<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Apr 17, 2017 at 2:47 PM, Dean Coclin <span dir="ltr"><<a href="mailto:Dean_Coclin@symantec.com" target="_blank">Dean_Coclin@symantec.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-6407957033413086916WordSection1">
<p class="MsoNormal">“Unless it can be demonstrated that this message was received by all participants subscribed, and was able to be crawled and index by an Internet search engine, I do not believe you can argue that the "posting" requirement has been met.
We must look at the entirity of the Bylaws, and choosing this particular interpretation is not consistent.”<u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">I think this is the crux of the matter at hand. There are different interpretations of “posting” and interpreting it one way or the other is the cause of the
issue. Looking at “entirety” is one way. Looking at “intent” is another. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><br>
I remember a time when we did not have public voting. Then a change was made, with the intent being to inject transparency into the voting process and publicly disclose where CAs and Browsers came down on issues. It would seem this intent is satisfied by the
chair’s disclosure of the votes online.</span></p></div></div></blockquote><div><br></div><div>We discussed this during the adoption of public voting and the public mail list, however. That is, in the conversations leading up to that, there was the discussion about whether to have 'secret ballot' approaches (all votes sent to Chair) or whether to have on-list public votes, with the conclusion being the latter.</div><div><br></div><div>To ensure all members understand the history related to these changes:</div><div>Ballot 73 - <a href="https://cabforum.org/2012/05/11/ballot-73-public-mail-list/">https://cabforum.org/2012/05/11/ballot-73-public-mail-list/</a> - introduced the public mailing list</div><div>Ballot 79 - <a href="https://cabforum.org/2012/07/25/ballot-79-mailing-list-usage/">https://cabforum.org/2012/07/25/ballot-79-mailing-list-usage/</a> - introduced the deference to do things publicly</div><div>Ballot 98 - <a href="https://cabforum.org/2013/02/22/ballot-98-public-voting/">https://cabforum.org/2013/02/22/ballot-98-public-voting/</a> - required that all voting happen on the public list<br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_-6407957033413086916WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">I’m not arguing either way, just pointing out the viewpoints.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">So what are the possible solutions?:<u></u><u></u></span></p>
<p class="gmail-m_-6407957033413086916MsoListParagraph"><u></u><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><span>1.<span style="font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"times new roman"">
</span></span></span><u></u><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">Do not count Microsoft’s vote. The ballot then fails. I’m guessing the proponents will post a new ballot stating the same thing and is voted on again.
The bylaw ambiguity should be clarified in a different ballot.<u></u><u></u></span></p>
<p class="gmail-m_-6407957033413086916MsoListParagraph"><u></u><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><span>2.<span style="font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"times new roman"">
</span></span></span><u></u><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">Count Microsoft’s vote. The ballot passes. Clarify the bylaw ambiguity in a new ballot.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">These are really the only possible ways forward under our bylaws. The Chair and Vice-Chair can’t be asked to make a ruling since they could be biased one way
or the other on the outcome.</span></p></div></div></blockquote><div><br></div><div>Thanks for stating that Dean, because that really is the crux of the matter. I agree with you that neither the Chair nor the Vice-Chair can or should be asked to serve as "tie-breakers" or "interpreters at large" of the Bylaws. They exist to facilitate and honor the Bylaws, but not to offer their interpretation in a privileged place beyond that of any other member. Thus, to decide #2 - whether to count Microsoft's vote - the process is what we do for all such matters, which is the formalization of a Ballot. We've done Ballots like this in the past, without touching on documents, as reflected in Ballot 77 - <a href="https://cabforum.org/2012/06/07/ballot-77-emergency-extension-of-ipr-requirements/">https://cabforum.org/2012/06/07/ballot-77-emergency-extension-of-ipr-requirements/</a> - and the (failed) Ballot 82 - <a href="https://cabforum.org/2012/07/31/ballot-82-extend-ipr-introduction-timetable/">https://cabforum.org/2012/07/31/ballot-82-extend-ipr-introduction-timetable/</a></div><div><br></div><div>When it came to deciding process, we've used Ballots such as Ballot 85 - <a href="https://cabforum.org/2012/08/24/ballot-85-governance-reform/">https://cabforum.org/2012/08/24/ballot-85-governance-reform/</a> - to define a process and reflect members agreement on that process. Most notably, it spells out an agreement first and foremost that the process was correct, and then, and only then, did it proceed to executing that process. This was done to ensure there was consensus on the process.</div><div><br></div><div>From this perspective, if we were to accept Microsoft's vote, it raises the question about whether the Ballot is retroactively changing the Bylaws (if it succeeds). This is understandably troubling, as discussed during Ballots 180 - 182, as it suggests our bylaws are flexible to the point that retroactive IP risk may be introduced for members. This is part of why we so strongly objected to the approach the Chair used with respect to interpreting the execution of these Ballots, and why we supported the further clarifications in Ballot 183 as a necessary condition before introducing any further ballots using such an ad-hoc and unsupported approach.</div><div><br></div><div>Thus, it argues that Option 1 is the correct, unambiguous, and with precedent approach to resolve this issue. If this Ballot succeeds on its merits, it's clear that there's not agreement that the current language represents the Baseline of security, and that's perfectly fine and appropriate, and allows for other members to appropriately reflect that within their policies, should they so wish. This may be the most desirable outcome for everyone regardless, and so it seems entirely reasonable and appropriate to go forward on that.</div><div><br></div><div>Regarding the "Section 2" of the Ballot, the outcome of Ballot 194 in no way changes how the Baseline Requirements applies to new certificate issuance, so there is no additional 'risk' in conducting this second ballot, because as highlighted before, there is no legitimate way a CA can continue to issue such certificates without violating the Baseline Requirements. This only changes that discussion from being several weeks to being closer to two months, but that remains the prerogative of root programs to accept or reject such qualifications, as it always has.</div></div></div></div>