<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:782454099;
mso-list-template-ids:-2137850724;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>The bootstrapping issue was discussed extensively during governance reform, and it was noted that there are a number of ways to deal with it, including the one you mention. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Tim<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Wayne Thayer <wthayer@gmail.com> <br><b>Sent:</b> Thursday, February 6, 2020 2:05 PM<br><b>To:</b> Ryan Sleevi <sleevi@google.com><br><b>Cc:</b> CABforum1 <public@cabforum.org>; Tim Hollebeek <tim.hollebeek@digicert.com>; Clint Wilson <clint_wilson@apple.com><br><b>Subject:</b> Re: [cabfpub] Ballot Forum-11: Creation of S/MIME Certificates Working Group<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>Ryan - Thank you for pointing out the past discussions. it's unfortunate that this ballot has lingered for so long and as a result it's possible that some of your feedback from a year ago was (unintentionally, I believe) "ignored". In reviewing [12], I observe the following:<o:p></o:p></p></div><div><p class=MsoNormal> * As noted, most, but not all of your comments relate to identity, an issue that is intended to be decided via ballot.<o:p></o:p></p></div><div><p class=MsoNormal> * You state "I'll also duplicate them as suggested edits on the doc after sending this, to provide more concrete and hopefully productive guidance." Did you share a redline with suggested changes?<o:p></o:p></p></div><div><p class=MsoNormal> * Your comment "Finally, regarding membership criteria, I'm curious whether it's necessary to consider WebTrust for CAs / ETSI at all." was discussed in the thread without reaching agreement.<o:p></o:p></p></div><div><p class=MsoNormal> * Regarding membership, you also commented "There's also a bootstrapping issue for membership, in that until we know who the accepted Certificate Consumers are, no CA can join as a Certificate Issuer. I'm curious whether it makes sense to explicitly bootstrap this in the charter or how we'd like to tackle this." I agree with this concern but is it something that can be easily worked around by having Certificate Consumers such as Microsoft and Mozilla become the first members of the WG?<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>What other important issues have we "ignored"?<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>- Wayne<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Wed, Feb 5, 2020 at 4:35 PM Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><div><p class=MsoNormal>Just to make sure the timing is accurate:<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>2018-05 - Tim Hollebeek circulates a draft charter, largely modeled after the code signing charter [1]. <o:p></o:p></p></div><div><p class=MsoNormal>2018-06 - F2F 44 provides significant discussion on this issue and the potential concerns. [2]<o:p></o:p></p></div><div><p class=MsoNormal>2018-07 - Ballot 208 [3] is finalized, which sets forth the requirements for creating new CWG charters.<o:p></o:p></p></div><div><p class=MsoNormal>2018-10 - F2F 45 reiterates the concerns previously raised [4], with the conclusion being<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:3.75pt;margin-left:15.0pt;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:#333333'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#333333'>Ben – It sounds like the initial charter should focus on three aspects: profile, identity validation of email and identity (host and local part), and private key protection.<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:3.75pt;margin-left:15.0pt;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:#333333'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#333333'>Kirk Hall, Entrust – Is that enough to start drafting a charter?<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:3.75pt;margin-left:15.0pt;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:10.0pt;font-family:Symbol;color:#333333'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#333333'>Ben – Yes, I can start a charter based on those three principles.<o:p></o:p></span></p></blockquote><div><p class=MsoNormal>2019-01 - Ben Wilson circulates an updated draft for feedback [5]. This draft is substantially more expansive, due to the changes in Ballot 206.<o:p></o:p></p></div><div><p class=MsoNormal>2019-03 - F2F 46 is held in Cupertino. While the minutes show [6] there is still scope issue, a clear and viable path forward, previously raised, is reiterated.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#333333'>Dean – We have a blank slate here and it seems the reluctance was to make it a narrow scope and then focus on either one aspect of SMIME. First task might be how to validate an email, and then focus on identity validation. Some comments were to make the chart narrow to focus on one task while others say to include all proposed tasks to not have to recharter which has caused issues in the past.</span> <o:p></o:p></p></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>2019-06 - F2F 47 is held in Thessaloniki [7], where again we discuss the same topic.<o:p></o:p></p></div><div><p class=MsoNormal>2019-12 - Tim circulates the first draft version [8], the week before Christmas. This is the first version that has been circulated since Ben Wilson's 2019-01 version. Feedback is provided by Wayne [9] to be addressed.