Subject: RE: Policy User Interfaces (was RE: Setting X.509 Policy Data in IE, IIS, Outlook)

From: [email-masked]
Date: Thu, 12 Feb 2004 00:13:11 +1300

"Santosh Chokhani" <[email-masked]> writes:

>To All Those who want to simplify 3280 and get rid of policy stuff:

I don't want to get rid of it, I want to make it an option alongside policy=
CA.

>What problems are your applications encountering with the certificates in the
>area of policy processing?  Specific examples only.

None, because apart from some test certs I've never seen any certs with policy
constraints and mappings and chrome tailfins and all the other stuff.  The
problem isn't "policy processing", the problem is that users look at the spec,
see a mass of incomprehensible complexity (and I'm referring specifically to
the incomprehensible policy complexity, not any other incomprehensible
complexity that may or may not be present), and after a lot of head-scratching
go with "policy=CA", never quite sure whether they're doing the right thing
because the spec never comes out and says it's OK, but it's the only option
that makes sense to them.

This fix doesn't involve implementations at all, it makes things simpler for
users with no effect on implementations.

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 11 Feb 2004 09:50:18 -0500

Peter:

You can do that now with any change.  Require explicit policy as path
processing output (vice pass/fail factor) will make this air tight.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, February 11, 2004 6:13 AM
To: [email-masked]; [email-masked]
Subject: RE: Policy User Interfaces (was RE: Setting X.509 Policy Data inIE,
IIS, Outlook)

>What problems are your applications encountering with the certificates 
>in the area of policy processing?  Specific examples only.

None, because apart from some test certs I've never seen any certs with
policy constraints and mappings and chrome tailfins and all the other stuff.
The problem isn't "policy processing", the problem is that users look at the
spec, see a mass of incomprehensible complexity (and I'm referring
specifically to the incomprehensible policy complexity, not any other
incomprehensible complexity that may or may not be present), and after a lot
of head-scratching go with "policy=CA", never quite sure whether they're
doing the right thing because the spec never comes out and says it's OK, but
it's the only option that makes sense to them.

Peter.