<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Wayne and all,<div class=""><br class=""></div><div class="">We can discuss these issues at the next Governance WG meeting.<br class=""><div class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><span class="" style="orphans: 2; widows: 2;"><span style="font-family: Arial; orphans: auto; widows: auto;" class=""><br class=""></span></span></div><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><span class="" style="orphans: 2; widows: 2;"><br class=""></span></div><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">Best regards,</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial; min-height: 17px;" class=""><br class=""></div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">Virginia Fournier</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">Senior Standards Counsel</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class=""><span style="line-height: normal; font-family: 'Myriad Set Pro'; color: rgb(94, 94, 94); -webkit-text-stroke-color: rgb(94, 94, 94);" class=""></span> Apple Inc.</div><div style="margin: 0px; font-size: 14px; line-height: normal; -webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: initial;" class="">☏ 669-227-9595</div><div style="margin: 0px; font-size: 14px; line-height: normal; color: rgb(71, 135, 255); -webkit-text-stroke-color: rgb(71, 135, 255); -webkit-text-stroke-width: initial;" class=""><span style="color: rgb(0, 0, 0); -webkit-text-stroke-color: rgb(0, 0, 0);" class="">✉︎ <a href="mailto:vmf@apple.com" class=""><span style="-webkit-text-stroke-color: rgb(71, 135, 255);" class="">vmf@apple.com</span></a></span></div></div><div class="" style="color: rgb(0, 0, 0); font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Helvetica; line-height: normal;"><div class="" style="orphans: 2; widows: 2;"><div class=""><br class=""></div><div class=""><br class=""></div></div></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<div><br class=""><div class="">On Jan 19, 2018, at 3:54 PM, <a href="mailto:public-request@cabforum.org" class="">public-request@cabforum.org</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Send Public mailing list submissions to<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="mailto:public@cabforum.org" class="">public@cabforum.org</a><br class=""><br class="">To subscribe or unsubscribe via the World Wide Web, visit<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>https://cabforum.org/mailman/listinfo/public<br class="">or, via email, send a message with subject or body 'help' to<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>public-request@cabforum.org<br class=""><br class="">You can reach the person managing the list at<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>public-owner@cabforum.org<br class=""><br class="">When replying, please edit your Subject line so it is more specific<br class="">than "Re: Contents of Public digest..."<br class=""><br class=""><br class="">Today's Topics:<br class=""><br class=""> 1. Re: Pre-Ballot 206 - Amendment to IPR Policy & Bylaws re<br class=""> Working Group Formation (Wayne Thayer)<br class=""> 2. Re: [EXTERNAL] Verification of Domain Contact and Domain<br class=""> Authorization Document (Geoff Keating)<br class=""><br class=""><br class="">----------------------------------------------------------------------<br class=""><br class="">Message: 1<br class="">Date: Fri, 19 Jan 2018 13:30:37 -0700<br class="">From: Wayne Thayer <wthayer@mozilla.com><br class="">To: Virginia Fournier <vfournier@apple.com>, "CA/Browser Forum Public<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Discussion List" <public@cabforum.org><br class="">Subject: Re: [cabfpub] Pre-Ballot 206 - Amendment to IPR Policy &<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Bylaws re Working Group Formation<br class="">Message-ID:<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><CAJE6Z6cn0RXHBZWDNNS=Qkvr6PmDvXMx1-+XwyPBxVq+V8uLJw@mail.gmail.com><br class="">Content-Type: text/plain; charset="utf-8"<br class=""><br class="">On Fri, Jan 19, 2018 at 12:03 PM, Virginia Fournier via Public <<br class="">public@cabforum.org> wrote:<br class=""><br class=""><blockquote type="cite" class="">Yes, a Working Group can form its own subcommittees within itself.<br class=""><br class=""></blockquote><br class="">I don't think this statement is obviously true. The current bylaws define<br class="">these "subcommittees" (called Working Groups) - the new bylaws do not. So<br class="">one reasonable interpretation is that they can no longer exist. For<br class="">example, if we go to appoint a chair and create a mailing list for a new<br class="">"subcommittee", what are the odds that someone will say "you can't do that<br class="">- there is no such thing as a subcommittee and what you're really doing is<br class="">creating a new WG without following the process?"<br class=""><br class="">Someone asked whether all of the WGs would be subgroups under the Server<br class=""><blockquote type="cite" class="">Certificate WG - and that is clearly not the intent.<br class=""><br class="">The new bylaws imply that the existing WGs will become new WGs in section<br class=""></blockquote>5.3.4 - Legacy Working Groups. However some fundamental flaws have been<br class="">pointed out with this structure in the case where the WG's purpose involves<br class="">server certificates. To reiterate, if the Validation WG recharters under<br class="">the new bylaws, it will no longer be able to take its work product back to<br class="">the Server Certificate WG for review and approval.<br class=""><br class="">Also, please note that the *same* Bylaws and IPR policy apply to all WGs.<br class=""><blockquote type="cite" class=""><br class="">The structure is *intended to be different* from what we have now. It<br class="">needs to be different because right now IP commitments apply to all of the<br class="">Forum?s activities. Under the new structure, IP commitments will only<br class="">apply to the WGs in which a member is participating - this necessarily<br class="">makes the structure more complex.<br class=""><br class="">Yes, the structure is intended to be different to address IP issues, but I<br class=""></blockquote>suspect the assumption has been made that the existing "subcommittee"<br class="">system can continue under the new structure without exploring all of the<br class="">implications.