<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.gmail-gmail-gmail-msonormal, li.gmail-gmail-gmail-msonormal, div.gmail-gmail-gmail-msonormal
{mso-style-name:gmail-gmail-gmail-msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Just to add one more perspective – I have always viewed Associate Members as people or groups that CAs and Browsers
<i>wanted</i> on our calls and meetings as providing necessary expertise – starting with WebTrust and ETSI representatives. It’s very convenient to have them understand what we are doing and provide feedback during meetings and calls. I was not active with
the Forum when PayPal was added as an Associate Member, and was never entirely certain about the reasons for a single company to be an Associate Member.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">As to adding ETA as an Associate Member – I think the Forum would benefit by adding
<i><u>one</u></i> financial services group Associate Member who can provide rapid responses to our work at meetings and on calls (and serve as a conduit of information back to the ETA membership), especially after the SHA-1 problems. Some Forum members have
been very harsh toward those financial services companies who didn’t respond in time to the SHA-1 cutoff and are now seeking SHA-1 certificates, saying “they should have paid attention”. Future Forum changes are likely to have a disproportionate impact on
financial services companies, so I think one Associate Member makes sense – I just want to make sure ETA is the
<i><u>right</u></i> member from that community.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Perhaps we also could benefit from one Associate Member who can represent all the independent hosting and registrar companies out there (not associated with a CA or browser).
But to keep meetings and calls to manageable size, in my opinion we should only add a very limited number of Associate Members.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Dean Coclin<br>
<b>Sent:</b> Saturday, April 09, 2016 2:29 PM<br>
<b>To:</b> Ryan Sleevi<br>
<b>Cc:</b> public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] FW: Associate member of the CA/B Forum<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="gmail-gmail-gmail-msonormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Basically because they would like to be more active in meetings and one benefit of Associate membership is the ability to attend F2F meetings.
</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So can Interested Parties<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">>>Yes, by invitation only. As I read the bylaws, AMs can come w/o invitation.<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<p class="gmail-gmail-gmail-msonormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">As a representative of 5000 members, ETA can better communicate things they learn from the forum and our meetings to a wide audience of theirs.
Traditionally, associations have been granted Associate member status, rather than Interested Party.</span><o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So that seems to be two arguments:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- So they can talk to members<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- Because it's what we did in the past<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The first can be accomplished by Interested Parties, and the Second is... more complicated.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The notion of Associate Members is actually relatively new - they were introduced in Bylaws v1.1, rather than the original version. Contributions, such as PayPal's, which arguably occupies a similar niche as ETA, were under the Interested
Party contribution. The introduction of the notion in v1.1 (via Ballot 116 - <a href="https://cabforum.org/2014/03/24/ballot-116-bylaw-amendment-for-associate-member-category/">https://cabforum.org/2014/03/24/ballot-116-bylaw-amendment-for-associate-member-category/</a>
) was to align our practices and inconsistencies with following our bylaws, but I don't know if we can argue they were associate members.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Given that <a href="https://cabforum.org/liaisons/">https://cabforum.org/liaisons/</a> is now, seemingly, considerably out of date due to non-renewal of the IPR policy, I don't know how much we can argue on that basis either. In terms of
membership tracking, unfortunately, the Wiki is not very helpful in determining who, of the parties that have executed IPR agreements (and are thus members in good standing) are Interested Parties vs Associate Members, but it seems that there are entities
comparable to ETA that are as Interested Parties.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I would also note that the Associate Member status seems to have been granted to the SDOs directly involved in the Web PKI operations - that is, WebTrust and ETSI stand out as participants. To what degree ETA is an SDO is unclear to me;
my understanding is they are merely a trade association, and not responsible for the standards themselves (compared to, say, the PCI SSC)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">While I fully welcome greater participation in the Forum, and that's a topic that we've advocated for rather hard in the past, my feeling and suspicion is that many potential members needs will be met as an Interested Party. A concern,
of course, has been raised by many CAs in the past, which is that the larger the F2F meetings get, the less likely we'll be able to accomplish anything productive, and the more expensive it will be to host. However, my concern is that the F2F's are notoriously
"smoke-filled rooms", in that minutes fail to capture the many nuances of discussions, due to their subtleties, and thus provide much less transparency or accountability to discussions on the list.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That's why I favor greater Interested Party participation, because it encourages greater participation on the list, and greater transparency of what was said and why decisions were made.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">While I'm uncertain as to whether "oppose" the application would be the right position I'm advocating, I would like to strongly encourage an Interested Party membership, which should confer almost all of the benefits - except for that of
secrecy (the ability to post on the management list, and the ability to routinely hold discussions that aren't well or completely minuted during the F2F). That seems certainly in everyone's best interests.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">>>I’m hearing two points here: One is that as part of the Governance Change WG, we should re-look at the categories of IPs and AMs and determine if there is a
meaningful distinction. That can certainly be done.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><br>
The other subtle point is that the F2F meetings are not valuable, not transparent enough and should be discontinued. I think you’ll find some arguments there from members but again, can be tackled by the WG to determine if the frequency of meetings is too much,
too little or just right and if minute taking should be recorded or changed to another format.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Back to the issue of ETA, I’ll put this on the agenda for next week’s call and would be interested in hearing from others either on the list or the call.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Dean<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>