[cabf_validation] [EXTERNAL]Re: Revision to OU requirements

[Dimitris Zacharopoulos (HARICA)]

On 2020-09-09 5:56 π.μ., Ryan Sleevi via Validation wrote:
> To discuss how the information should be validated requires discussing 
> what the information should be in the first place. In the months since 
> the F2F discussion, no one has brought any use case forward. We know 
> from extant practices that CAs are keen to add their brandnames, 
> marketing information, or otherwise problematic data, such as "Domain 
> Control Validated", which serves no value to the software using these 
> certificates. To figure out how to validate first requires identifying 
> the use cases, and those use cases that have been shared are not only 
> hardly compelling, but border on problematic to harmful to security.

Shouldn't it be easier to search CT logs or CENSYS for OU values to get 
a better reading on possible value to the OU field? I'm sure we would 
find more than just brandnames, marketing information, or otherwise 
problematic data in OU fields.

Dimitris.