<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Sun, Sep 23, 2018 at 9:14 PM Kirk Hall via Public <<a href="mailto:public@cabforum.org">public@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_517091071321783397WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Ryan, I’m glad you referred to our Sept. 20 SCWG teleconference in your message below, and what was said there. I went back to listen and I prepared draft Minutes on the Shanghai
Agenda/audits issues portion. (I’m sending those Minutes to the Management list because they have not yet been approved for publication on the Public list.) I also included a link in that message to the recording so interested members can confirm for themselves
what was said on the call.</span></p></div></div></blockquote><div><br></div><div>These were posted to the Public List, and I think it's good for the transparency of the discussion.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_517091071321783397WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The recording and draft Minutes of our Thursday teleconference do not support your recollection of the call as presented below. Here are the main takeaways from the 15 minute
discussion on the call.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="m_517091071321783397MsoListParagraph"><u></u><span style="font-size:11.0pt;font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I asked if anyone had Agenda items to propose for the Shanghai meeting. You suggested the Forum discuss
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">the process for inclusion of roots in browser root programs from the auditing standpoint, the audits required from birth to death of a CA, and the variety of program requirements in place
that require different things. You said clarity and consensus on that and related verbiage would be useful, and this also applies to reworked language in BR 8.1 and 8.2 and confusion around performance audits. You thought these issues could take at least
an hour of time at the meeting, and that 30 minutes might be necessary to get everyone on the same page concerning audit vocabulary, as some people use phrases that don’t match with professional terms. You said the goal was to a common understanding as well
as diagramming what the expected process should look like with the appropriate audit schemes recognized. You did not initially say you wanted to be a presenter or the sole presenter on all these related issues.</span></p></div></div></blockquote><div>I think the key point here is that I was requesting a slot, of 60 to 90 minutes, to cover these issues. Thank you for confirming the accuracy of this, and it seems the only confusion here is that despite requesting this slot, you did not believe it was being requested?</div><div><br></div><div>I think your record of the minutes also does not capture your dismissiveness of the issue, and I certainly can see why clarity is necessary, as it seems you're intent on not scheduling the request.</div><div><br></div><div>The request being made here - and the issue described - is because they are all tightly coupled, and I believe would most benefit the Forum discussed as a single, concerted topic, that explores those relations - as we requested. I am explicitly requesting this separate from the WebTrust and ACAB-C updates, because I believe it is beneficial to have a discussion that focuses on the common understanding these issues as they stand. As we've seen, our WebTrust folks are excellent about talking about WebTrust - but are not so at ETSI, and so to the opposite. </div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_517091071321783397WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">That’s pretty much how I broke things down on my Agenda proposal on Friday. </span></p></div></div></blockquote><div><br></div><div>Yes. And I'm objecting to that, because I believe you've taken a description of a session that was specifically being requested, which you disagreed with, and attempted to reorganize the content, structure, and presentation. As discussed from our past meetings, it's clear you do not view some of these matters as important, nor do you appreciate the issues at play.</div><div><br></div><div>I believe this will be a far more productive use of folks time, energy, and expectations, if we can have that discussion, particularly for browser members, if taken as a cohesive single presentation that examines the current state.</div><div><br></div><div>That does not conflict with the ETSI or WebTrust updates, it does not conflict with (other than an ordering dependency) with Wayne's suggestion made in person previously. Indeed, the specific request for this session emerged from those discussions, and through discussions that made it clear a more cohesive understanding was necessary.</div><div><br></div><div>As such, I would like to, unfortunately yet again, request that 60-90 minutes be set aside in the schedule.</div><div><br></div><div>For ordering purposes:</div><div>- 60-90 minutes - Discussion of current state of audits and membership requirements (Ryan)</div><div>- 60 minutes - Discussion about future audit requirements (Wayne)</div><div><br></div><div>And that these discussions would best benefit independent from the WebTrust TF or ETSI updates, which are incredibly valuable, but somewhat orthogonal to the conversation proposed.</div><div><br></div><div>Please update the agenda to reflect this request.</div></div></div>