<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Thanks for your feedback Doug,</span></div>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Let me list the changes in relation to the comments from Ryan:</span></div>
<blockquote itemscope="" itemtype="https://schemas.microsoft.com/QuotedText" style="border-left: 3px solid rgb(200, 200, 200); border-top-color: rgb(200, 200, 200); border-right-color: rgb(200, 200, 200); border-bottom-color: rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If that were not troubling enough, however, I think it also bears mentioning that this approach continues with one which has been firmly discredited, and which we've been actively moving away from in the Forum since the Forum's very creation, which is the introduction
of significant interpretation differences and leeway. "and an equivalent of the word ... " and "in the equivalent of the language" should best be read as "any other method", and much like how "but" serves to negate that which precedes it in a sentence, the
"an equivalent" serves to negate any presumption of any rigor described.<br>
</div>
</blockquote>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Moving to a fixed set of pre/suffix values does addresses Ryans point on the usage of equivalent, this is also the reason I added 'certified
translation', and I would like to extent this further to 'unambiguous certified translation of the equivalent in a language other than English'.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<blockquote itemscope="" itemtype="https://schemas.microsoft.com/QuotedText" style="border-left: 3px solid rgb(200, 200, 200); border-top-color: rgb(200, 200, 200); border-right-color: rgb(200, 200, 200); border-bottom-color: rgb(200, 200, 200); padding-left: 1ex; margin-left: 0.8ex; color: rgb(102, 102, 102);">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family:Calibri, sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">And, in the spirit of completely missing the problem space, it does nothing to address the fact that the following language is, practically
speaking, unimplementable: "It SHALL NOT include a name, DBA, tradename, trademark, address, location, or other text that refers to a specific natural person or Legal Entity unless the CA has verified this information in relation to the Application accordance
with Section 3.2."</span><br>
</div>
</blockquote>
<div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Instead of SHALL NOT, the proposal now requires the CA to verify if</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> the
value is listed in the WIPO Global Brand Database or the local business registry and if registered that the usage rights must be verified.</span></div>
<div><br>
</div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">I do not agree that an extension is the right place for the OU field. The organizational unit is for many large organizations a fundamental element
to identify the accountable unit (equally for relying parties). A new extension might be great for other purposes such as unique tracking information which is currently often placed in the OU field and I'm happy to collaborate on that with you, after we have
address the OU field.</span></div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0);">
<br>
<hr tabindex="-1" style="display:inline-block; width:98%;">
<b>From:</b> Doug Beattie<br>
<b>Sent:</b> Monday, November 23, 2020 12:58<br>
<b>To:</b> Paul van Brouwershaven; CA/Browser Forum Validation SC List; Ryan Sleevi<br>
<b>Subject:</b> RE: [cabf_validation] [EXTERNAL] Draft Ballot SCXX: Improve OU validation requirements
<div><br>
</div>
</div>
<div class="rps_ec2b">
<div lang="EN-US" link="blue" vlink="purple">
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
Paul,</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
This does not address Ryan’s concerns he’s previously stated, so I doubt it’s really advancing the cause.</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
Ryan: I’m thinking the use of a private extension for this type of data (including LEIs and other industry desired data) that cannot be validated in accordance with the BRs (section 3.2) might be a good approach, similar to the
<span style="font-size:10.5pt; color:#172B4D; background:white">QCStatement extension. Would you have any serious objections to the long term use of a private extension which the browsers can ignore for conveying this type of data?</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<b>From:</b> Validation <validation-bounces@cabforum.org> <b>On Behalf Of </b>Paul van Brouwershaven via Validation<br>
<b>Sent:</b> Monday, November 23, 2020 4:00 AM<br>
<b>To:</b> Ryan Sleevi <sleevi@google.com>; CA/Browser Forum Validation SC List <validation@cabforum.org><br>
<b>Subject:</b> Re: [cabf_validation] [EXTERNAL] Draft Ballot SCXX: Improve OU validation requirements</p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<div>
<p style="margin-bottom:8.0pt; line-height:106%"><span style="font-size:12.0pt; line-height:106%; color:black">I created a version to address the highlighted concerns on the usage of the word 'equivalent' and the validation of trademarks and trade/business
names.</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;margin-bottom:8.0pt; line-height:106%">
<span style="color:black">This version:</span></p>
<ul type="disc" style="margin-bottom: 0in;">
<li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;mso-list:l0 level1 lfo1">
is using a <u>fixed set</u> of pre/suffix values</li><li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;mso-list:l0 level1 lfo1">
includes a requirement for a <u>certified translation</u> for the equivalent in a language other than English </li><li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;mso-list:l0 level1 lfo1">
requires the CA to check the value in the WIPO Global Brand Database and the local business registry</li></ul>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;margin-bottom:8.0pt; line-height:106%">
