Monthly Archives: October 2010

Licensing our Documentation under CC-by-sa+DRP

Hi all, and contributors of documentation!

We are now at the point of licensing our documents. As some of you may have noticed, we have now licensed the Policies under Creative Commons – attribution – share alike licence, with our DRP [1]. Or CC-by-sa+DRP for short [2].

The Board is intending to do the same thing with our other documentation: CC-by-sa+DRP.

If you’re fine with this, say YAY TEAM, and read no further 🙂

Some notes on what this means:

  1. In broad terms the chosen licence is like GPL but for documents not source code.
  2. Documents are contributed under CCA 1.3 which includes this broad grant from you to CAcert Inc.:

    1.3 Your Contributions

    You agree to a non-exclusive non-restrictive non-revokable transfer of Licence to CAcert Inc. for your contributions. That is, if you post an idea or comment on a CAcert forum, or email it to other Members, your work can be used freely by the Community for CAcert purposes, including placing under CAcert Inc.’s licences for wider publication.

    You retain authorship rights, and the rights to also transfer non-exclusive rights to other parties. That is, you can still use your ideas and contributions outside the Community.
    ….

  3. At first glance, that clause CCA 1.3 looks quite fierce. There are a couple of reasons for such a complete and blanket transfer.
    1. It has been our experience that people have made contributions, and withheld transfer, preferring instead to control the results by means of copyright rights. This has put the Board, the Policy Group and the critical teams in a difficult position at times. The people making the contributions have often been thinking with all good intentions, but results of those intentions have been at least unpredictable and sometimes very costly.
    2. Secondly, it is possible that people with bad intentions could insert documents of uncertain background, and then stir up trouble later [3]. We do live in a competitive environment, and a competitor could cause this to happen. So the CCA includes a broad grant that addresses that.
    3. Thirdly, it would take an entire team to resolve the copyright mess if we didn’t have a broad grant. We’d have to have people running after every document, every post, every idea. It’s just uneconomic, and most of the contributors would not fill out the forms and return them anyway. We’ve got better things to do without creating work for ourselves following the tired old dreams of some 20th century colonialist music empire for the collection of royalties from poor starving artists.
  4. The grant is broad about what documents belong. Primarily we’d expect that to include the wiki, the SVN, the doco pages on the main website, email / list forums etc. These would all be “forums” under the above text. The point is it’s broad, inclusive. If there is any difficulty about this, then the intention is to use our Arbitration to solve the bits we missed.
  5. The quid pro quo for all of this is that CAcert Inc, now the proud owner of lots of documentation, license it back to the community. That’s today’s job.

So this email is going out to all the team leaders and so forth, from the Board, to ask for your thoughts, comments, desires, responses on the issue. What do you think? More thought required? Or full-steam-ahead? Somewhere in between? [4]

iang, informally for and from Board [5].

[1] There are some technicalities. We are adding to this by resolving all disputes in our own forum. We do this by means of the single licensing line in the document itself which now looks like: CC-by-sa+DRP. The motive for this is that our Arbitration works well across the planet, and is cheaper. It’s the same motivation for Arbitration with anything else, we protect all the members better this way.

[2] Also, we are using the Australian licence, 3.0 version, so the fuller acronym would add -AU-3.0. It is customary to not add those details. The various 3.0 licences are meant to be complementary (documents can work together under different 3.0 licences from different countries.

[3] This has been reported in the IETF groups, mostly with “submarine patents,” as a game between competitors.

[4] If you’ve got this far 🙂 Let me take this moment to conduct a quick survey: who feels more comfortable with the spelling of the word as licence, and who feels more comfortable with license?

For the noun form, the word is /licence/ in Anglo spelling, and /license/ in American spelling. The reason it is confusing is that in Anglo-english, the *verb* form uses S like licensing, licensed not C like licence. The American form then is far simpler, using S all the time, and as expected. The Anglo form is confusing … Note the RDL retained the American form 🙂

Anglo in this context means A/NZ/UK, I’m not sure about countries such as India, Pakistan, Singapore, Honk Kong and other strong users of English. Europe generally adopts British English, but I’d be surprised if they have avoided this confusion! Note that the answer to this question may feed into a wider question…

[5] which means, there is no Board motion as yet. There is board discussion minuted at:
https://wiki.cacert.org/Brain/CAcertInc/Committee/MeetingAgendasAndMinutes/20101003#a2.3

Assurer Training Event Hamburg, Freitag 5.11.2010

Scroll down for English version

[Deutsch]

