In the past, lots of good stuff has been done that handles the ascension
to the root list of Mozilla.  c.f. the policy.  But not so much is
written about *what happens afterwards*.  This recent thread has been
such a case, and has afforded an opportunity to make some notes on what
might be suitable as a practices page on the wiki.

The reason for doing this, and adding yet more boring verbage to the
mass of words, is that it can prevent uneccessary legal costs by
providing clear guidepaths, and clear signals of seriousness.

Here's what I see:

1.  How to file a dispute against Mozilla and/or a CA.  This seems
fairly easy;  file a bug in bugzilla and mark it as already described
here: https://wiki.mozilla.org/CA:How_to_apply .  (With mods:  Severity:
  as appropriate.)

2.  What is the practice on revocation or un-trusting on roots?  This is
is perhaps a headline case of a dispute, so possible merits its own
notes.  Frank has suggested the test:

    a.  there is a clear and present danger to Mozilla users, or
    b.  to punish a CA, and/or to deter others.

I would suggest that (b) be modifed slightly to give it a basis, which
in this case might be "for breaches of policy or practices".  The
Policy, pt 4, gives the authority, as well as some examples, and adds
another test case:

    c.  where certificates cause technical problems with mozo software.

3.  How to resolve a dispute.  This is a Mozilla action &
responsibility.  Reverse-engineering and referring, I would suggest this
as a teaser:

   a.  The CA certificate "module owner" at Mozilla foundation is
responsible.  Ref, the policy, pt 15.
   b.  The dispute is investigated and ruled on by module owner.
   c.  The ruling is listed in the bug report above.
   d.  Many disputes will be dealt with by communication, and no ruling
will be required.  This will create a default "closed, no action" ruling.

4.  Finality.  What happens if we disagree with the decision of the
module owner?  In the policy, it says "CAs or others objecting to a
particular decision may appeal to mozilla.org staff, who will make a
final decision."  Ref, policy, pt 15.

I would wonder about this;  google suggests that "staff" is as listed here:
http://www.mozilla.org/about/staff
but that seems out of date.  Also, due to the absence of this forum in
the public eye, I doubt it musters the credibility we need in dispute
review where the legal and contractual significance is high.  E.g., is
there any way we can review the decisions they made in the past?

There are several possibilities:

   (i)   Ruling is final.
   (ii)  Mozilla.org staff, policy, pt 15.
   (iii) Review by board of Mozilla Foundation.
   (iv)  Review by some independent party.
   (v)   Review by forum at law: courts, or Arbitrator.

Personally, I would plumb for (iii) and suggest the Mozo Foundation
board as the next step.  It is expensive, but available.  The directors
already have fiduciary responsibility, and can thus deal with the
significance.  It is also aligned with the review of the manager
concerned, the policy and the general contractual issues.

End!  I'd encourage others to comment!

If nobody has any objections, I can add that as a page into the wiki as
an informal document of practices, including or without those questions.

iang

On 23/12/08 06:09, Frank Hecker wrote: