<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 4, 2018 at 9:48 AM, Bruce Morton <span dir="ltr"><<a href="mailto:Bruce.Morton@entrustdatacard.com" target="_blank">Bruce.Morton@entrustdatacard.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-558455951266984445WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Hi Ryan,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Here are some details on how we perform this method.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">For an OV certificate, we perform method #1 as follows:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="m_-558455951266984445MsoListParagraph"><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><span>1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Order is received with the subject name, SANs, a certificate requester and an authorization contact. The authorization contact must be employed by the
organization in the subject name.</span></p></div></div></blockquote><div>How can you vet that? You've not vetted anything yet, so how can you vet the Applicant's employment status? I think you're trying to hint at this in 4, but that's unclear.</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_-558455951266984445WordSection1"><p class="m_-558455951266984445MsoListParagraph"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="m_-558455951266984445MsoListParagraph"><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><span>2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">BR 3.2.2.1 is performed to confirm the identity of the organization. This task is done with using a QIIS.</span></p></div></div></blockquote><div>Note that the concerns about QIIS apply here - as we've seen with situations like "Stripe, Inc" in Kentucky. At this point, you've verified that some organization exists, but that's based entirely on Applicant-provided data (namely, the Applicant provided the organization-to-vet in 1, which is under their control - e.g. "Stripe, Inc" in Kentucky)</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_-558455951266984445WordSection1"><p class="m_-558455951266984445MsoListParagraph"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="m_-558455951266984445MsoListParagraph"><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><span>3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">BR 3.2.2.4.1 is performed using registrar information to confirm the organization has registered the domain name. The QIIS is used to identify relationships
if the domain is registered to a parent or subsidiary.</span></p></div></div></blockquote><div>As Jeremy highlighted, this is both insufficiently described and inherently dangerous. That you have is that _an_ organization with a name such as "Stripe, Inc" requested a certificate. Are you obtaining the full jurisdiction of incorporation information from the registrar (I would be curious which registrars they are, given the various collection policies that contractually apply)? If not, then you're back to relying on the 'fuzzy match' - for example, does the registrar say "Stripe, Inc" at this address applied for it? As shown with both the QGIS and QIIS situations, this is not a particularly robust method - and that's assuming y'all were trying to "do it right"</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_-558455951266984445WordSection1"><p class="m_-558455951266984445MsoListParagraph"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="m_-558455951266984445MsoListParagraph"><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><span>4.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">BR 3.2.5 is performed by finding contact information for the organization using a QIIS. The authorization contact is called at the organization using
this information. The authorization contact is asked to confirm that a certificate with the organization name, using the domain name(s) requested, can be issued to the certificate requester.</span></p></div></div></blockquote><div>This doesn't link the Applicant's employment status - just the authorization. Further, given that Entrust has argued strongly in favor of reusing past validations, I'm guessing that this authorization is then applied to subsequent requests. Further, given the BRs allow you to reuse data and documents, do you use such authorizations for additional domain names?</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_-558455951266984445WordSection1"><p class="m_-558455951266984445MsoListParagraph"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thanks, Bruce.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> January 4, 2018 12:09 AM<br>
<b>To:</b> Bruce Morton <<a href="mailto:Bruce.Morton@entrustdatacard.com" target="_blank">Bruce.Morton@entrustdatacard.<wbr>com</a>><br>
<b>Cc:</b> Rich Smith <<a href="mailto:richard.smith@comodo.com" target="_blank">richard.smith@comodo.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>>; Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>><br>
<b>Subject:</b> Re: [EXTERNAL]Re: [cabfpub] Ballot 218: Remove validation methods #1 and #5<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Wed, Jan 3, 2018 at 5:27 PM, Bruce Morton <<a href="mailto:Bruce.Morton@entrustdatacard.com" target="_blank">Bruce.Morton@entrustdatacard.<wbr>com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">I disagree.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Removing, changing and adding back in method #1 is not a productive exercise. This method has been used for probably 20 years and yet we never see any