Es hat sich viel getan im letzten Jahr. Eine ganze Reihe von bisher eher “mündlich überlieferten” Regeln wurden in Policies gegossen. Neue Prozeduren (z.B. die Assurer Challenge) und Verpflichtungen (z.B. in dem CAcert Community Agreement) wurden beschlossen. Die Assurer Training Events wollen versuchen, die ganzen Informationen unter’s Volk zu bringen:

  • Was hast du auf dem CAP Formular hinzuzufĂĽgen, wenn du Minderjährige ĂĽberprĂĽfst ?
  • Was sind die 2 wesentlichen Punkte der CCA die du einem Assuree vermitteln können sollst ?
  • Unter welchen Umständen können z.Bsp. niederländische Rufnamen akzeptiert werden?

Antworten auf diese und weitere Fragen erhälst du bei den Assurer Training Events (ATEs).

Die kommende Veranstaltung in deiner Nähe findet statt am Freitag, den 5. November 2010 ab 19 Uhr:

Attraktor e.V.
Mexikoring 21
22297 Hamburg

Das Veranstaltungs-Team freut sich schon auf Eure Teilnahme.

Details zum Veranstaltungsort und Anfahrthinweise findet Ihr im Wiki: ATE-Hamburg im Wiki

Unverbindliche Anmeldung und Registrierung:
Ich möchte am ATE in Hamburg teilnehmen.

[English]

Much has happened during the past 3 years. The old way of
orally-transmitted procedures has now gone, and our rules have been cast
into formal policies. New procedures (e.g. the Assurer Challenge) and
obligations (e.g. in the CAcert Community Agreement) have been approved.
The Assurer Training Events bring all this to you, the Community:

  • What you have to add onto the CAP form if you assure U18 people ?
  • What are the 2 essential topics regarding CCA you have to present an Assuree ?
  • When you can accept i.e. a Dutch “roepnaam” ?

Answers to these and many other questions are given at the Assurer
Training Events (ATEs).

The nexte ATE takes place on Friday, November 5th, from 7 p.m., at

Attraktor e.V.
Mexicoring 21
22297 Hamburg

The Event-Team is looking forward to your attendance.

Details on Location and Transportation can befound in the corresponding Wiki page.

Informal registration and questions: I will attend the ATE in Hamburg.

Software-Assessment-Project reached next milestone

Todays systemlog message marks the quantum leap in our about 10 months project work, to become the Software-Assessment area auditable.

As many Software-Updates are in the queue from the software developers, that needs testing and reviews by Software Assessors, the team started by end of last year with this project,

  • to build up a new ”controlled” testserver with authority by Software-Assessors
  • built up by the critical team as a Disaster Recovery testcase
  • a new central repository for all the upcoming software projects (including the New Software project BirdShack)
  • building a new test team running the software tests
  • and finalyze the process by a review of the patches by 2 Software-Assessors
  • document the patches, the testing, the review and the check by two Software-Assessors
  • to bundle the new Software-revision for transfer to the Critical team

The systemlog message signals, that the first tested and reviewed patches has received by the critical system webdb and is incorporated into production. A new tarball has been generated to build the next basis for applying the next patches.

So here my thanks goes to all the involved teams,

  • Software-Assessment-Project team
  • the new Software Testteam
  • the Critical Sysadmins team
  • and last but not least to the Software-Assessors from the Software-Assessment team

With all these people assistance, this project hadn’t be pushed to this milestone. Thank you Andreas, to build the project plan and the technical background, and also hosting the current testserver, Thank you Wytze for all your work to build the new testserver from scratch as identical as possible to the production server, to Michael, who assist us in deploying the new git repository and also assistance in deploying the Testserver-Mgmt-System, so everybody can start testing w/o the need of console access, Thank you Markus, for all your time and effort to deploy the repository and testserver environment and also your work together with Philipp as Software-Assessor, to finalyze the Software-Update-Cycle. Thank you Dirk for all your suggestions to move on with this project.

Some more work is todo:

  • adding a test-signer, so also cert related patches can be tested in the future (Andreas and Markus are working on this)
  • deploying a C(ontinous)I(ntegration) system for automated testing (Andreas is working on this).

Now the teams have to walk thru the list of open bugs, that needs to be pushed thru … First of all is the “Thawte” bug … to signal all users who’ve got their Thawte points transfered by the old Tverify program if they are effected by the points removal or if they are safe. The CCA-Rollout with a couple of patches, a list of new Policies and Subpolicies related patches (eg. PoJAM, TTP program), a list of Arbitration pushed patches, and so on …

So guys, lets have a party tonight, we’ve wiped out one of the biggest audit blockers!

