<div dir="ltr">Kirk,<div><br></div><div>It's sad to see your promise was so short lived. That is, the " I promise I will read the links carefully for the details you have provided. " promise you made one hour ago.</div><div><br></div><div>Since your message is not appearing in the archives, I'll link you to the reply in which I quoted you, in the hopes it will jog your memory of you making that promise - <a href="https://cabforum.org/pipermail/public/2016-October/008630.html">https://cabforum.org/pipermail/public/2016-October/008630.html</a></div><div><br></div><div>And then I'll link you to the post where I already answered this for you, less than an hour ago, in the hopes it will continue to jog your memory:</div><div><a href="https://cabforum.org/pipermail/public/2016-October/008630.html">https://cabforum.org/pipermail/public/2016-October/008630.html</a><br></div><div><br></div><div>Perhaps you can read the above link carefully for the details I have provided? That'd be great. Thanks.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 24, 2016 at 2:04 PM, Kirk Hall <span dir="ltr"><<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_1933826708901439739WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thanks Ryan – that is helpful.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Can you tell us who ordered the two certificates you listed? By an employee, or by a fraudster?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">In what way was the <a href="http://googleusercontent.com" target="_blank">googleusercontent.com</a> cert “not authorized”?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> Monday, October 24, 2016 1:58 PM<span class=""><br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>><br>
<b>Cc:</b> Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>>; <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>
<b>Subject:</b> Re: [cabfpub] Continuing the discussion on CAA<u></u><u></u></span></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Mon, Oct 24, 2016 at 1:50 PM, Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>> wrote:<u></u><u></u></p><div><div class="h5">
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Ryan, your response is cryptic and confusing. I think we are wasting time.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I literally and specifically gave you multiple examples - both of where CAA *could have* prevented unauthorized issuance to third parties and where CAA *has* prevented unauthorized issuace to third parties, with specific domain names and
CAs.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I cannot help you if you are unable to participate in a technical discussion, but it's very clear that the bar is not "convince you", but "explain to you" - and the latter is something that's only possible if you're honestly interested
in learning, which, at this point, I can only conclude is yet another attempt to avoid productive discussions.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Can you please avoid quoting other stuff (not sure what it proves or how it helps)
</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It shows me attempting to honestly engage in your request that I "restate whatever evidence you have"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">and just lay out on the Public list your examples in simple English of cases where CAA would have prevented
misissuance of a certificate to a fraudster not associated with the organization that owns or controls the domain requested? I don’t believe this has explicitly been discussed on the Public list before.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">And yet again, you're disrespectfully changing the conversation when it's been pointed out you're mistaken.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In this case, after providing you the examples you specifically claimed were absent, and reminding you of specific conversations you were part of in which they were answered, you've now suggested that they're insufficient because they weren't
discussed on the public list. As the Chair, this does not bode well at all for the future of the Forum that you would engage in such tactics so brazenly.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I will attempt to repeat for you:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="http://googleusercontent.com" target="_blank">googleusercontent.com</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- Certs were not authorized, but conformed to 3.2.2.4. They were issued.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- We added CAA<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- Certs are prevented now<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="http://amazonaws.com" target="_blank">amazonaws.com</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- Certs were not authorized, but conformed to 3.2.2.4. They were issued.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- Amazon has not added CAA<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- Unauthorized certs are still possible<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Microsoft Azure<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- Microsoft expressed repeatedly concerns with 3.2.2.4 about certs that were not authorized being issued.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm not sure how much simpler I can make it for you. But I'm certainly unwilling, at this point, to continue to engage with you on this topic, considering how dismissive you've been throughout the 2.5 years that we've been discussing this.
Perhaps it would be better if someone more technically capable engaged on your behalf, so we can at least have productive discussions about where to draw the line between technical and policy solutions.<u></u><u></u></p>
</div>
</div></div></div>
</div>
</div>
</div>
</div>
</blockquote></div><br></div>