Subject: Re: QC: VERISIGN uses UIDs!

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 09 Nov 1999 20:45:41 -0700

Steve,

For someone who works for a competing Certification Authority, 
that was a cheap shot, and did not exhibit the impartiality
that is normally expected of a WG chair.

Surely you understand the legacy of some of those particular 
"innovations", dating back to a time when the PKIX RFC was not nearly so
advanced, and the various browsers were in a much more parlous 
state than they are now.  Back then VeriSign really didn't have much choice.

I'm not saying that I defend or support everything that they do, nor
GTE (my former and your current employer) either. The same is true of 
Entrust and others. And BTW, we have a CA product as well, and not 
everything is perfect with that product either.

But just as I recognize the pre-eminent position of Microsoft in many aspects of
this business, I also recognize the considerable market success that VeriSign has
achieved. I may not always agree with what they do, but I don't throw rocks 
at them.

Although some people's stock is appreciating very nicely, I don't know 
of anyone in this business who is making a ton of money yet, and as a 
consequence I don't know of anyone who has all of the time and personnel
they wish they had to make everything better all at once.

Let's try to avoid both ad hominem and "ad corporate" attacks,
and concentrate on the message. Taking an ex cathedra position
on various issues, as you seem increasingly inclined to do, really 
isn't very helpful.

Bob

>>> Stephen Kent <[email-masked]> 11/09/99 03:29PM >>>
Anders,

If we followed VeriSign's behavior re certificate syntax, we would 
also encourage e-mail names hacked into DNs, CPS text embedded in 
certificates, etc.  I'm afraid I don't consider VeriSign to be the 
reference standard for certificate syntax.

Steve

---

From: [email-masked]
Date: Wed, 10 Nov 1999 08:23:19 EST

Guys,

I think this discussion needs to be taken off line!

Charlie

---

From: Stephen Kent <[email-masked]>
Date: Wed, 10 Nov 1999 10:12:00 -0500

>Bob,

>that is normally expected of a WG chair.

My observations about some of the syntactic choices that have 
appeared in VeriSign certificates have nothing to do with my 
relationship to CyberTrust. CyberTrust is only one of the 3 corporate 
entities with which I work here at GTE.  In my capacity as Chief 
Scientist of Information Security for BBN I made similar observations 
about some of these issues long before the merger that brought 
CyberTrust into my realm.

The observations are factual.  One may argue that VeriSign, as the 
first major TTP CA, has been in the forefront of the business and 
thus has gone to market with their perceptions of what is appropriate 
before standards bodies have rendered decisions that would guide 
their implementations.  However, I think we can find examples where 
even that argument is overly charitable.  I don't mean to single out 
VeriSign as the only CA service provider who has made choices of this 
sort; others are guilty too, both as service providers and as CA 
technology providers.  But since Anders used VeriSign as the exemplar 
for appropriate certificate syntax, my response had to be couched in 
the context he established.

>state than they are now.  Back then VeriSign really didn't have much choice.

We all make design choices and those choices reflect individual 
tastes and prejudices. The PKIX list discussed many issues prior to 
issuing I-Ds and RFCs and the likely outcome was established well 
before issuance. It is always the case that vendors who chose to make 
product/service decisions prior to issuance of an RFC run the risk of 
not being compliant.  That is a tradeoff that vendors make in 
pursuing "first to market" strategies.

>everything is perfect with that product either.

Agreed.

>achieved. I may not always agree with what they do, but I don't throw rocks

I have no qualms about throwing rocks at Microsoft either, when it is 
justifiable.  I never consider market position to be a substitute for 
correctness, for standards compliance, etc.  In fact, I think that 
companies who use their market position to flout standards deserve to 
be criticized for such behavior and I do so regularly, in a variety 
of fora.

>on various issues, as you seem increasingly inclined to do, really
Sorry you don't like my comments.  I try to maintain impartiality in 
dealing with all the players in this arena, and I have received many 
private compliments on my general restraint, and my occasional 
rebukes, in the context of the debates we have on this list.  My 
observations on VeriSign are, as noted above, accurate and, I 
believe, justifiable, given the context of the message to which I 
have responded.  They were not intended to criticize VeriSign in 
isolation, but to refute the use of VeriSign as a reference point for 
the argument. As for ad hominem attacks, I feel that my rebukes to 
folks who have continually and forcefully espoused positions that 
have been rejected by the WG, have been necessary to avoid wasting my 
time and that of the list. Based on the feedback I have received, I'm 
satisfied with my behavior.

Steve