<br class=""><br class="">Someone also commented that we can all ask multiple questions and make<br class=""><blockquote type="cite" class="">additional changes during the discussion period. I?m at a complete loss as<br class="">to why questions haven?t already been asked and comments not already made.<br class="">As you are all aware, we?ve been working on and discussing all of these<br class="">documents *for well over a year*. Please *engage in the process now*,<br class="">read the documents, and ask questions and make comments now, rather than<br class="">holding up the voting period when we get there.<br class=""><br class="">I am asking for the Governance WG to explain what is going to happen with<br class=""></blockquote>each existing WG before we adopt the new bylaws. Given the concerns that<br class="">have been raised, I do not believe this is an unreasonable request.<br class=""><br class=""><blockquote type="cite" class=""><br class="">Best regards,<br class=""><br class="">Virginia Fournier<br class="">Senior Standards Counsel<br class="">? Apple Inc.<br class="">? 669-227-9595 <(669)%20227-9595><br class="">?? vmf@apple.com<br class=""><br class=""><br class=""></blockquote>-------------- next part --------------<br class="">An HTML attachment was scrubbed...<br class="">URL: <http://cabforum.org/pipermail/public/attachments/20180119/1ea5bdea/attachment-0001.html><br class=""><br class="">------------------------------<br class=""><br class="">Message: 2<br class="">Date: Fri, 19 Jan 2018 15:54:48 -0800<br class="">From: Geoff Keating <geoffk@apple.com><br class="">To: Kirk Hall <Kirk.Hall@entrustdatacard.com><br class="">Cc: CA/Browser Forum Public Discussion List <public@cabforum.org><br class="">Subject: Re: [cabfpub] [EXTERNAL] Verification of Domain Contact and<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Domain Authorization Document<br class="">Message-ID: <280AFA6E-CAB1-4673-8318-4FFBB733AF2D@apple.com><br class="">Content-Type: text/plain; charset="utf-8"<br class=""><br class=""><br class=""><br class=""><blockquote type="cite" class="">On Jan 19, 2018, at 12:16 PM, Kirk Hall <Kirk.Hall@entrustdatacard.com> wrote:<br class=""><br class="">Sorry for the misquotation ? I left off ?*** directly with the Domain Name Registrar,? which is generally what we have been discussing ? a WhoIs lookup to see who owns the domain.<br class=""></blockquote><br class="">That wasn?t my objection?it was to the words ?by verifying that?.<br class=""><br class=""><blockquote type="cite" class="">But do you see my point that ?validating the Applicant as the Domain Contact? (current language) could simply be confirming a hacker in both roles, but would not be validating the Registrant information as to the organization that owns the domain? <br class=""><br class="">Which would not be sufficient to include the Registrant Organization name in the O field of an OV or EV cert. That?s why we made the change, which makes Method 1 more secure in our opinion.<br class=""></blockquote><br class="">Are some CAs validating by saying that, for example, someone has control of cabforum.org and so based only on that and the whois information they can be issued a certificate with O=Go Daddy? That would be unfortunate.<br class=""><br class="">As a side note, do you think it would be helpful to put something in the BRs to basically say ?you still have to validate everything in a certificate; if these BRs appear to allow a process which is not an effective validation, or some choices in your implementation of the process makes it ineffective, you must do whatever additional process is necessary to ensure an effective validation?? An overall ?don?t be stupid? rule.<br class=""><br class=""><blockquote type="cite" class="">Again, Method 1 was the original validation method starting in the 1990s, and I think it?s proven its worth over the years.<br class=""></blockquote><br class="">Processes often work great until someone works out how to abuse them, and then they don?t, sadly.<br class=""><br class=""><blockquote type="cite" class=""><br class="">From: geoffk@apple.com [mailto:geoffk@apple.com] <br class="">Sent: Friday, January 19, 2018 11:52 AM<br class="">To: Kirk Hall <Kirk.Hall@entrustdatacard.com><br class="">Cc: CA/Browser Forum Public Discussion List <public@cabforum.org>; Mads Egil Henriksveen <Mads.Henriksveen@buypass.no><br class="">Subject: Re: [cabfpub] [EXTERNAL] Verification of Domain Contact and Domain Authorization Document<br class=""><br class=""><br class=""><br class=""><br class="">On Jan 19, 2018, at 11:23 AM, Kirk Hall <Kirk.Hall@entrustdatacard.com <mailto:Kirk.Hall@entrustdatacard.com>> wrote:<br class=""><br class="">First, I think everyone knows what CAs are supposed to do under Method 1<br class=""><br class="">I?m fairly sure this is not the case?<br class=""><br class=""><br class="">, and the lack of misissuance reports means CAs are doing it right. Here?s how Method 1 starts now:<br class=""><br class="">?Conforming the Applicant's control over the FQDN by validating the Applicant as the Domain Contact by verifying that: ***?<br class=""><br class="">You can see why I think CAs might not know what they?re supposed to do, because the above quote is not the actual words from the the Baseline Requirements! Right now, in BR 1.5.4, Method 1 starts with these words:<br class=""><br class="">Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact directly with the Domain Name Registrar. This method may only be used if:<br class=""><br class="">Your version prescribes a method. The actual current requirements specify an objective and don?t specify a method.<br class=""><br class="">Now, I?m not against prescribing a method, but the method prescribed does need to achieve the original objective, and I think the proposed method is inadequate to do that?<br class=""></blockquote><br class="">-------------- next part --------------<br class="">An HTML attachment was scrubbed...<br class="">URL: <http://cabforum.org/pipermail/public/attachments/20180119/3087e6c6/attachment.html><br class=""><br class="">------------------------------<br class=""><br class="">Subject: Digest Footer<br class=""><br class="">_______________________________________________<br class="">Public mailing list<br class="">Public@cabforum.org<br class="">https://cabforum.org/mailman/listinfo/public<br class=""><br class=""><br class="">------------------------------<br class=""><br class="">End of Public Digest, Vol 69, Issue 89<br class="">**************************************<br class=""></div></div></div><br class=""></div></body></html>