<div dir="ltr">Sounds great Ben. Thanks for keeping the proposal narrow.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jan 20, 2014 at 10:07 PM, Ben Wilson <span dir="ltr"><<a href="mailto:ben@digicert.com" target="_blank">ben@digicert.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Ryan,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I am still working on the revisions to the proposed bylaws, but I’m still have trouble formulating the Forum’s approach to Invited Guests. As the draft currently exists, no changes will be made in sections 1.1, 2.1(3), or 5.2 (although I strongly believe changes need to be made to improve these sections). No major change is needed to section 2.2, other than to change a typo / incorrect reference that is legacy from the pre-bylaws voting rules (reference to “item 6” instead of “subparagraph (g)”), but I don’t see a problem with the minor clarifying language in that section. Proposed Sections 3.1 and 3.2 are needed, as discussed during telephone calls and recent Face-to-Face meetings. So, back to section 3.3, my current thought is that if could read:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">“In accordance with the following notice procedure, a person may be invited to attend and/or participate as an Invited Guest during a Forum Teleconference or Forum Meeting in which such person’s expertise or participation will be of benefit to the Forum or a Forum Member:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">(a) at least five (5) days prior to the Teleconference or Meeting, the Chair will send notice to the Forum about a proposed Invited Guest;<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">(b) the notice must set forth the relevance of the person’s participation and whether the Forum should waive the requirement that the Invited Guest sign the IPR Agreement, and if so, the reasons therefore; and<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">(c) if no objection is made within 96 hours of such notice, the Chair may invite the person to attend as an Invited Guest.”<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Ben<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Ryan Sleevi<br>
<b>Sent:</b> Friday, January 17, 2014 7:41 PM</span></p><div><div class="h5"><br><b>To:</b> Ben Wilson<br><b>Cc:</b> CABFPub<br><b>Subject:</b> Re: [cabfpub] Ballot 110 - Motion to Adopt Version 1.1 of the Bylaws<u></u><u></u></div>
</div><p></p><div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p><div><p class="MsoNormal">On Fri, Jan 17, 2014 at 6:26 PM, Ben Wilson <<a href="mailto:ben@digicert.com" target="_blank">ben@digicert.com</a>> wrote:<u></u><u></u></p>
<div><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Ryan,</span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">See my responses inline below.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Thanks,</span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Ben</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Ryan Sleevi<br>
<b>Sent:</b> Friday, January 17, 2014 5:37 PM<br><b>To:</b> Ben Wilson<br><b>Cc:</b> CABFPub<br><b>Subject:</b> Re: [cabfpub] Ballot 110 - Motion to Adopt Version 1.1 of the Bylaws</span><u></u><u></u></p><p class="MsoNormal">
<u></u><u></u></p><div><div><p class="MsoNormal">While I realize it's not at ballot review period, a few thoughts, given the time constraints being operated in:<u></u><u></u></p><div><p class="MsoNormal"> <u></u><u></u></p>
</div></div><div><div><p class="MsoNormal">1) I'd prefer to not change the "Purpose of the Forum" (Section 1.1) at this time.<u></u><u></u></p><p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
</div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">BTW: That’s fine. I just didn’t like the current wording because it was written as if we’d just finished version 1.0 of the EV Guidelines.</span><u></u><u></u></p>
</div></div></div></div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Yup. I'd love to see this iteratively refined, I just wouldn't want to hold up the IG aspects.<u></u><u></u></p>
</div><div><p class="MsoNormal"> <u></u><u></u></p></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><div><div><div><div><p class="MsoNormal">
<u></u><u></u></p></div><div><div><p class="MsoNormal">2) Section 2.1 ("authenticate digitally signed code") is still a much greater increase of scope of the work of the members. I'd prefer if we could leave that for broader discussion. While I'm aware of the "Code Signing WG" discussions, this change in definitions has the effective quality of allowing/encouraging vendors with no/limited stake in the SSL/TLS ecosystem to vote on changes to the BRs / EVGs, and vice versa. I'm sure you can recognize at it's face, that has some degree of undesirability, and effectively changes the "CA/Browser Forum" to the "CA/ISV Forum"<u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p></div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">BTW: I disagree that we’re calling it the “ISV” forum under the proposed language, but in any event I’m fine with reverting the title to “Browser Member”. I also thought that the wording was sufficient to limit potential browser concerns, but here is a start on revised language that could make it a little more clear in its restrictions:</span><u></u><u></u></p>