<span style="color:black">Proposed OU validation requirements:</span></p>
</div>
<blockquote style="margin-left:30.0pt; margin-right:0in">
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;margin-bottom:8.0pt; line-height:106%">
<i><span style="color:black">If the Subject Identity Information is to include an organizational unit, then it MUST be preceded or followed by a whitespace and one of the words “unit”, “department”, “division”,
<span style="background:white">“group”, </span>“service", "system", "center", "office", “school”, “faculty”, "administration", "operations” in singular or plural form; or a certified translation of the equivalent in a language other than English. </span></i><span style="color:black"></span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;margin-bottom:8.0pt; line-height:106%">
<i><span style="color:black">The CA MUST verify the existence and affiliation of the organizational unit with the Applicant using an Organizational Chart provided by an authoritative source within the Applicant's organization, such as the Applicant's main business
offices, corporate offices, human resource offices, information technology offices, or other department that the CA deems appropriate. </span></i><span style="color:black"></span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;margin-bottom:8.0pt; line-height:106%">
<i><span style="color:black">If a value holds an active registration in the ‘WIPO Global Brand Database’ or a local business register the CA MAY only include these registered values when the CA has verified the right of usage in relation to the Application
in accordance with Section 3.2. </span></i><span style="color:black"></span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;margin-bottom:8.0pt; line-height:106%">
<i><span style="color:black">The value SHALL not be abbreviated unless this would exceed the maximum length of the `subject:organizationalUnitName` field, in which case it SHALL only use locally accepted abbreviation. </span></i><span style="color:black"></span></p>
</div>
</blockquote>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black">Please share your thoughts about this version.</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black">Thanks,</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black">Paul</span></p>
</div>
<div class="x_MsoNormal" align="center" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span style="color:black">From:</span></b><span style="color:black"> Ryan Sleevi <sleevi@google.com><br>
<b>Sent:</b> Monday, November 16, 2020 16:23<br>
<b>To:</b> Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>; CA/Browser Forum Validation SC List <validation@cabforum.org><br>
<b>Subject:</b> Re: [cabf_validation] [EXTERNAL] Draft Ballot SCXX: Improve OU validation requirements</span>
</p>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
</div>
<div>
<div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
On Mon, Nov 16, 2020 at 10:12 AM Paul van Brouwershaven via Validation <<a href="mailto:validation@cabforum.org" target="_blank" rel="noopener noreferrer" data-auth="NotApplicable">validation@cabforum.org</a>> wrote:</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-right:0in">
<div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:12.0pt; color:black">I have been thinking about a more simplistic and strict approach that doesn't follow all the current allowed methods listed in section 3.2 of the BR like we have proposed currently. </span></p>
</div>
</div>
</blockquote>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
As with every other proposal Entrust has offered to date, this doesn't actually address the problem inherent to any use of this field, which is that it's unverified, unvetted data, as there is *no* way to validate and vet it.</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
The most recent proposal reflects a thoroughly-debunked theater exercise to security, which is to rely on statements like "The user should understand that ...". It attempts to absolve the CA of the responsibility for not placing unverified data in certificates
in the first place, by trying to make it the user's responsibility on distinguishing that data from other fields and making an informed decision. Thankfully, this has been shown to be a theater exercise that harms users, so I feel like it's reasonable to simply
reject it outright.</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
If that were not troubling enough, however, I think it also bears mentioning that this approach continues with one which has been firmly discredited, and which we've been actively moving away from in the Forum since the Forum's very creation, which is the introduction
of significant interpretation differences and leeway. "and an equivalent of the word ... " and "in the equivalent of the language" should best be read as "any other method", and much like how "but" serves to negate that which precedes it in a sentence, the
"an equivalent" serves to negate any presumption of any rigor described.</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
This isn't progress on any measured dimension of providing rigor or addressing the fundamental issues, and is an attempt to preserve the status quo without actually addressing the issues. I'm glad Entrust is now interested in this space, but this approach was
discussed as far back as London in 2018, during the WG day, and highlights the problematic approach.</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
And, in the spirit of completely missing the problem space, it does nothing to address the fact that the following language is, practically speaking, unimplementable: "It SHALL NOT include a name, DBA, tradename, trademark, address, location, or other text
that refers to a specific natural person or Legal Entity unless the CA has verified this information in relation to the Application accordance with Section 3.2."</p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>