Management Sub-Committee meeting 20080317
- Present: teus, evaldo, iang
- schedule next meeting: Thursday 27 March 2008
Dispute Resolution
- emaillist of case managers and arbitrators, no news
- any cases?
- one indicated from MS, iang chased, no action.
- CeBIT Jens: any news on whether on-the-spot-arbitrations would have been useful at CeBIT?
Assurance
Policy list work
teus to give overview of current issues and status.
- OA, M-SC has taken the lead for OA. Pending in AT 1, US 3, AU 1, CH 2, SE 1
- CH is stalled. Teus is chasing...
- OA AT: sub-pol is in draft. p20080310 should be recorded?
- OA USA: GS, GM + RJ will do next step including Europe+Mexico
- OA AU: RC proposed subpol end discussion 19 March, 20080326 March.
- AU COAP needs dns record discussion.
- Evaldo to check the AU subpol
feature request for DNS control check? evaldo to chase OAP (main one, not subpol):
- countries/areas which have no OAs nor a subpol
- board agrees to the task
- teus, guillaume has mailed to policy group
- policy on OA in "empty" areas proposed 14 March
teus + iang to check the posts
- how do we check who is an assurer?
- now CATS passing-marks are in the database is easier
- overall question still stands for the Assurance process
- privacy/public status of the information in the certificates
- cert numbers
- name
- DPA issue policy discussion: DoB drop request, rumbles on
- DoB is in debate and call for vote to drop DoB in 19th of March
- need for DOB, proposal to drop DOB from database (i Naye, 2 Aye)
dropping the DOB and making all cert info as "public" means practically all DPA/PII data disappears. Big win!
- make this claim on the policy list...
- code-signing policy
- TH made proposal to [policy] for basic claims plus optional claims
- code-signers enter into a contract
- modelled after the Creative Commons concept
need to chase it: Teus still
- code signing: proposed signer agreement and signer statements/claims Then policy write up
- Dutch DPA authority statement that it is forbidden to copy passports
- do all passports copies need to be dropped?
- what about old Assurers?
- some very early Assurances were "send photocopy to CAcert Inc" ... what to do?
Teus announced this decision to policy list:.
- need to announce to all Assurers to destroy
- need a dispute filed to ask Arbitrator to order all passports copies to be destroyed. (i) Assurers, (ii) CAcert Inc., (iii) support IMAP mailbox.
policy question is whether to delete and drop any and all requirements. Teus.
- board question is whether the board decides to unilaterally drop their copies and their requirements.
- priority is not high, but we need to progress the question
- add a CATS question, when we have a result
- related question: Identity Numbers (passport numbers, identity card numbers) were and are being written down on CAPs.
Tverify ==> subpolicy for other CA's members.
Tverify needs subpol to be written, on ToDo.
- TTP
need a subpolicy (propose a new policy) proposed no discussions seen, on ToDo.
- Junior Assurer, below 18 years of age
- need a subpolicy for Junior Assurer
- there are about 30 or so...
- 10 points allocatable only.
- Senior Assurer, people who have reached 150 or beyond?
- need to drag out the wip doco and think about it
- Policies now linked directly from main page
- php and wiki list to compile for text changes due to policies
- new e-mail cert form request php id
- new certificate request page text
- translation is an issue
- translingo is back but still a good idea to move to rosetta?
CATS
- 2nd sysadmin, has he been added yet?
Evaldo: Add Ted.
- Evaldo is changing the test system, when changed, can bring in new sysadms
- Current server goes down soon, new server is online.
- Sonance requests one VM for DNS/mail failover.
- can over the same in return
Bernhard has reported: for those interested in such things here is a current status of CATS:
- 341 different certificates have passed tests (ask Sourcerer how many different users, I'd guess more than 300)
- Since CeBIT (about 100 tests on CeBIT saturday!) there have been 5-10 passed tests per day
- I have created about 150 documents for passing the test, including 27 printed ones
- The passed results are already imported into the CAcert database
- User interface for viewing passed tests is in code review
- Admin interface and other related code changes are in (slow) progress
The great majority (>90%) of users who have requested a document have been german speaking (DE/AT/CH). Only about 5 non european Assurers (judging from email adresses)...
- need to mention that the Assurers will be chopped off
- Teus: how many Assurers have 150 points? Ask Philipp.
- how many Assurers are active today? In the last 6 months?
- if number of active Assurers (last year) is N, then 25% should have it before we impose a deadline.
- Ted to chase PR? Ask Ted whether he can ask Greg + Henrik to generate some PR?
- Challenge-passed
- report over to core system, status of that?
iang to chase:
- implementaton of Challenger-passed mark into the database is pending?
- teus reminded Philipp.
- assurer mark for challenge passed assurers
ask sysadmins for this http://bugs.cacert.org/view.php?id=499 is progressing: Current status:
Import interface (CATS->CAcert DB): In code review
- User interface (showing passed tests in CAcert account): Coding with low intensity
- Admin interface (modifying results): pending
Other
- Assurance promulgation plan
- main web page has been updated
- logo is in
housestyle adoption is pending, johan needs access to test system, evaldo to chase?
- teus wants metadata on the page for the policies.
- on the todo list
- Changes
- Principles should be somewhere too
these are recorded as task on RolloutCommunityAgreement
Systems
- new team members
- Evaldo to present list
- several prospects for non-critical servers, positive
- Nagy (hungarian)
- Matthijs M
- ishbir
- Jacob S
- amessina
- premrara
- kim H
- shaun L.
