<div dir="ltr">How about creating some dedicated time for it at the F2F, now that there's a concrete ballot and even some data, and see where the Forum can get to from there?<div><br></div><div>The written version of this debate is starting to really spin its wheels, especially if even Dean is starting to use phrases like "ulterior motives" (which I don't think is called for). And despite Ryan's links to past discussions, the ballot proposal process seemed like a sudden escalation that didn't offer the same opportunity for discussion or consensus building as past successful ballots. </div><div><br></div><div>It seems like an ideal candidate for a F2F session.</div><div><div><br></div><div>-- Eric<br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Feb 10, 2017 at 2:51 PM, Dean Coclin <span dir="ltr"><<a href="mailto:Dean_Coclin@symantec.com" target="_blank">Dean_Coclin@symantec.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-8424822773968622464WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Building consensus in meetings is different than building consensus for a ballot. Discussions happen in meetings without concrete proposals, as was shown in the
chart I posted earlier from the Zurich meeting. I can’t recall anyone coming out before this ballot seeking consensus for a 1 year validity effective in 4 months. So yes, I do think that now that a formal proposal (ballot) has been issued, a serious attempt
to build consensus should be undertaken. This will likely take more than 2 weeks of online back and forth. We have a F2F coming up in 40 days, giving folks time to reach out and get more input. I do believe that everyone wants to improve security but as the
scattering of input shows, this must be balanced with the user constituency needs which really haven’t been fully vetted for THIS particular proposal. You’re right, I’m not saying we can reach consensus on this ballot but perhaps an alternative compromise
can be reached which balances the needs of all constituencies.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Regarding the motive, all I’m saying is that there is no consensus, therefore, it seems a ballot failure is a foregone conclusion and you must know that, but
you want it to go forward anyway. Call me crazy?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> Friday, February 10, 2017 1:12 PM<br>
<b>To:</b> Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com" target="_blank">Dean_Coclin@symantec.com</a>><br>
<b>Cc:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>>; Eric Mill <<a href="mailto:eric@konklone.com" target="_blank">eric@konklone.com</a>><span class=""><br>
<b>Subject:</b> Re: [cabfpub] Draft Ballot 185 - Limiting the Lifetime of Certificates: User input<u></u><u></u></span></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Fri, Feb 10, 2017 at 10:03 AM, Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com" target="_blank">Dean_Coclin@symantec.com</a>> wrote:<u></u><u></u></p><div><div class="h5">
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">We’ve always allowed minor changes in ballots after being proposed and this would fall into that category.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">However, I strongly believe time spent gathering consensus
<u>would</u> be of value. I disagree that the forum is not a consensus driven organization. Sure there have been disagreements on some issues in the past but for the most part, ballots pass with a large percentage voting yes. Consensus has been a goal since
the first meeting in NYC. It seems there is an ulterior motive at play in rushing this to a vote.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Can you perhaps expand on your belief of an ulterior motive? That suggests a bad faith attempt, and it would be helpful to understand that accusation or confusion, so it can be addressed.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Given the three years of attempts to build consensus on this matter, do you believe that we're likely to achieve consensus with an additional week or month of deliberation?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">For example, do you believe that new information has been shared by the Browser members that hasn't been clear for years, such as Gerv's arguments in <a href="https://clicktime.symantec.com/a/1/kHyfVNLdHrVzICacNRs7YQhFl-tns0pP1OdK7JkyjZY=?d=F5L_7thI-b0RnB4A_J8k-e5GiG1kwRSD7qnjjCY4hvLE7fBnWy4OGG3PoYk5ccUwBBkx8jK7Ox00Vz78GIrFAZxo_p9Ekc-zDM1awxSsGNNyWgrV2qhGFQtNt7PBev48KfJeEbXFmPnpXmCXkv5A2BMijIy83BbPS_r7phLYEfkyrB4yeuftVljoaUb3M5xViy6RqPtVbafTs_8EjuIfdcAmjBqxDVJ4gnijiESVcJgx_IQ2wjbugu9vbLsJQJ8BZVG5yVQHjWp42md9kUEO4yXEi7U-GaBJcp9BwJT-bg6z_fuWM0p1fQI1-PLk3-kwu01bnlgvzKDdyJjaBPQR_30UmlQaExMo0hz179Ld9lSL6ROaqTgzeswd677HQQyCZsve-iOrPeE7mNxRI7zCfmTdliXIqmIxl2tk39ZCV4y5d8wCRV4cVztIG2MAWSk4HYKMkWz5aj6jwXXw&u=https%3A%2F%2Fcabforum.org%2Fpipermail%2Fpublic%2F2013-November%2F002493.html" target="_blank">https://cabforum.org/<wbr>pipermail/public/2013-<wbr>November/002493.html</a>
, which I've simply repeated here.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Alternatively, do you believe that an additional week or month of time is necessary for CAs to provide new data, given that they've already had years to do so, but have not?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I highlight this to suggest that the issue is one which, despite years of trying, we've not been able to drive consensus towards. At this point, most appropriate for the broader community, is to understand what those challenges are, and
who specifically is objecting to improving security. It's also useful to understand whether or not there is consensus among browsers that this is a necessary and required step to ensure the security of their users when interacting online.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I simply highlighted that the end state is that Root Stores / Application Software Suppliers need to take the steps to protect their users. Ideally, ASSes such as myself can help CAs understand our concerns and desires, and the risks and
challenges, and find a solution that the community can reach. However, when CAs ignore the concerns of ASSes such as myself, or do not take them seriously, it sometimes requires taking the role of being an ASS serious, and taking the steps directly as part
of program policy and implementation.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Such is the nature of the ecosystem - as much as we all try to ensure we're a community pushing forward, sometimes we get stalled on a roadblock, and we unfortunately have to let CAs be CAs and ASSes be ASSes.<u></u><u></u></p>
</div>
</div></div></div>
</div>
</div>
</div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><a href="https://konklone.com" target="_blank">konklone.com</a> | <a href="https://twitter.com/konklone" target="_blank">@konklone</a><br></div></div></div></div></div></div></div>
</div>