On 01/17/2009 11:45 AM, Ian G:
Once you name another party, then you are likely in dispute.
Might be.
...then that should be treated a dispute.
The question is, if Mozilla is a party to that dispute. Making a complaint about a CA might be of interest for Mozilla (in its own right), but Mozilla still isn't part of that dispute.
It's also irresponsible and unprofessional, and likely if we want to make this distinction, we will have to think about a policy of no complaints. You can't have your cake and eat it too.
Well, no...somebody is free to complain or inform Mozilla about something which might affect Mozilla. If Mozilla can/should/must act upon that information greatly depends on the nature of that information and how this affects its users. This is the assessment Mozilla will have to make and perform certain actions or not. A dispute still mustn't arise, because the affected CA might not even dispute the claim, might be cooperative, might solve the problem or whatever.
An affected party which has a dispute with a CA must solve the dispute with the CA through the proper channels. Mozilla CAN NOT provide resolution to the dispute - Mozilla is not a court.
Mozilla can provide dispute resolution, and I would argue they are already doing it, albeit badly.
Not that I can see...at most Mozilla is party to a dispute (so far I can't see that Mozilla has a dispute with any CA, do you?)
But they certainly can do it, I'm unsure what you mean by "in no way."
Mozilla has no legal powers for solving disputes. Mozilla can only protect itself and its users if such a risk exists. Mozilla might in turn become part to a dispute, but not necessary.
Right, on this I agree. There is a sea of interests to be covered here, and it is not even clear that mozo people can represent end-users [1].
Mozilla does not represent any end-user! Full stop! Mozilla makes on behalf of its users a decision which CA roots to ship with its software. Users have obligations as well and will have to solve disputes through the proper channels. Mozilla is not such a channel.
As far as choosing to add a root to the list, Mozilla Foundation have already established their place. They have already declared that they will act according to a policy and set of interests (whatever they may be).
Up to a certain extend. It declared under which condition it may add a root and under which circumstances it may remove it. Mozilla hasn't defined which action to perform under which circumstances nor promises to do so, but clearly retains the right to do so at any time.
Now, there is of course another reality besides the legalese... Mozilla wouldn't want to put its users to undue risks because it would be bad for its software and standing.
Indeed. In my proposal it is less arbitrary. They will be able to do certain things, more so than before. Right now, they cannot drop anyone from the root list.
I'm not sure from where you got this...which law are you following that prevents Mozilla from doing so? Which legal requirements? Which policies? Which agreements?
Right now, about the only thing they can do without fear is to write and ask stuff. This proposal will make it easier to act.
Sorry Ian, I can't see how your page should change anything. Besides that I don't agree with your statement above to start with...however, if you feel that Mozilla should have performed certain actions and hasn't done so, than you should speak up and complain (to Mozilla for inaction). If you want to define certain actions Mozilla should perform under certain circumstances, than rally Mozilla behind such a proposal and have the foundation agree to it. It has however still nothing to do with dispute resolution.
-- Regards Signer: Eddy Nigg, StartCom Ltd. Jabber: start...@startcom.org Blog: https://blog.startcom.org _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