- thomas w (association member) salzburg
- Sam J (SAGE, google apps)
- questions (however brief) for 20080326
- proposal for new non-critical members for 26th
- agreement on 29th by M-SC+pg
- Cachaca project drafted: to be decide:
- need speed.
- philipp is back from link protocol
- need to assess amount of time he has available
- NL team will need 2 people in sysadm team to meet dual control criteria
- request for costs is implied
- preparations in Brazil, in "production with test systems"
- had got close, but disks got reallocated
- starting again, but this time with documentation
- doco not yet published
- should be part of the security manual
- remote work? how to do the reboot remotely?
- prepare the kvm before flight?
- Plan proposed to board???
- M-SC decision is to build the team to move the system to Netherlands.
- Evaldo is to start that team.
- Philipp is providing the software to Evaldo.
incorporate tonight's changes, circulate plan, and then send plan to board. iang
Admin
- Funding
- from Audit Project?
- AtC funding needed?
- NL move
- USB link installed, serial line was also requested by PG
- interest of volunteers: JJ (NLnet Labs) proposed, Medison (pending)
- no interest seen: old email from PG with some names. Need to chase.
- create systems committee
Evaldo compiles req list For systems sub-committee? We said it is not exactly needed
- need closed group nomination policy?
bounce back ideas and create a proposal to board: all
- link
- serial not on Suns
- Spare Tunix firewalls PC has them
- or use USB, or use Ethernet, device nodes available?
- software
- decision taken by board sw to go to EG
- familiarisation with sw is started
- Some pieces are already sent, missing many pieces still, but probably able to create a working set with the available data already
- Virtual machine with signer is installed, missing OpenSSL profiles
- Virtual machine with web application is in progress, missing some bits and pieces
- Support team
- new member was discussed (problems: not assurered, possible conflict of interest with his work)
- notify ggr + rob of situation: done, Member not invited.
- admin team: Daniel, Ted, Michael ???
- check OCSP/CRL distr systems (Philipp request)
- not clear what check is required
- outline of concerns by Evaldo to M-SC:
a CRL distribution point that is NOT UP TO DATE is a big denial of service on revocation (unable to properly revoke and send the message out)
a bogus OCSP server can declare legitimate certs revoked, and vice versa
Even if we decide to remove a DNS entry for the bad servers, DNS caching might hurt us
- PG asked for status.
- iang to talk to Pete S
- are these critical systems?
- nothing much on them
- DOS for revocation checking
- certificate could be used for a social engineering attack
- teus chase philipp with questions. Done.
- OCSP/CRL usage stats: 5000 p/mnth (PG)
- outage stats OCSP routing: 25 mins/mnth (98% uptime) (PG)
- getting sources up and available
- good to get the board to finalise the licence under which the source code is to be issued.
- agreed that CAcert is to own the full rights, as per the FSFE tfr agreement
proposal to board to be written up on that basis iang
iang to review GPL[23] again
House Style
- new logo is in
- web style has not been incorporated ... (promised first week Febr) to be incorporated.
- No action caused ripple effect for events. New request on 13th of March with one week to results.
request for access on test system by Johan. Also on 13 March email to support. evaldo to chase
- advertisement handling (teus: status unknown)
- cert button (teus: status unknown)
Admin
- organigram wait for community comments ends on 1st of March.
Evaldo to review.
- email lists / aliases for offices. Names / offices to be sync'd. Still to do. Wiki needs to be updated.
- leave it as it is for now, pending the systems changes.
- progress on tracking system: none found as yet.
- wiki pages update in progress by M-SC (!?)
- more people to help for doco
- now in svn: Doc Policy work-in-progress, early stage, not near to DRAFT
Audit
- workplan for auditor, teus
- MoU with Ian is in place.
start real audit requires NL move + dual control
- preparations
- policy Assurance Policy
- press release
- rollout plan: policy progress
- where we are now, write statement of where we are
- look at the report sent to board in around January.
- rewrite this for up to date comments, plus the needs in the MoU.
- add bullet that MoU is now in effect, has ramifications
- timeline, operations.
- defer discussion until we have had a chance to review the MoU.
- look for MoU and get it to the SVN.
- security manual
- NLnet-MoU
- need announcement press release, but defer this until after agreement with auditor is reached
- RC received first 9K
- documents now on website
- real audit can only restart when systems are completely moved to NL Need date (Cachaca project and/or PG last trial; GP seems to be stalled on serial/link protocol.
- need link from main web site to audit pages.
Committee meetings
Cmtee met 29th Febr 2008. Minutes and decision list is updated on wiki Board/Minutes/20080229
- AGM and board minutes need (board) review
iang has now read the minutes, and will review them again!
Assurance Events
- Need CeBIT report (Jurgen/Mario)
CAcert Associations
- Policy on Foundations and Associations: to be updated
- introduce it to the policy list
- secure-u commitments, still pending, still under negotiation
- for example, funding earmarked for CAcert should be controlled by CAcert (board notice?)
- if local funding is raised locally how to get properly in control of CAcert?
- finances for meetings
- non-profit issue raised
- needs a change of CAcert Inc. by-laws
- SGM called on 4th April for Association
- mail has gone out to members of the Association
- within 3 weeks so it is enough notice to change the rules
- is in hand
- board asked M-SC to do the preparations for the AGM
- date: 20081107 23:00 MET.
PR / Marketing
- flyers/CAP/COAP, CCA printouts, sources
- presentations in svn tree
- need overview of events in wiki
M-SC finances
- finances for meeting travel
- equipment funding?