<o:p></o:p></p></div><div><p class=MsoNormal>2019-01 - Tim starts the discussion period for this ballot [10]<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I highlight this timeline, because it does seem somewhat concerning that after significant good faith effort to discuss the issues, these are seemingly intentionally ignored in forcing a vote that intentionally ignores feedback during the discussion period [11]. For example, [10] represents the first time of seeing any draft on how the concerns were raised. Given the significant beneficial edits proposed by Apple, for example, Google did not submit its many procedural and practical concerns with the draft language, on the hope that there would be a good faith effort to engage with and discuss these issues.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>It's equally concerning that the effort and time spent in communicating on the previous draft, in [5], was entirely ignored in [8], which entirely precipitated the issues in [9]. Substantive issues, such as those raised in [12], were entirely ignored, and are largely orthogonal to the debate about identity but to the very core of the charter.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I can understand that, if the view is we are at an impasse, then rough consensus is a path forward. However, it remains deeply disappointing that it seems that virtually all feedback, from a variety of participants, has been ignored, as shown through the minutes and the past proposed changes. That does not seem to be in the spirit of what you've suggested the intent is.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>[1] <a href="https://cabforum.org/pipermail/public/2018-May/013400.html" target="_blank">https://cabforum.org/pipermail/public/2018-May/013400.html</a><o:p></o:p></p></div><div><p class=MsoNormal>[2] <a href="https://cabforum.org/2018/06/06/minutes-for-ca-browser-forum-f2f-meeting-44-london-6-7-june-2018/" target="_blank">https://cabforum.org/2018/06/06/minutes-for-ca-browser-forum-f2f-meeting-44-london-6-7-june-2018/</a><o:p></o:p></p></div><div><p class=MsoNormal>[3] <a href="https://cabforum.org/2018/04/03/ballot-206-amendment-to-ipr-policy-bylaws-re-working-group-formation/" target="_blank">https://cabforum.org/2018/04/03/ballot-206-amendment-to-ipr-policy-bylaws-re-working-group-formation/</a> <o:p></o:p></p></div><div><p class=MsoNormal>[4] <a href="https://cabforum.org/2018/10/18/minutes-for-ca-browser-forum-f2f-meeting-45-shanghai-17-18-october-2018/#6-Creation-of-additional-Working-Groups---Secure-Mail-Other" target="_blank">https://cabforum.org/2018/10/18/minutes-for-ca-browser-forum-f2f-meeting-45-shanghai-17-18-october-2018/#6-Creation-of-additional-Working-Groups---Secure-Mail-Other</a><o:p></o:p></p></div><div><p class=MsoNormal>[5] <a href="https://cabforum.org/pipermail/public/2019-January/014517.html" target="_blank">https://cabforum.org/pipermail/public/2019-January/014517.html</a><o:p></o:p></p></div><div><p class=MsoNormal>[6] <a href="https://cabforum.org/2019/05/03/minutes-for-ca-browser-forum-f2f-meeting-46-cupertino-12-14-march-2019/#Creation-of-additional-Working-Groups---Secure-Mail" target="_blank">https://cabforum.org/2019/05/03/minutes-for-ca-browser-forum-f2f-meeting-46-cupertino-12-14-march-2019/#Creation-of-additional-Working-Groups---Secure-Mail</a><o:p></o:p></p></div><div><p class=MsoNormal>[7] <a href="https://cabforum.org/2019/08/16/minutes-for-ca-browser-forum-f2f-meeting-47-thessaloniki-12-13-june-2019/#Creation-of-Additional-Groups---Secure-Mail" target="_blank">https://cabforum.org/2019/08/16/minutes-for-ca-browser-forum-f2f-meeting-47-thessaloniki-12-13-june-2019/#Creation-of-Additional-Groups---Secure-Mail</a><o:p></o:p></p></div><div><p class=MsoNormal>[8] <a href="https://cabforum.org/pipermail/public/2019-December/014838.html" target="_blank">https://cabforum.org/pipermail/public/2019-December/014838.html</a><o:p></o:p></p></div><div><p class=MsoNormal>[9] <a href="https://cabforum.org/pipermail/public/2019-December/014839.html" target="_blank">https://cabforum.org/pipermail/public/2019-December/014839.html</a><o:p></o:p></p></div><div><p class=MsoNormal>[10] <a href="https://cabforum.org/pipermail/public/2020-January/014852.html" target="_blank">https://cabforum.org/pipermail/public/2020-January/014852.html</a><o:p></o:p></p></div><div><p class=MsoNormal>[11] <a href="https://cabforum.org/pipermail/public/2020-February/014865.html" target="_blank">https://cabforum.org/pipermail/public/2020-February/014865.html</a><o:p></o:p></p></div><div><p class=MsoNormal>[12] <a href="https://cabforum.org/pipermail/public/2019-January/014521.html" target="_blank">https://cabforum.org/pipermail/public/2019-January/014521.html</a><o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Wed, Feb 5, 2020 at 5:45 PM Wayne Thayer <<a href="mailto:wthayer@gmail.com" target="_blank">wthayer@gmail.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal>Based on my recollection of the Guangzhou discussion, and supported by the minutes, the "path forward agreed to in Guangzhou" was that we would take this charter to a ballot without further attempts to resolve the issue of including identity in the charter's scope. There does not appear to be a path to consensus on this issue, despite the considerable amount of time spent discussing it. I'm unhappy with this approach, but as one of the endorsers, I don't see an alternative other than "take it to a vote" that gets this much-needed WG formed any time soon.<o:p></o:p></p></div></div></blockquote></div></div></blockquote></div></div></div></body></html>