<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">Hi Ryan,</span><div class=""><br class=""></div><div class="">I’m glad to see that you’re supportive of a code of conduct. Thanks for reviewing the differences between CAs and browsers. I just don’t see anything in those differences that would prevent the adoption of the proposed Code of Conduct. I don’t think there’s anything inherent in the asymmetrical relationship between CAs and browsers that would prevent either category of members from being polite, professional, and respectful to the other. </div><div class=""><br class=""></div><div class="">It would be extremely helpful if you would please point out the specific language in the proposed Code of Conduct that you believe would prevent browsers from enforcing their expectations with CAs? Does that require unreasonable conduct? </div><div class=""><div class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><span class="" style="orphans: 2; widows: 2;"><span style="font-family: Arial; orphans: auto; widows: auto;" class=""><br class=""></span></span></div><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><span class="" style="orphans: 2; widows: 2;"><br class=""></span></div><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">Best regards,</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial; min-height: 17px;" class=""><br class=""></div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">Virginia Fournier</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">Senior Standards Counsel</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class=""><span style="line-height: normal; font-family: 'Myriad Set Pro'; color: rgb(94, 94, 94); -webkit-text-stroke-color: rgb(94, 94, 94);" class=""></span> Apple Inc.</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">☏ 669-227-9595</div><div style="margin: 0px; font-size: 14px; line-height: normal; color: rgb(71, 135, 255); -webkit-text-stroke-color: rgb(71, 135, 255); -webkit-text-stroke-width: initial;" class=""><span style="color: rgb(0, 0, 0); -webkit-text-stroke-color: rgb(0, 0, 0);" class="">✉︎ <a href="mailto:vmf@apple.com" class=""><span style="-webkit-text-stroke-color: rgb(71, 135, 255);" class="">vmf@apple.com</span></a></span></div></div><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><div class="" style="orphans: 2; widows: 2;"><div class=""><br class=""></div><div class=""><br class=""></div></div></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""><div><div class="">On Apr 26, 2017, at 12:11 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Wed, Apr 26, 2017 at 2:21 PM, Virginia Fournier via Public <span dir="ltr" class=""><<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class=""><span class="">While this may be true, I'm not Mozilla's representative to those<br class="">organizations :-) And anyway, if "someone else does it" were a<br class="">concluding argument, we would not be having any discussion at all about<br class="">what's best for us.</span></div><div class=""><br class=""></div><div class=""><font color="#ff9300" class="">**VMF 4/26: As mentioned above, Mozilla Foundation is the member of CAB Forum, W3C, and WhatWG, and not any individual person. So, hopefully Mozilla would be able to agree to the same code of conduct terms it has already agreed to in the other groups. </font></div></div></blockquote><div class=""><br class=""></div><div class="">I totally appreciate where you're coming from - but I think it may not be clear that the operation of the CA/Browser Forum is very much different than that of, say, the W3C or WHATWG. There is very much a different dynamic at play here, most obviously through things like our Antitrust Statement.</div><div class=""><br class=""></div><div class="">We have CAs, which are organizations that, whether through explicit legal contracts or through community agreements and committments, are trusted to provide services for the Browser members. The Browser members can and do take the steps necessary to protect their users from security incidents, and the Forum serves largely as a way to both solicit feedback in a transparent manner and to ensure that these changes don't meaningfully conflict with other Browsers' security goals.</div><div class=""><br class=""></div><div class="">I think it may help to think of other organizations, like PCI SSC, in which the core firms - whether it be Visa, MasterCard, etc or Google, Apple, Microsoft, etc - are responsible for enforcing compliance, and the goal is to ensure a common-baseline.</div><div class=""><br class=""></div><div class="">I suppose put differently - the goal of the CA/Browser Forum is not to determine what is the best security for the industry, or for a given browser member, or for the Web. It's goal is to define and deconflict individual Browser members' expectations of the companies they contract with or delegate keys to the Internet to, and to leave enforcement to the Browsers.</div><div class=""><br class=""></div><div class="">And so understandably, I think both Robin and Gerv have captured one aspect of that dynamic for which the policy highlights some issues - is that Browser Members may _enforce_ their expectations (contractual or otherwise) upon a CA member, and so there is not an equality among members or a shared and common purpose for which we all agree on. This is very different from both the W3C and the WHATWG, which aim to collaboratively produce new documents, but have zero enforcement arm, particularly around compliance. Browsers can, and do, so this creates a dimension to a lot of the discussions that cannot be ignored.</div><div class=""><br class=""></div><div class="">For example, the documents the Forum produces are the Baselines. Every Browser Member here has additional requirements, specific to their product, that go above and beyond these Baselines, and there is no intent (or necessity) to incorporate them in to the Baseline, because it reflects the different Members' needs and objectives. </div><div class=""><br class=""></div><div class="">My own take of the zeitgeist of some of these comments is that, while the spirit of a code of conduct is absolutely welcome and appreciated, we want to recognize this dynamic - and the challenges it produces - and the asymmetric nature of the relationships, as otherwise, we're simply exacerbating some already strained relationships. Put differently, there are no neutral or equal parties here in the Forum :)</div></div><br class=""></div></div>
</div></div><br class=""></div></body></html>