</div></div></div></div></blockquote><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><div><div><div><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in"><span lang="EN" style="font-family:"Arial","sans-serif"">(3) <u>Browser Member</u>: The member organization:</span><u></u><u></u></p><p class="MsoNormal" style="margin-left:.5in;text-indent:.5in">
<span lang="EN" style="font-family:"Arial","sans-serif"">(A) manages a root store AND </span><u></u><u></u></p><p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><span lang="EN" style="font-family:"Arial","sans-serif"">(B) is a major global provider of a hardware or software product that is: </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:1.0in;text-indent:.5in"><span lang="EN" style="font-family:"Arial","sans-serif"">(i) used by the general public as a browser or computing platform, </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:1.0in;text-indent:.5in"><span lang="EN" style="font-family:"Arial","sans-serif"">(ii) used to browse the Web securely or authenticate digitally signed code, AND </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:1.0in;text-indent:.5in"><span lang="EN" style="font-family:"Arial","sans-serif"">(iii) able to verify the digital signatures on certificates used with the product (i.e. by processing the chain to a root certificate managed within the member’s root store). </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">However, if browser members still have strong opposition to the proposed wording, or this alternative above, I’d rather delete it from the proposal now than have the ballot fail, but I would hope you could see the importance of it to CAs who must deal with public key stores.</span><u></u><u></u></p>
</div></div></div></div></blockquote><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">I'd love to deal with this in a separate ballot, since it doesn't really tie to the Invited Guests discussion. I certainly can understand how it was originally part of a general clean-up, whereas now we're at a point of just trying to get a bylaws revision in place before the next F2F.<u></u><u></u></p>
</div><div><p class="MsoNormal"> <u></u><u></u></p></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><div><div><div><div><p class="MsoNormal">
<u></u><u></u></p></div><div><div><p class="MsoNormal">3) Why the removal of the transparency requirements in Section 5.2 for WGs? This is not at all desirable - although the modifications to Section 5.2(c) are.<u></u><u></u></p>
</div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">BTW: The current language requires that EVERYTHING (even things that are not currently being done, like the creation of agendas and minutes for working groups) be posted to the public list – for some people, the amount of email traffic on the public list is already bad. Read Section 5.2(e) where “important” working group updates are addressed. Otherwise, as the responsible executive interpreting the bylaws I will have to start telling everyone that they must prepare agendas and minutes and that all emails and every single interim draft, agenda and all minutes will now need to be posted to the public list, and then we’ll just eliminate the WG lists. </span><u></u><u></u></p>
</div></div></div></div></blockquote><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">I for one would welcome the enhanced transparency, and see it as a feature, even as I'm already deluged in e-mail.<u></u><u></u></p>
</div><div><p class="MsoNormal"> <u></u><u></u></p></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><div><div><div><div><div><p class="MsoNormal">
<u></u><u></u></p></div><div><p class="MsoNormal">4) Why are Invited Guests at the sole discretion of Chair/Vice-Chair, whereas Interested Parties go through Forum/WG consent? If anything, Invited Guests represent the greatest "threat" to members, in that they've not executed any IPR Agreement for any of the discussions they are present in.<u></u><u></u></p>
</div></div></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">BTW: If someone represents such a threat, we just won’t invite them—problem solved. However, we will likely run into situations where we value the input of someone, or we want their individual expertise, and for one reason or another they cannot sign the agreement in time (because of employment situation, legal advice, or whatever), then we will have to “pass” on having that person attend, and then maybe we’ll miss out on valuable information. If we invite [fill-in-the-blank] as our “invited guest”, I want to have sufficient discretion on whether to require them to sign the IPR Agreement. I would hope that attendees would we able to identify when an invited guest is trying to submarine us with some great idea (albeit contained in an undisclosed patent), and hopefully the Chair or Vice Chair, who we elect as our trusted representative will be smart enough to exercise his or her discretion appropriately. If we do change this, then we’ll need something appropriate to take its place—I’m fine if someone comes up with a simplified voting process that can also accommodate last-minute guest speaker replacements, etc.</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Thanks again for your comments.</span><u></u><u></u></p><p class="MsoNormal" style="margin-bottom:12.0pt">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Cheers,</span><u></u><u></u></p><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Ben </span><u></u><u></u></p>
</div></div></div></blockquote><div><p class="MsoNormal">When I used such a loaded term as "threat", I do not ascribe malicious intent. I simply mean that, for the members, every one of these IGs - and their contributions - does represent a threat to anything produced by a Standards Defining Organization or (as in the CA/B Forum's case) "similar" organizations. That is the unfortunate situation that we find ourselves in with respect to IPR.<u></u><u></u></p>
</div><div><p class="MsoNormal"> <u></u><u></u></p></div><div><p class="MsoNormal">I would definitely feel more comfortable seeing us put the same rigor as applied to members / associates, and simply present it to the Forum, especially when attendance-without-IPR-agreement is an entirely dangerous can of worms, no matter how well-intentioned or well-meaning the IG is. The further nuance is that an IG is, presumably, a natural person, whereas the IPR agreement is with legal persons - typically, corporations. The distinction is that no matter how good the IG is, they may be employed by an organization that does not share the same values, and thus that presents a 'risk'.<u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Anyways, I think these are the foundations of a series of good changes, I just think they will trigger a variable level of engagement, and for expediency, it might be best to just ballot the minimal set of changes for the F2F, and perhaps simultaneously ballot "the rest" for further discussion. Just $.02 from dealing with code and "minimal patches" / "one commit, one bug".<u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><div><div><div><div><p class="MsoNormal" style="margin-bottom:12.0pt">
<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><div><p class="MsoNormal">On Fri, Jan 17, 2014 at 3:49 PM, Ben Wilson <<a href="mailto:ben@digicert.com" target="_blank">ben@digicert.com</a>> wrote:<u></u><u></u></p>
<div><div><p class="MsoNormal">I am seeking two endorsers.<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">On 17 January 2014, Ben Wilson of DigiCert made the following motion, endorsed by _____ of _______ and ______ of __________:<u></u><u></u></p>
<p>–Motion Begins– <u></u><u></u></p><p>Be it resolved that the CA / Browser Forum adopts the attached “CA-Browser Forum Bylaws v. 1.1- Draft for Ballot 110” as its Bylaws, effective as of 4 February 2014. <u></u><u></u></p>
<p>–Motion Ends– <u></u><u></u></p><p class="MsoNormal">The review period for this ballot shall commence at 2100 UTC on 20 January 2014 and will close at 2100 UTC on 27 January 2014. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2100 UTC on 3 February 2014. <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Votes must be cast by posting an on-list reply to this thread. A vote in favor of the ballot must indicate a clear ‘yes’ in the response. A vote against the ballot must indicate a clear ‘no’ in the response. A vote to abstain must indicate a clear ‘abstain’ in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Voting members are listed here: <a href="https://cabforum.org/members/" target="_blank">https://cabforum.org/members/</a>. In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and more than one half of the votes cast by members in the browser category must be in favor. Quorum is currently six (6) members– at least six members must participate in the ballot, either by voting in favor, voting against, or by abstaining for the vote to be valid. <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p><p> <u></u><u></u></p><p> <u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p></div></div><p class="MsoNormal" style="margin-bottom:12.0pt"><br>_______________________________________________<br>
Public mailing list<br><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><u></u><u></u></p>
</div><p class="MsoNormal"> <u></u><u></u></p></div></div></div></div></blockquote></div><p class="MsoNormal"><u></u> <u></u></p></div></div></div></div></div></div></blockquote></div><br></div>