<div dir="ltr">Kirk,<div><br></div><div>I think it again highlights a misunderstanding about the role and relevance of the Forum to suggest that the Forum can excuse anything, lest we also suggest that the Forum also enforces compliance on its members. Similarly, it highlights a misunderstanding about whether or not compliance is a binary state. I'm sure no CA would want to be in the unenviable position of finding them retroactively sanctioned for something expressly permitted in the BRs, on the basis that the Forum later decided it was non-compliant.</div><div><br></div><div>That is, it would be unimaginable to suggest that the Forum could adopt a ballot that suggests that everything issued under 3.2.2.4 in the past year was misissuance. As such, it must also remain unimaginable to suggest that the Forum could adopt a ballot that suggests something prohibited under the past year was valid issuance. Merely, the Forum can decide what its documents state for the future. They cannot state what they want about the past, at least not without sacrificing the legitimacy and value of the Forum.</div><div><br></div><div>This is why it's terribly unproductive to keep suggesting such ballots, and instead focus on allowing discussions about the future to inform how browsers - and auditors - evaluate the past.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Sep 26, 2017 at 1:35 PM, Kirk Hall <span dir="ltr"><<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_5740299595938786785WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Ryan, of course the browsers can make any rules they like – neither I nor anyone else has questioned that.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">But likewise, the CA/Browser Forum can make any rules it likes, and it (like any Legislature in the world) can adopt its rules in the manner I described below,
including retroactively making changes to rules that have been adopted. I can provide numerous examples if you like.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">So it could be that the Forum retroactively excuses brief non-compliance with a rule that was adopted by the Forum in error. At that point, it’s up to browsers
like Google and others to decide and announce whether they agree (through their root program) or not. Both groups – the Forum and individual browsers – get to decide for themselves.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> Monday, September 25, 2017 6:22 PM<br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
<b>Cc:</b> Tim Hollebeek <<a href="mailto:THollebeek@trustwave.com" target="_blank">THollebeek@trustwave.com</a>>; Jacob Hoffman-Andrews <<a href="mailto:jsha@letsencrypt.org" target="_blank">jsha@letsencrypt.org</a>>; Doug Beattie <<a href="mailto:doug.beattie@globalsign.com" target="_blank">doug.beattie@globalsign.com</a>><span class=""><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Voting has started on Ballot 214 - CAA Discovery CNAME Errata<u></u><u></u></span></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Tue, Sep 26, 2017 at 5:39 AM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<u></u><u></u></p><div><div class="h5">
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="color:#1f497d"> So Ballot 214 would be in effect for about 12 days (Oct. 27 – Nov. 9). It’s possible a new ballot could say “It is not a violation of the BRs if CAs
did not comply with Ballot 214 after its effective date but before the effective date of this ballot.” We would know that provision had passed on about Oct. 10, but wouldn’t be effective until about Nov. 9 – but if worded correctly it would be retroactive
to the effective date of Ballot 214. I think auditors would take the position that CAs who ignored Ballot 214 for the 12 day period had not violated the BRs – we can check.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">As noted many, many times before, the suggestion of retroactive immunity is a decision for root stores - not the CA/Browser Forum. Compliance is binary, measured over time. You are either compliant or non-compliant. Our voting process establishes
what compliance is - and redefining it changes it at a future point.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Your suggestion of "not violating the BRs" is also not consistent. It would be a violation of the BRs - but the suggestion is that it can be informed through the CA/Browser Forum's consensus process whether that violation is material to
the stated principles and criteria. That is very different than what you suggest, but a subtle and important distinction worth reiterating :)<u></u><u></u></p>
</div>
</div></div></div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</blockquote></div><br></div>