Policy-Discussion

[Bernhard Froehlich <ted AT convey.de>]

Maybe only because I have said nothing for a long time it itches me to 
make some statements...

   * IMHO Assurances should be made by people, not by organisations.
     Otherwise the org could name its own Assurers. CAcert would
     probably be able to insist on rules for appointing Assurers, but
     what would be gained if orgs would only be allowed to select
     Assurers who fulfill all Assurer requirements of CAcert?
   * An employee may only hide behind his/her company if acting as an
     employee. And a company may only sacrifice an Org Admin if they
     have evidence that they told the Org Admin not to do wrong. Or
     that s/he did not act as an employee. So in a case of Arbitration
     against an Org Certificate either or both might be subject to the
     ruling (assuming that orgs are considered members).
   * The fact that 1000 EUR is no punishment for many companies may be
     true, but is not really relevant. The same is true for individuals.
   * Though I would prefer OA to be included in Mozilla roots I'd say
     that our prime purpose is to "serve" our individual members. So
     I'd prefer a quick(er) inclusion without OA to a (significantly)
     delayed inclusion with OA. Especially because several uses of OA
     can be worked around with individual certificates.

My small coins on the topic...

Ted
;)

--
PGP Public Key Information
Download complete Key from http://www.convey.de/ted/tedkey_convey.asc
Key fingerprint = 31B0 E029 BCF9 6605 DAC1  B2E1 0CC8 70F4 7AFB 8D26

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature