<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>All,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For the currently pending Ballot 110 version of the Bylaws, we postponed changes to Section 2.1(a)(3) for more group discussion about the membership category of “Browser.” <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We also postponed any changes to Section 5.2 for more discussions about transparency vs. security of working group lists--we have had discussions about whether existing WG mailing lists need to be shut down so that new ones can be started which are publicly accessible. I mention an alternative solution below. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Also note that regardless of any changes we might make to the Browser membership category, we’re not going to rename our organization to something else. Also, Iñigo’s email concerning Cisco this morning reminded me that Cisco had asked to become a member in the CA/Browser Forum. I think Cisco fits better in the browser category than in the CA category even though they do manage a publicly trusted PKI – as do Google, Microsoft, and Apple. However, the proposed edit to section 3.1(3) of the bylaws says:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>(3) Browser Category: The member organization <o:p></o:p></p><p class=MsoNormal>(A) manages a root store and <o:p></o:p></p><p class=MsoNormal>(B) is a major global provider of a hardware or software product that is: <o:p></o:p></p><p class=MsoNormal>(i) intended for use by the general public as a browser or computing platform, <o:p></o:p></p><p class=MsoNormal>(ii) used to browse the Web securely or authenticate digitally signed code, and <o:p></o:p></p><p class=MsoNormal>(iii) able to verify the digital signatures on certificates used with that entity’s product by processing the chain to a root certificate managed by that entity’s root store.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So, even under this proposed subsection (3)(B)(i) category definition, Cisco might not qualify because unless someone can clarify if Cisco provides a browser or computing platform – so additional wordsmithing may be necessary. That being said, I’d suggest that if they want to, we allow Cisco to join the CA/B Forum in the interim as an Associate Member, upon their submission of a signed IPR Agreement. Then, their membership status can change if our membership criteria in the bylaws change.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thoughts?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Also, to reignite the discussion on section 5.2, one of the arguments for amendment, in addition to the one I’ve made for administrative simplification, is that security sensitive discussions should be exempted from public disclosure – I think that means that certain email lists should not be required to be made public. Does anyone disagree with the general proposition that the public disclosure of security measures weakens the effectiveness of those security measures?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Section 5.1 of the Bylaws currently provides that non-public discussions of the following may take place on the management list:<o:p></o:p></p><p class=MsoNormal>(d) Security incidents if, in the opinion of the Members, discussion on the Public Mail List could reasonably be detrimental to the implementation of security measures by Members.<o:p></o:p></p><p class=MsoNormal>…<o:p></o:p></p><p class=MsoNormal>(f) Matters which, in the opinion of the Members, require confidentiality.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So, there are working group discussions that should be allowed to take place confidentially without flooding the Management List (or the Public List).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Edits to sections 5.1 and 5.2 are needed to clarify our position on this. Meanwhile, maybe we need to adopt an approach like we have for the management and public lists – i.e. two lists for each working group – one public and one private? Then “Members have discretion about which mailing list they use, but are strongly encouraged to use the Public Mail List for [most] matters.” And “[they] are strongly discouraged from posting the text of [non-public working group] list messages [publicly] without the permission of the author or commenter.” This is consistent with the current approach of our bylaws.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thoughts?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>