On Thu, Sep 7, 2017 at 5:22 PM, Jakob Bohm via dev-security-policy < [email protected]> wrote:
> On 07/09/2017 21:00, Ryan Sleevi wrote: > Then there is your suggestion of requiring technically constrained >> >>> SubCAs (that were constrained under a previous set of relevant name >>> types) could survive by subjecting themselves to the massive overhead of >>> satisfying the requirements for an unconstrained SubCA (audits, dual >>> user authentication, specially secured server facilities, geographic >>> redundancy, etc.), where as a constrained SubCA they could operate under >>> normal enterprise internal security rules. >>> >>> >> Yup. >> >> > What do you mean "Yup"? > This is a correct statement about what is currently required of CAs, and is a technically viable and workable solution, albeit one with tradeoffs, and does not require any breaking of compatibility. > The goalposts have not moved at all. > > When you failed to understand the goals outlined in the first two and > last paragraphs of my initial short post, I listed the two purposes > explicitly in my post dated 2017-09-01 06:07 UTC (As "primary problem" > and "secondary problem"). > Respectfully, you are changing the goals as solutions are produced. For example, your notation of primary/secondary fails to consider (or explicitly ignores) the repeated attempts to highlight the principle in https://www.mozilla.org/en-US/about/manifesto/#principle-06 outlined to you. As I highlighted, your proposal (and all variations of it that you've offered so far) fail to meet that. I offered you a variety of suggestions that meet that principle - some of which do not achieve what you value, but do achieve what Mozilla has explicitly valued. At this point, I feel like there's not much productive communication to be made here. I understand your goals. They are ignoring publicly-stated goals and principles, and present compatibility issues, but I wish you the best of luck in demonstrating how your solution can meet those goals. I don't believe you realize you're setting value-based criteria and those values are not shared, nor reasonable, but in any event, you have a solution you believe works, I've offered you several solutions that balance for other values, and it seems profoundly unlikely that you can be convinced that interoperability and standards-compliance is more important in the concrete than an abstract perception of cost that doesn't actually manifestly exist. _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
