Tag Archives: Policy

The policy group has started a new vote on “CCA – Update” (CAcert Community Agreement)

CAcert-vote p20140709After a long period of inactivity on the policy side, we are back in
in business again.

In February board nominated a Policy Officer (Eva Stöwe) and this was later
confirmed by a Policy Group vote.

At about the same time an intensive discussion regarding changes to the CCA
started.

There are a lot of changes, some of them being just cleanups or
rephrasing, but there are also some bigger changes.

The central changes are:
– The CCA can be accepted by more ways than currently allowed.
– How CCA may be terminated was greatly rephrased, it now also covers
death of members.
– A clear obligation to answer truthfully before and to help arbitration
was added.

If you want to follow the discussion visit the archive on
https://lists.cacert.org/wws/arc/cacert-policy.

The actual version of the proposal is located here:
http://svn.cacert.org/!svn/bc/2568/CAcert/Policies/CAcertCommunityAgreement_20140708.html

Every community member is also invited to participate by joining the
policy group. Just subscribe the mailing list cacert-policy@lists.cacert.org

The state of the voting can be found at https://wiki.cacert.org/PolicyDecisions#p20140709

The voting stays open until Sunday 27th of July 2014.

ATE Manchester / Crewe, UK – Sat 14th January

Much has happened during recent years. The old way of orally-transmitted procedures has now gone, and our rules have been cast into formal policies. New procedures (e.g. the Assurer Challenge) and obligations (e.g. in the CAcert Community Agreement) have been approved.
Continue reading

Easter Egg Challenge 2011

Easter Egg
We’ve just started our this years Easter Egg Challenge … We’ve put a couple of patches on to our testserver CACERT1 for you, our fellow and our new Software testers. We’ve put light to heavy patches to the package so everybody is able to walk thru the testserver web pages and search our Easter Egg’s.
Continue reading

The Big Masterplan to become Audit Ready

Back in January 2010 the former Board decided by Board motion m20100117.3 “No new subroots on current root, plan for new root”. In the discussion a date was scheduled by end of Dec 31, 2010. On my 2nd thought, probably nobody did recognize, what that means, CAcert's Big Masterplan To become Audit Ready (01/2010) to finish all the projects from the bottom left corner at beginning of 2010 to the top right corner by end of the year with the “New Roots and Escrow” (New Roots and Escrow) process running. So this article should bring Audits mistery to light.

Policy Group worked on the last few essential Policies (Policies on Policy Group), that are essential for the Audit. One essential requirement for Audit is to Rollout the CAcert Community Agreement to all the members, so they can decide to continue or to leave the Community. To become “CCA Rollout Ready” (CCA rollout), the running Software needs to be updated. This opens the next problem: by starting 2010, there was no Software Update Process defined, nor documented. But we’re on the lucky side, the Software-Assessment-Project started November last year to fulfill this requirement (Software-Assessment-Project). The task was: To get a repository system controlled by Software-Assessment team, a controlled testserver environment and a documentation system. Currently the team tests the transfer of a test patch to the production system. Involved parties: Software-Assessment Project team, Software-Assessment team and the Critical Sysadmins team.

CAcert's Big Masterplan To become Audit Ready (10/2010)
CAcert’s Big Masterplan To become Audit Ready (10/2010)

In the meantime, another issue pop’d up: the “Thawte points removal” with a deadline of Nov 16th, 2010. We’ve allready posted several blog posts on this topic. So also this is related onto the Software-Assessment-Project progress (Software-Assessment-Project).

The next topic is running Assurer Training Events (ATE) (Assurer Training Events). ATE’s are an essential concept in the Audit over Assurance (RA) business area. To scale a worldwide community, the community has to assist Auditors work in doing Co-Audits over Assurers. The question: How to contact groups of Assurers was answered back in 2009 with the ATE concept. The purpose of ATE is twofolded: first to communicate to the Assurers all the new informations and second to do Co-Audits. As Assurers follows the invitations to the ATEs we can expect, that they are more active in the community. So also from 2009 ATE experiences, we’ve got new resources from the community by contacts on ATEs (Get new resources). So this was the plan for 2010 ATE season, to find more people, who can help on the several tasks and projects that needs to be finished, before the new Roots and Escrow project and also the Audit can be (re-)started. E.g.

Helping CAcert

  • we are searching Infrastructure Admins for the Non-Critical Infrastructure systems, all running on Unix. Familiar with system migrations for the big Infrastructure project to separate Non-Critical from the Critical systems (The big Infrastructure Task). This project is running about 2 years, but currently without progress.
  • we are searching for Software Developers (C++, Python, Java) for the New Software project BirdShack (New Software Project BirdShack), that was started last year, after Auditors review of the Software that concludes: „Serious difficulties in maintaining, improving and securing.” and „Cannot form conclusion over software.”, so if the plan to start with the Audit over the old Software fails, we’re close to the 2nd path: BirdShack.
  • we are searching for Audit consultants who can assists in the Audit next step CrowdIt disclosure system (read AGM – Audit Report 2010 – CrowdIt. CrowdIt, as a sort of wordplay on Crowd-Audit). CrowdIt is an emerging disclosure tool (based on the old DRC browser).
  • we are searching people, who can assist us in the funding project (Funding project), that becomes the ground base for the New Roots and Escrow project (New Roots and Escrow) that should be keep tracked by an Auditor, and the re-start of the Audit (Audit over Assurance (RA) 1) and (Audit over Systems (CA) 2).

The New Roots and Escrow Project Relation to Audit

As said before, the New Roots and Escrow Project should be keep tracked by an Auditor. From the experiences back in 2008 on creating New Roots but fail on Roots Escrow, we’re warned to separate the Audit steps of the New Roots and Escrow Project (New Roots and Escrow) and the Audit over Systems (Audit over Systems (CA) 2). Both tasks should be close together.

On the other side, we have to do an Audit over Assurance (Registration Authority, RA) (Audit over Assurance (RA) 1). There is no requirement on bundling the RA Audit and CA Audit as both business areas have their own Policy sets and can be checked separately. This can make our work presumably easier. Easier to get Audit funding for Audit over RA. As Assurance area is closer to be Audit Ready, we can also signal to the Community Audit is back on track. This will probably push the other tasks. With a small budget we probably can double the result by getting new resources, “Hey, there is progress on the overall Audit task” – CAcert is back!

New TTP-Assisted-Assurance to Draft – one more milestone in Policy!

TTP-Assisted-Assurance to DRAFTThis weekend, the Security Policy goes into DRAFT. Consensus has erupted in policy group once again.

The practicle work now can start, to write down all the documentation for the practice documents. Clean out the wiki with all the informations of the old TTP program and start spreading the new TTP-Assisted-Assurance to the CAcert deserts after the old program was frozen.

Who volunteers now to becoming the first TTP-admins ? As policy defines
Senior-Assurers to be the TTP-admins and the first new TTP requests will come soon probably
we have to deploy the policy now into practice. Thats again a Community Task. We need at least 3 TTP-Admins as following graphic displays:

             TTP ----:--> TTP-Admin (1) --> 35 points max
                 /       :         \
   Assuree =  -  -  :-  >      =----> TTP-Admin (3)  --> 35 points max (Topup)
                 \       :         /
             TTP ----:--> TTP-Admin (2) --> 35 points max
                         :........ CAcert internal ................................................

TTP-Admins should become familiar with the TTP’s available in a country of the TTP requestor so the program gets a strong path of reliance. One idea is to work close together with Organisation Assuers, who are familiar with the regulations in a country but its not limited to. These are only thoughts.