notifications, articles, alerts, etc. of how this method was defeated by an attacker.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I think it's exceptionally dangerous to rest on that, particularly since CAs such as Entrust don't make available to the public their processes and controls to inspect whether or not they're vulnerable. I am greatly appreciative to Jeremy
sharing the case of customers from a CA they acquired not being validated to the level that DigiCert holds itself - but that's hardly to be expected, unless we are to suggest DigiCert should buy out every other CA.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It was this philosophical opposition that resulted in MD5 being exploited 'in the wild' - CAs ignoring the literature and research and demanding 'proof it applied'<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Does Entrust (or the CAs it has acquired) use this method? Can you share the details that are used to do this?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I stand by the assertion that while it may be possible to restrict what is done under 3.2.2.4.1 to be 'secure', that is not what it is in the language, and what is presently executed is demonstrably insecure. If we are to suggest that we,
as an industry, care about security of our users, then we should make tradeoffs that favor security.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Note, I agree that method #1 can be approved in the BRs, but please advise which CAs have not already improved this method in practice? If a CA finds
a BR requirement to be weak, they should either not use it or improve the process in their own practices. I assume that many BR requirements were not intended to have loopholes, but were written to allow competitiveness in the way they are adopted.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Fundamentally, I disagree with this framing. System security works by ensuring the minimum level of security is appropriate - not that every CA will be smart enough, well-versed in the nuance enough, and/or financially motivated enough
to 'not be creative'.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">I think that the current ballot 218 is bypassing the working group process where a working group was created by ballot to improve the validation methods.
Is this the intension?</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This is not, nor has it never been, required by our Bylaws. There have been suggestions from some CAs to try to do this, but this has historically turned out to be a stalling tactic.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Does Entrust employ 3.2.2.4.1? If so, given that it's required to track the validation methods it uses, can you share approximately how many or what percentage of certs you use it for, and how you use it? This can go leaps and bounds to
providing meaningful data about the potential impact to the ecosystem from disallowing it, without the deliberative delays.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">If we are going to support abrupt ballots, then I would suggest that they at least be split into one topic and discuss method #1 and #5 independently.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Finally, what is the rush? Why can’t this change be discussed at the bi-weekly CAB Forum meeting or Validation Working Group meeting at least once before
a pre-ballot is produced? And why effective March 1, 2018? Not only has method #1 been highly effective for 20 years, but we have also just updated the validation methods to support ballot 190. More time would allow CAs to add changes to their release cycles
and allow Subscribers to learn new validation processes they will now have to adopt.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Security comes first. That sounds like a considerable stalling tactic, to be honest. Is this because Entrust specifically uses 3.2.2.4.1, or are you opposing it on procedural grounds? This, too, will help understand both the substance of
the objections and potential paths to addressing them.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">I am open to change BR requirements, but do not support ballot 218.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Bruce. </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> Public [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@<wbr>cabforum.org</a>]
<b>On Behalf Of </b>Rich Smith via Public<br>
<b>Sent:</b> January 3, 2018 4:44 PM<br>
<b>To:</b> 'Ryan Sleevi' <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>>; 'CA/Browser Forum Public Discussion List' <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>>; Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Ballot 218: Remove validation methods #1 and #5<u></u><u></u></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I agree with Ryan on this and stand by my endorsement of this ballot to move forward. I’m not opposed to adding 3.2.2.4.1 back in if it can be made much more secure and brought
up to equivalent level with the other methods, but I also have my doubts as to whether or not that is possible in the broad sense across all TLDs and registrars. That being the case I think the best course is to remove it for now because in it’s present form
is extremely weak and add back later if and when it has undergone sufficient revisions to make it secure.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Regards,<u></u><u></u></p>