The Big Masterplan to become Audit Ready

Back in January 2010 the former Board decided by Board motion m20100117.3 “No new subroots on current root, plan for new root”. In the discussion a date was scheduled by end of Dec 31, 2010. On my 2nd thought, probably nobody did recognize, what that means, CAcert's Big Masterplan To become Audit Ready (01/2010) to finish all the projects from the bottom left corner at beginning of 2010 to the top right corner by end of the year with the “New Roots and Escrow” (New Roots and Escrow) process running. So this article should bring Audits mistery to light.

Policy Group worked on the last few essential Policies (Policies on Policy Group), that are essential for the Audit. One essential requirement for Audit is to Rollout the CAcert Community Agreement to all the members, so they can decide to continue or to leave the Community. To become “CCA Rollout Ready” (CCA rollout), the running Software needs to be updated. This opens the next problem: by starting 2010, there was no Software Update Process defined, nor documented. But we’re on the lucky side, the Software-Assessment-Project started November last year to fulfill this requirement (Software-Assessment-Project). The task was: To get a repository system controlled by Software-Assessment team, a controlled testserver environment and a documentation system. Currently the team tests the transfer of a test patch to the production system. Involved parties: Software-Assessment Project team, Software-Assessment team and the Critical Sysadmins team.

CAcert's Big Masterplan To become Audit Ready (10/2010)
CAcert’s Big Masterplan To become Audit Ready (10/2010)

In the meantime, another issue pop’d up: the “Thawte points removal” with a deadline of Nov 16th, 2010. We’ve allready posted several blog posts on this topic. So also this is related onto the Software-Assessment-Project progress (Software-Assessment-Project).

The next topic is running Assurer Training Events (ATE) (Assurer Training Events). ATE’s are an essential concept in the Audit over Assurance (RA) business area. To scale a worldwide community, the community has to assist Auditors work in doing Co-Audits over Assurers. The question: How to contact groups of Assurers was answered back in 2009 with the ATE concept. The purpose of ATE is twofolded: first to communicate to the Assurers all the new informations and second to do Co-Audits. As Assurers follows the invitations to the ATEs we can expect, that they are more active in the community. So also from 2009 ATE experiences, we’ve got new resources from the community by contacts on ATEs (Get new resources). So this was the plan for 2010 ATE season, to find more people, who can help on the several tasks and projects that needs to be finished, before the new Roots and Escrow project and also the Audit can be (re-)started. E.g.

Helping CAcert

  • we are searching Infrastructure Admins for the Non-Critical Infrastructure systems, all running on Unix. Familiar with system migrations for the big Infrastructure project to separate Non-Critical from the Critical systems (The big Infrastructure Task). This project is running about 2 years, but currently without progress.
  • we are searching for Software Developers (C++, Python, Java) for the New Software project BirdShack (New Software Project BirdShack), that was started last year, after Auditors review of the Software that concludes: „Serious difficulties in maintaining, improving and securing.” and „Cannot form conclusion over software.”, so if the plan to start with the Audit over the old Software fails, we’re close to the 2nd path: BirdShack.
  • we are searching for Audit consultants who can assists in the Audit next step CrowdIt disclosure system (read AGM – Audit Report 2010 – CrowdIt. CrowdIt, as a sort of wordplay on Crowd-Audit). CrowdIt is an emerging disclosure tool (based on the old DRC browser).
  • we are searching people, who can assist us in the funding project (Funding project), that becomes the ground base for the New Roots and Escrow project (New Roots and Escrow) that should be keep tracked by an Auditor, and the re-start of the Audit (Audit over Assurance (RA) 1) and (Audit over Systems (CA) 2).

The New Roots and Escrow Project Relation to Audit

As said before, the New Roots and Escrow Project should be keep tracked by an Auditor. From the experiences back in 2008 on creating New Roots but fail on Roots Escrow, we’re warned to separate the Audit steps of the New Roots and Escrow Project (New Roots and Escrow) and the Audit over Systems (Audit over Systems (CA) 2). Both tasks should be close together.

On the other side, we have to do an Audit over Assurance (Registration Authority, RA) (Audit over Assurance (RA) 1). There is no requirement on bundling the RA Audit and CA Audit as both business areas have their own Policy sets and can be checked separately. This can make our work presumably easier. Easier to get Audit funding for Audit over RA. As Assurance area is closer to be Audit Ready, we can also signal to the Community Audit is back on track. This will probably push the other tasks. With a small budget we probably can double the result by getting new resources, “Hey, there is progress on the overall Audit task” – CAcert is back!