<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 2020-02-06 9:25 μ.μ., Ryan Sleevi
via Public wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CACvaWvbMe9zTvqiW36D8-yfh+mg1YgYxiU4NDSKy1uVLv7Bxxw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr"><br>
</div>
</div>
</blockquote>
[...]
<blockquote type="cite"
cite="mid:CACvaWvbMe9zTvqiW36D8-yfh+mg1YgYxiU4NDSKy1uVLv7Bxxw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div> * Regarding membership, you also commented "There's
also a bootstrapping issue for membership, in that until
we know who the accepted Certificate Consumers are, no
CA can join as a Certificate Issuer. I'm curious whether
it makes sense to explicitly bootstrap this in the
charter or how we'd like to tackle this." I agree with
this concern but is it something that can be easily
worked around by having Certificate Consumers such as
Microsoft and Mozilla become the first members of the
WG?</div>
</div>
</blockquote>
<div><br>
</div>
<div>Define "easily"? The membership definition is circular
and intended to protect CAs' interests, and that's a real
problem. A Certificate Consumer is one who accepts
Certificate Issuers in the WG, meaning that if a given
Consumer moves to distrust a given issuer, such action may
result in their removal from the SMCWG, which would happen
automatically, while for CAs, they would merely be
suspended.</div>
<div><br>
</div>
<div>Beyond that, as suggested, Microsoft and Mozilla cannot
qualify as Certificate Consumers without Certificate
Issuers, and CAs cannot qualify as Certificate Issuers
without the existence of Certificate Consumers. There's no
way, valid to the Bylaws, for members to declare their
interest, because they can't meet the qualification, so it's
incorrect to suggest that this is a first-mover problem.
This is a bootstrap problem, similar to the audit, that was
flagged in the past.</div>
<div><br>
</div>
</div>
</div>
</blockquote>
<br>
This was not raised as an issue when the code signing WG was
created. During the kick-off meeting, there was a Certificate
Consumer present and Certificate Issuers that were trusted by this
Certificate Consumer. So the WG was forged at that meeting without
problems or concerns raised. I can only assume we will do the same
thing at the kick-off meeting of the SMCWG.<br>
<br>
<br>
Dimitris.<br>
<br>
<br>
</body>
</html>