<p class="MsoNormal">Rich<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><b>From:</b> Public [<a href="mailto:public-bounces@cabforum.org" target="_blank">mailto:public-bounces@<wbr>cabforum.org</a>]
<b>On Behalf Of </b>Ryan Sleevi via Public<br>
<b>Sent:</b> Wednesday, January 3, 2018 2:24 PM<br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a><wbr>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
<b>Subject:</b> Re: [cabfpub] Ballot 218: Remove validation methods #1 and #5<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">Hi Kirk,<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">We had two endorsers for the discussion. As I mentioned, there's nothing inherent in needing to direct this to VWG. As DigiCert has pointed out, there are CAs today that are doing
validations that are patently insecure.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">While we can understand and appreciate that some members may wish to introduce new validation methods that are limited in scope and applicability (for example, Mads' example only
applies to a limited subset of ccTLDs, and cannot be done safely generically), in order to reduce that risk, I think it's entirely appropriate to take the necessary steps to ensure the safety of the Internet at large.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">This does not prevent or inhibit the issuance of certificates that have appropriate controls - that is, these methods could be argued as an 'optimization' - and thus we should not
unduly delay progress. Regarding passing it to the VWG, could you indicate where you saw that was suggested? The only mention of it I saw was from you, on a separate thread, and I'm curious if perhaps I've missed additional discussion. Certainly, our workmode
does not require sending such discussions "to committee"<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">On Wed, Jan 3, 2018 at 3:10 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">Tim, I thought this issue was going to be discussed first by the VWG, as several CAs have indicated they would like to keep (but improve) Method 1.
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> Public [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@<wbr>cabforum.org</a>]
<b>On Behalf Of </b>Tim Hollebeek via Public<br>
<b>Sent:</b> Wednesday, January 3, 2018 11:22 AM<br>
<b>To:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
<b>Subject:</b> [EXTERNAL][cabfpub] Ballot 218: Remove validation methods #1 and #5<u></u><u></u></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Ballot 218: Remove validation methods #1 and #5<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Purpose of Ballot: Section 3.2.2.4 says that it “defines the permitted processes and procedures for validating the Applicant’s ownership or control of the domain.” Most of the
validation methods actually do validate ownership and control, but two do not, and can be completed solely based on an applicant’s own assertions.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Since these two validation methods do not meet the objectives of section 3.2.2.4, and are actively being used to avoid validating domain control or ownership, they should be removed,
and the other methods that do validate domain control or ownership should be used.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">The following motion has been proposed by Tim Hollebeek of DigiCert and endorsed by Ryan Sleevi of Google and Rich Smith of Comodo.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">-- MOTION BEGINS –<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates” as follows, based upon Version 1.5.4:<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">In Section 3.2.2.4.1, add text at the end: “For certificates issued on or after March 1, 2018, this method SHALL NOT be used for validation, and completed validations using this
method SHALL NOT be used for the issuance of certificates.”<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">In Section 3.2.2.4.5, add text at the end: “For certificates issued on or after March 1, 2018, this method SHALL NOT be used for validation, and completed validations using this
method SHALL NOT be used for the issuance of certificates.”<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none">
In Section 4.2.1, after the paragraph that begins “After the change to any validation method”, add the following paragraph: “Validations completed using methods specified in Section 3.2.2.4.1 or Section 3.2.2.4.5 SHALL NOT be re-used on or after March 1, 2018.”<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">-- MOTION ENDS –<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">For the purposes of section 4.2.1, the new text added to 4.2.1 from this ballot is “specifically provided in a [this] ballot.”<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">The procedure for approval of this ballot is as follows:<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Discussion (7+ days)
<u></u><u></u></p>
<p class="MsoNormal"> Start Time: 2017-01-03 19:30:00 UTC
<u></u><u></u></p>
<p class="MsoNormal"> End Time: Not Before 2017-01-10 19:30:00 UTC<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Vote for approval (7 days)
<u></u><u></u></p>
<p class="MsoNormal"> Start Time: TBD
<u></u><u></u></p>
<p class="MsoNormal"> End Time: TBD<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>_________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div></div>