<div dir="ltr">Hi Kirk,<div><br></div><div>That does seem uncharitably dismissive, and while I hope that wasn't your intent, I do want to draw your attention to it. I would note that members typically raise issues in part to understand the authors intent, as well as express the concerns, to try to collaboratively find a solution. As your response indicated you disagreed with the assessment, it does not seem like we would be able to come to a successful conclusion until you appropriately understood the concern. Despite this concern having been raised several times, you have continued to discard it, and it remains unclear whether that is an intentional dismissal of feedback that you disagreed with, or whether it we because you simply didn't understand the concern. That is why I highlighted the concern of DV, to see if it helps you understand how the scenario raised is possible, and thus, to help determine whether it is your intent to permit such a case.</div><div><br></div><div>Separately, as to language on how to resolve that, I would note that there had been suggestions offered on how to resolve this. It would be useful to know whether this is a case where this is another case where, due to the length of the discussions, you've forgotten that feedback, whether you disagree with that feedback, or whether you may not have understood how that feedback would have addressed this.</div><div><br></div><div>I do want to keep the discussion productive, and so I do want to make sure you understand the issue and agree it is an issue first, since that can save a considerable amount of time in explaining how alternatives address that issue.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 7, 2017 at 7:19 PM, Kirk Hall <span dir="ltr"><<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_6872712403700789769WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Typically when a Forum member is unhappy with the language of a pending ballot, s/he proposes specific alternate wording for consideration.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">If you want to propose an amendment to pending Ballot 190 that addresses your concerns, but that also addresses the problem we were solving as described in my
email below, please do and we’ll all give it a look.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> Thursday, September 7, 2017 3:23 PM<span class=""><br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
</span><b>Cc:</b> Peter Bowen <<a href="mailto:pzb@amzn.com" target="_blank">pzb@amzn.com</a>></span></p><div><div class="h5"><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Ballot 190 - Discussion Period is starting<u></u><u></u></div></div><p></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Wed, Sep 6, 2017 at 9:14 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Peter, let me first review how BR 4.2.1 got where it is in Ballot 190. We started the ballot by adding
back 7 validation methods from Ballot 169. Then there was a question of whether this meant CA could, or could not, reuse domain validation data under 4.2.1 for validation methods that had changed. The Validation Working Group did not intend that data that
was still in the permissible “re-use” period under 4.2.1 had to be thrown out, so we made that clear in an amendment to 4.2.1. Then there was an additional question of whether a “validation” itself (for example, combining vetting data for both an organization
and its domains in OV vetting a week before the Ballot 190 becomes effective) could still be used under 4.2.1 – this was tied to some very specific language that some were interpreting as requiring revalidation of data where a domain method had changed.
So we clarified that as well by another amendment to 4.2.1 – a prior completed validation (domain and/or organization) could still be reused under 4.2.1 for the permitted period.
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">I’m not sure I completely follow your examples below. If someone has collected OV validation data
(both organization data and domain data) on July 1, 2017, then both the data itself and the validation using that date can be reused under 4.2.1 (right now) for 39 months from that date. If the customer wants to add a new domain on July 20, 2017, that bit
of data could also be reused for 39 months, but the related organization validation data will expire 39 months after it was collected on July 1, 2017. No one could rebundle the old data one day before expiration and say “look, I just revalidated the organization
and domains” and use it for another extended period under 4.2.1.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Hi Kirk,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Please consider this example in the case of DV. I believe you will see Peter's point and the security risk that both Amazon and Google have highlighted would be introduced in the current ballot.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I hope you can consider addressing this security risk prior to voting on the ballot. As we've seen, promises to do this "after" passing take considerable time, and since the security risk here is so significant, it's difficult to believe
that it would be wise or in our users interest to support.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Again, the only reason we added “the validation itself” to the ballot was to counter a different interpretation
offered on the list. I don’t think the amended 4.2.1 language could be used as you suggest – but if you want to come up with a better way to express these concepts in a post-190 ballot, please draft it and add it to the list of further improvements the VWG
will be working on. We agree on the ultimate goal.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span><u></u><u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Peter Bowen [mailto:<a href="mailto:pzb@amzn.com" target="_blank">pzb@amzn.com</a>]
<br>
<b>Sent:</b> Wednesday, September 6, 2017 12:53 PM<br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Ballot 190 - Discussion Period is starting</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><span style="color:#888888"> <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="color:#888888">Kirk,<u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">As I have said previously, I think the changes in 4.2.1 regarding reuse are problematic for two reasons.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">First, the proposed text says "the CA obtained the data or document from a source specified under Section 3.2 or completed the validation itself”. It is not clear if the CA can
choose to do both, which would effectively extend the reuse period, or if these are mutually exclusive options. For example, assuming a reuse of 825 days, can a CA do the following?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- 1 March 2018 - Fetch a copy of domain registration information and corporate registration, complete a new validation, and issue a certificate<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- 1 May 2020 - Reuse the previously obtained registration information, complete a new validation, and issue a new certificate with the same info as the previous certificate<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- 1 July 2022 - Reuse the last validation and issue a new certificate with the same info as the previous certificates<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Second, the proposed text says "After the change to any validation method specified […], a CA may continue to reuse […] the validation itself, for the period stated in this BR 4.2.1
unless otherwise specifically provided in a ballot.”<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Right now CAs can reuse data and documents collected during validation. It isn’t that hard to run the validation workflow for each certificate issuance, using the existing data,
and make sure you have everything in place. I don’t think having the output reusable makes a lot of sense.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Peter<u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Sep 5, 2017, at 10:52 AM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">As agreed on our CABF teleconference last week, we are starting the formal discussion period for Ballot 190 (in this
case, v8). I have attached the ballot in two formats and in three modes.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The title of the actual ballot to be voted on uses all capital letters “BALLOT 190 v8 (9-5-2017)”. I also attach
a version that includes some explanatory comments, and a “clean” version showing how the BRs will read if Ballot 190 v8 is adopted “Ballot 190 v8 (9-5-2017) (showing BRs if adopted)”.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The discussion period ends Sept. 12 at 18:00 UTC, and the voting period runs Sept. 12-19.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">This version 8 is based on the prior version 7, but includes a limited number of changes as outlined in emails among
me, Ryan, and Doug on Aug. 29-30. </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We are almost there! Thanks to everyone who has worked on this effort over the past two years. Assuming Ballot
190 passes, the Validation Working Group can then start work on further amendments as outlined in my prior emails.</span><u></u><u></u></p>
</div>
<p class="MsoNormal"><BALLOT 190 v8 (9-5-2017).docx><BALLOT 190 v8 (9-5-2017).pdf><Ballot 190 v8 (9-5-2017) with comments.docx><Ballot 190 v8 (9-5-2017) with comments.pdf><Ballot 190 v8 (9-5-2017) (showing
BRs if adopted).docx><Ballot 190 v8 (9-5-2017) (showing BRs if adopted).pdf><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">_________________<wbr>______________________________<br>
Public mailing list<br>
</span><a href="mailto:Public@cabforum.org" target="_blank"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954f72">Public@cabforum.org</span></a><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif"><br>
</span><a href="https://cabforum.org/mailman/listinfo/public" target="_blank"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954f72">https://cabforum.org/mailman/<wbr>listinfo/public</span></a><u></u><u></u></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>_________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>