Re: CA scope transparency (was Re: Name-constraining government CAs, or not)

2015-06-19 Thread Brian Smith
On Fri, Jun 19, 2015 at 1:38 PM, Ryan Sleevi < ryan-mozdevsecpol...@sleevi.com> wrote: > On Fri, June 19, 2015 11:10 am, Brian Smith wrote: > > The current set of roots is already too big for small devices to > > reasonably > > manage, and that problem will get worse as more roots are added. Th

Re: CA scope transparency (was Re: Name-constraining government CAs, or not)

2015-06-19 Thread Ryan Sleevi
On Fri, June 19, 2015 11:10 am, Brian Smith wrote: > The current set of roots is already too big for small devices to > reasonably > manage, and that problem will get worse as more roots are added. Thus, > small devices have to take a subset of Mozilla's/Microsoft's/Apple's > roots. Without w

Re: CA scope transparency (was Re: Name-constraining government CAs, or not)

2015-06-19 Thread Brian Smith
On Fri, Jun 19, 2015 at 7:24 AM, Gervase Markham wrote: > On 17/06/15 22:50, Brian Smith wrote: > > By "small scope," I'm referring to CAs who limit their scope to a certain > > geographical region, language, or type of institution. > > I'm not sure how that neuters my objection. CAs who do more

Re: CA scope transparency (was Re: Name-constraining government CAs, or not)

2015-06-19 Thread Gervase Markham
On 17/06/15 22:50, Brian Smith wrote: > By "small scope," I'm referring to CAs who limit their scope to a certain > geographical region, language, or type of institution. I'm not sure how that neuters my objection. CAs who do more than DV will need to have local infrastructure in place for identit