relevant due to Oracle’s potential interest in joining the Forum. Back in 2009 we were looking at revising the browser category of membership. I have pasted excerpts from that discussion below. Today we had a similar discussion, which ended in a suggestion that we start this thread on the list.<o:p></o:p></p><p class=MsoNormal>The current bylaws define a “browser” member as “[an organization that] produces a software product intended for use by the general public for browsing the Web securely.” <o:p></o:p></p><p class=MsoNormal>One suggestion is that we amend the definition in two ways – (1) adding the concept of “trust agency” and (2) broadening the definition beyond just “browsing the web”.<o:p></o:p></p><p class=MsoNormal>For example, the definition could be revised:<o:p></o:p></p><p class=MsoNormal>Browser/User Trust Agent (“Browser”): The member organization produces a software product widely used by the general public that uses a root store for making trust decisions for relying parties.” <o:p></o:p></p><p class=MsoNormal>During the conversation, we noted that we’re not talking about root store operators, but systems, operating platforms, and browsers. <o:p></o:p></p><p class=MsoNormal>Also, to what degree should we consider the size of the applicant, if there were several small ones that wanted to join and become voting members, that might have an impact, and since this is not trivial, we are opening up this discussion on the list. <o:p></o:p></p><p class=MsoNormal>One draft from 2009 was as follows: “<b>Product Supplier</b> - The organization supplies a product intended for use by the general public that acts as a PKI relying party (making trust decisions on behalf of the user by actually processing certificates with software) to secure information or transactions.”<o:p></o:p></p><p class=MsoNormal>Here are the notes of our meeting May 14, 2009:<o:p></o:p></p><p class=MsoNormal>The voting category [would be] expanded beyond Web browsers to any product that acts as a PKI relying party. <o:p></o:p></p><p class=MsoNormal>…<o:p></o:p></p><p class=MsoNormal>Would the author of a Web browser with two users be eligible for membership? Tim said that it would. <o:p></o:p></p><p class=MsoNormal>…<o:p></o:p></p><p class=MsoNormal>Nick said that, because we have so few members in this category, someone with very little market presence could have disproportionate influence on the ballots. <o:p></o:p></p><p class=MsoNormal>…<o:p></o:p></p><p class=MsoNormal>Johnathan said that he would like to be able to apply common sense on a case-by-case basis. <o:p></o:p></p><p class=MsoNormal>Tim said that we have to ensure that our criteria are objective. <o:p></o:p></p><p class=MsoNormal>Johnathan said that the proposed criteria do not distinguish between software that curates its own root store and software that relies entirely on another's root store. There are a lot of browsers that are extensions on Mozilla. They use the same root store and make the same EV decisions. If they were all to join, then Mozilla may be over-represented.<o:p></o:p></p><p class=MsoNormal>Tim suggested that it should depend upon whether their constituents viewed them as their agent in questions of trust. Johnathan agreed.<o:p></o:p></p><p class=MsoNormal>Aaron said that there are browsers that use the Apple framework to make trust decisions and that should not be enough to disqualify them; their input as browsers is still very important. <o:p></o:p></p><p class=MsoNormal>Johnathan said that there is a case to be made that, if a piece of software has meaningfully different trust characteristics, then that is closer to a rational test.<o:p></o:p></p><p class=MsoNormal>Yngve said that we have encountered this situation with Google. He wasn't sure whether Google relies on its own root store or the platform's root store. Johnathan said that, without speaking for Chrome, his understanding was that they use the Microsoft root store on windows, but make their own EV determination, and that it is their intention to use 'platform native' cert stores on Mac and Linux as well.<o:p></o:p></p><p class=MsoNormal>Bjørn said that he would not want to accept anyone who is simply 'skinning' Internet Explorer, for instance. <o:p></o:p></p><p class=MsoNormal>Tim said that the wording we have is 'acts as a relying party'. Bjørn said that it is slightly vague. Yngve suggested 'acting as a PKI relying party, making trust decisions on behalf of the user'. Bjørn agreed. Tim said that he would incorporate that clause, and if there were no objections he would take it to ballot.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>