<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br class=""><blockquote type="cite" class="">On Jan 9, 2017, at 1:10 PM, Rob Stradling <<a href="mailto:rob.stradling@comodo.com" class="">rob.stradling@comodo.com</a>> wrote:<br class=""><br class="">On 09/01/17 17:39, Rich Smith via Public wrote:<br class=""><snip><br class=""><blockquote type="cite" class="">Scenario:<br class="">We ignore this and Ryan's arguments against, and we pass this proposal.<br class="">Next month we decide that the various browsers all now have enough<br class="">support for critical name constraints to update the BRs to MUST, but<br class="">because it will break your newly authorized dual-use certs Digicert is<br class="">now arguing against bringing the BRs back into full compliance w/RFC5280.<br class=""></blockquote><br class="">Geoff,<br class=""><br class="">Would you (or anyone else from Apple) be able to provide CABForum with data on the % of currently deployed Apple devices that support critical name constraints?<br class=""></blockquote><br class="">Sure, although of course only public data. We have this page:<br class=""><br class=""><a href="https://developer.apple.com/support/app-store/" class="">https://developer.apple.com/support/app-store/</a><br class=""><br class="">which shows that "76% of devices are using iOS 10” and an additional 18% using iOS 9, as of January 4, for a total of 94% supporting name constraints. For macOS, I don’t believe Apple publishes numbers, but there’s public data here:<div class=""><br class=""></div><div class="">http://netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0</div><div class=""><br class=""></div><div class="">which if you strip out the non-macOS systems, looks like this:</div><div class=""><br class=""></div><div class=""><img apple-inline="yes" id="90CF4A69-28F3-4F7E-8047-9D7B6D940EBD" width="443" height="404" src="cid:F8934903-8C26-45FD-8D82-907E583144EF@apple.com" class=""></div><div class=""><br class=""></div><div class="">for 68% of devices running macOS 10.12 or OS X 10.11 in December 2017, and so supporting name constraints. (I won't endorse the accuracy of the netmarketshare numbers, but they explain their methodology and so you can form your own opinion.)</div></body></html>