COrbitCA - CAcert.org Account Holders CCA Completing Campaign - Brain Background


Project Flow


Preamble

There are two major changes that we need to get out to the world: The NRP-DaL to "everyone" and the CCA to our members.

This list of changes is now at version 7. Much stuff is done, see bottom. Audit-blocking summary:

1.

Root page needs reference to NRP-DaL

2.

Certs request needs "I agree" text

3.

old psuedo-contract text to go

4.

Members to be notified of CCA

The above are required by audit. (See AuditToDo for others.) Now read on for more explanation.

NRP-DaL

The use of the Non-Related Persons -- Disclaimer and Licence to reach out to the people we can't reach to ... is "novel". That means, we are in an area where the courts don't necessarily agree with our approach, but there is custom in the industry, in the form of open source licensing. Courts say that licences aren't necessarily held as binding on people who did not see them, and industry practice says that Shrink-wrap and Open-source licences are delivered the only way we know how ...

To make this work, CAcert has to be very consistent, very repetitive, and very boring. CAcert has to point to the NRP-DaL at all times and in all places.

It starts with the website: the website must *PROMINENTLY* push the NRP-DaL.

(As well as getting it plastered all over the website, it is the Assurance team's responsibility to work the issue through with all Assurers (eg.., ATE, CATS), and PR's responsibility as well.)

CAcert Community Agreement

The second issue is our agreement, the CCA. This regime of community documents and policies was agreed fundamentally at the TOP in September 2007.

It needs to be put into place everywhere. The CAcert Community Agreement has to be made part and parcel of all processes. CCA1.1 specifies where agreement has to be got from the user, and these changes need to be implemented: 

  1.1  Agreement

You and CAcert both agree to the terms and conditions in this agreement. Your agreement is given by any of

    * your signature on a form to request assurance of identity ("CAP" form),
    * your request on the website to join the Community and create an account,
    * your request for Organisation Assurance,
    * '''your request for issuing of certificates''', or
    * if you USE, RELY, or OFFER any certificate issued to you.

For this we need words like: 

          I agree to the CAcert Community Agreement [ ]

in various places, see below. I suggest you stick to those words above exactly because (a) they are simple words, easy to understand, and good enough to get the message across, and (b) translation issues means we have to be consistent with the text for a long period of time, else everyone ends up with English.

Main Website

Totally Urgent and Important

These three fixes are holding back AUDIT

1. Root Certificate Download Page: 

    * As a member, your USE and RELIANCE is governed by the CCA.
    * For all non-members:  you may only download and USE under CAcert's Non-related person - Disclaimer and Licence.  You must not rely!

2. Certificate creation page (e.g., client certs) 

    Your use of a certificate is controlled by the CAcert Community Agreement, the CPS and other policies.  Please see /policy/

3. Old psuedo-contract text needs to be cleaned out from the website. This is a bit more difficult because it needs to be identified and replaced with something else. (E.g., see example in 2. above.) Let's look at this when the above 2 parts are done, or see the bugs filed on this issue.

Not Absolutely urgent but still quite important

These are not audit issues, but important business issues. They remove unprofessionalisms and confusions, and replace with certainty and clarity:

Also see the bugs system for another reading of the things that are needed (no time right now to cross-reference them).

CCA-patches Testing

Additional changes noted

Notifications of Change

All Members need to be notified of the CCA.

Also note this related but non-CCA issue: All Assurers need to be notified of the new AP. This in effect may have happened on 20090522.

Complete!

references:

Inputs & Thoughts