<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Apologies, I replied before seeing these last two messages :-)<br>
<br>
<div class="moz-cite-prefix">On 5/1/2022 7:38 μ.μ., Ryan Sleevi
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CACvaWvYnHNw9Sx2d0OExi0XZbfUkpz_Mrk_NxKEL8SuD_gUUvw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr"><br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Jan 5, 2022 at 12:06
PM Aaron Gable <<a href="mailto:aaron@letsencrypt.org"
moz-do-not-send="true" class="moz-txt-link-freetext">aaron@letsencrypt.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">If I may, I believe the disconnect in this
conversation can be summarized as follows:
<div><br>
</div>
<div>- It is understood that the current requirements are
upper bounds, and that CAs should be scheduling their
recurring tasks at intervals notably less than the
strict requirements.</div>
<div>- But at the same time, scheduling things to occur
every 23 hours or every 11 months is relatively
inconvenient, compared to scheduling things every 24
hours or 12 months.</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<br>
It is not just inconvenient, it is not the expectation of the
author. If the author of the document expected an event to occur at
least every 1 day, an implementer should be allowed to schedule this
event every 24 hours, otherwise it doesn't meet the expectation of
the author. Similarly with the annual expectation. If the author
wanted a hard limit and "not a second later", then this hard limit
should take into account implementation challenges and security
risks. If there is a slightly increased hard limit that has
negligible security impact but is more convenient for implementation
purposes and even readability, then IMHO it should be a preferred
option.<br>
<br>
<blockquote type="cite"
cite="mid:CACvaWvYnHNw9Sx2d0OExi0XZbfUkpz_Mrk_NxKEL8SuD_gUUvw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_quote">
<div><br>
</div>
<div>I <i>think</i> there may be a third disconnect as well:</div>
<div>- Reading the clarifications (for hours & days) as
also applying to longer periods, particularly those in the
NCSSRs.</div>
<div><br>
</div>
<div>I realized after seeing the discussion of weeks, that
this might be getting interpreted as also applying to the
NCSSRs. If they had been incorporated into the BRs, that's
totally a risk, but the work to extract them into a new WG
seems to suggest otherwise. In that document, the discussion
may be different.<br>
</div>
</div>
</div>
</blockquote>
<br>
I understood this ballot to apply to NCSSRs and EV Guidelines as
well. Section 5 of the BRs say:<br>
<br>
<i>"The CA/Browser Forum's Network and Certificate System Security
Requirements are incorporated by reference as if fully set forth
herein."</i><br>
<br>
<blockquote type="cite"
cite="mid:CACvaWvYnHNw9Sx2d0OExi0XZbfUkpz_Mrk_NxKEL8SuD_gUUvw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_quote">
<div><br>
</div>
<div>I highlight this as a disconnect, because the NCSSRs
already have the slack built in (by using the vaguer terms
that are subject to auditor interpretation, rather than
consistent interpretation); "at least an annual basis" is
such an example.<br>
</div>
</div>
</div>
</blockquote>
<br>
Exactly, and this is resolved by scoping the proposed 1.6.4 language
to only "hours" and "days" as mentioned in my previous post. I hope
you can understand the unnecessary disturbance this ballot would
cause it it were applied to "months", "quarters" or "years".<br>
<br>
<blockquote type="cite"
cite="mid:CACvaWvYnHNw9Sx2d0OExi0XZbfUkpz_Mrk_NxKEL8SuD_gUUvw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div>My contrasting suggestion would be that, instead, one
might schedule recurring tasks for 12 hours and 6 months
respectively, which are both convenient and come in
generously below the requirements.</div>
</div>
</blockquote>
<div><br>
</div>
<div>Yes, exactly. </div>
</div>
</div>
</blockquote>
<br>
Of course, one might schedule things as they like (probably CAs
reading this thread :-) but the author of the document doesn't set
the expectation for CAs to use limits in the document as the
absolute "ceiling", to be on the safe side. It still allows for the
bare minimum. If we want to change that, we need to communicate it
better in the current BRs.<br>
<br>
</body>
</html>