On 27/06/17 12:17, Ryan Sleevi wrote: > This was something the NSS developers explicitly moved away from with > respect to certdata.c
It would be interesting to know the history of that; but we are in a different place now in terms of the SCM system we use and the CI tools available, versus what we were a few years ago. If you were able to elaborate on the relevant history here, as you obviously know it, that would be helpful. >> That's one option. I would prefer something which is both human and >> computer-readable, as certdata.txt (just about) is. > > Why? Opinions without justification aren't as useful ;) :-) Because human-readable only is clearly silly, and computer-readable only is harder to maintain (requires tools other than a text editor). I want it to be easily maintainable, easily browseable and also unambiguously consumable by tools. > Apple suggested they'd like to make this data available; my hope would >> be that if a format could be defined, they might be persuaded to adopt it. > > And if they can't, is that justified? > > That is, it sounds like you're less concerned about cross-vendor > interoperability, and only concerned with Apple interoperability. Is that > correct? I'm after interoperability with whoever wants to interoperate. The other benefits I see for Mozilla are being able to better (if not perfectly) express our root store's opinions on our level of trust for roots in a single computer-readable file, rather than the combination of a text file, a C++ file and a wiki page. Given that the plan is to auto-generate the old formats when necessary, I didn't think that maintaining the data in a different format would cause anyone significant difficulty or hardship. >> Like, really? Developing a set of JSON name-value pairs to encode some >> fairly simple structured data has potential IP issues? What kind of mad >> world do we live in? > > It doesn't matter the format - it matters how and where it was developed. As in, if I just make it up and start using it, people will be scared I'm going to sue them over its use? Gerv _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
