Policy-Discussion

[Ian G <iang AT systemics.com>]

Duane wrote:

> *sigh* this has happened from time to time, where people introduce their
> own "standards" that don't match the official line, however the current
> policy (as per the official english version of the assurance form) is
> you need at least 1 photo ID, but ideally you should present 2 forms of
> government issued ID.

> At no point anyone should ever accept non-government ID, and even some
> government IDs should be explictly exempt such as library cards and
> other forms of ID that have dubious amounts of checking.
>
> At no point should anyone ever accept credit cards or other financial
> documentation for liability reasons (ie if something happens do you
> really want to be answering lots of difficult questions etc?)


These are all good points ...  I worry that there is too 
much richness compressed into short paragraphs.  The 
statements on the (english) form also suffer from too much 
brevity.

So they cannot be relied upon.

Someone wrote an Assurance Handbook (I haven't read it 
lately ... perhaps I should) and that seems to be a much 
more suitable document to expand out the basic rules ... 
especially as the CPS simply refers to it.

http://wiki.cacert.org/wiki/AssuranceHandbook2

Jens is writing training materials, and these need to derive 
from somewhere.  He has someone working on testing 
materials, and ditto, they need to derive from somewhere. 
Every Assurer needs a document ...


> Unless there is a good reason to change this policy all other documents
> should reflect the assurance page, not the other way round, it is the
> document that everyone sees when they apply for points, they don't
> see/read other documents.


But there needs to be references for this, and an ability to 
point to it.  By "assurance page" you mean the Assurance 
Handbook http://wiki.cacert.org/wiki/AssuranceHandbook2  right?

Right now this is how the draft documents have it crafted:

   1. The CPS points to the Assurance Handbook.
 http://www2.futureware.at/svn/sourcerer/CAcert/policy.htm

   2. The Assurance Handbook should document the process.
      http://wiki.cacert.org/wiki/AssuranceHandbook2

   3. The forms and other materials (training + testing)
      should follow the Assurance Handbook.


So when you say that there is a mismatch between official 
policy and other things, which part in the above are you 
saying is wrong?  Which part has to be fixed?

E.g., the Assurance Handbook says

    * A comprehensive set of institutional IDs.
    * Institutional IDs are those issued by banks and
      other agencies deemed reliable.

Which would contradict the second para above.  So one of 
these statements needs to be fixed.

(I don'd disagree with either statement here ... I just want 
it fixed.)


iang