Policy-Discussion

[Iang <iang AT iang.org>]

Lambert.Hofstra AT ins.com
 wrote:
> > Let's say that we agree with that principle, and CAcert is out of the
> > picture.
> >
> > Do we also say that the end-user also is never to be held responsible?
> > Or do we say that the end-user *is* to be held responsible?
>
> Define "end user": is this
> a) the owner of the CSC?
> b) the person running the code?
> c) someone else?


Above, I meant the NRP, the poor sod who's computer just got 
trashed, or worse, bank account raided.

That is, there are these parties:

a. code author
b. code distributor
c. CAcert
d. Assurer(s)
e. Browser vendor
f. end-user / NRP
g. attacker

For now.  The question for the moment is to allocate the 
Risks, liabilities and obligations amongst that set.

Please sum the numbers to 100% :)


(all rest in your email, ok.)

iang

PS: darn it, my computer is installing an unsigned quicktime 
bug fix... restart required.