posts

I’ve created a new draft 8 of the proposed Mozilla CA certificate policy. The main substantive changes are as follows: I changed references to “users” to clarify that we’re referring to users of the products distributed by the Mozilla Foundation through mozilla.org. I added a requirement for CA disclosure of business practices in the form of a Certification Practice Statement. Besides being a good idea in general, it’s typically the CPS that is referenced in auditor/evaluator reports, so it’s needed to provide a more complete picture of the CA’s conformance to whatever criteria are used to evaluate its operations. (For examples of Certification Practice Statements see my draft Mozilla CA certificate list.) I removed the explicit reference to knowledge of X509v3 in the qualifications for an independent and qualified third party. I consider it implicit in the reference to “related standards” and I’m not sure how useful it is to single out X509v3 in this context. I explicitly allowed for the possibility of the Mozilla Foundation doing its own CA evaluations, as requested by Zach Lipton and others. Note that I worded this clause the way I did because in practice such evaluations—if ever done—would almost certainly be done not by actual Mozilla Foundation employees but rather by someone else designated to act on their behalf. I added a note that we will reject CA requests if we don’t get the needed information in a timely manner. In part this is to motivate me to actually resolve requests with a “yes” or “no” answer, as opposed to letting them sit in Bugzilla without action. (I’ll definitely plead guilty to this, and I apologize to the CAs for which it’s happened. I’m going to try this month to go through all the CA-related bug reports and resolve them one way or another.) ...

I’ve published a new draft of the proposed Mozilla CA certificate policy. For information on changes from the previous draft please see my posting in the netscape.public.mozilla.crypto newsgroup (aka the mozilla-crypto mailing list). (Note that I have not yet completed writing the accompanying FAQ, but will try to do so in the coming weeks.) This new draft is intended to replace the simple “WebTrust or equivalent” policy that I’ve been using recently when deciding whether or not to approve CAs for inclusion in Mozilla-related software. (This interim policy was based on Microsoft’s policy.) ...

A while ago someone wrote to mozilla.org staff asking “What is the ECCN for Mozilla?” For that small fraction of the world’s population who knows what an ECCN is (an “Export Control Classification Number” for U.S. encryption export control regulations) and cares about what Mozilla’s ECCN happens to be, here’s the answer I gave. Note that this is not an “official” answer, but it’s the closest thing to it you’re likely to get. ...

UPDATE 2023-03-27: This page is obsolete, as it refers to a prior version of this blog. However, it may be of historical interest. I use the seemore plugin by Todd Larason to show only excerpts of entries on my main blog page, index pages for categories, and archive pages, while displaying the entire article on an individual entry’s page. It’s worked well, with one exception: When I created my RSS and Atom feeds I wanted the feeds to contain the full text of all entries, for the convenience of people using news readers. (Many of these applications display article text directly in the reader, removing the need to open a browser window to read the article.) ...

UPDATE 2023-03-27: This page is obsolete, as it refers to a prior version of this blog. However, it may be of historical interest. I’ve been using the entries_cache_meta plugin by Jason Thaxter, mainly for the convenience of specifying the modification date within the entry file. After a while I decided I’d like to also use its “meta” capability, i.e., the ability to specify arbitrary variables in the entry header along with the modification time, e.g., ...

UPDATE 2023-03-27: This page is obsolete, as it refers to a prior version of this blog. However, it may be of historical interest. I’ve previously blogged about my canonicaluri plugin that checks to see whether the requested URI is in the canonical form for the type of page being requested, and if necessary does a browser redirect to the canonical form of the URI. However the canonicaluri plugin may be overkill for some people, for example, it presumes use of the extensionless plugin, so that canonical URIs for individual entries do not have file extensions for the default flavour. A simpler alternative to the canonicaluri plugin is the slashredir plugin, which only enforces proper usage regarding trailing slashes. ...

UPDATE 2023/12/31: This is the first post for my blog after I converted my personal website hecker.org to use Blosxom. I’m including it here for historical interest. After a long period of neglecting my personal web site, I’ve decided to start my own weblog, with the goal of making it easier for me to publish new material and therefore (I hope) more likely that I’ll actually write more. My plan is to write about things that interest me, on the theory that they might interest at least a few other people. As part of that I’ll occasionally discuss the volunteer work I’ve been doing for the Mozilla project. ...

UPDATE 2023-03-27: This page is obsolete, as it refers to a prior version of this blog. However, it may be of historical interest. As many people can attest, sometimes you spend more time (and have more fun) tinkering with the underpinnings of a web site instead of actually writing new content to be posted on it. In that spirit, here is my current list of things I’m planning to add to or change about my web site and blog. ...

UPDATE 2023-03-27: This page is obsolete, as it refers to a prior version of this blog. However, it may be of historical interest. The “official” atomfeed plugin does not generate valid feeds for the current version (0.3) of the Atom specification because the output does not have a “modified” element for the feed as a whole, just “modified” elements for each story. Obviously the modification date/time for the feed can be interpreted as the date/time modified of the most recent story, so then it’s just a matter of generating the proper output for the MODIFIED tags. ...

UPDATE 2023-03-27: This page is obsolete, as it refers to a prior version of this blog. However, it may be of historical interest. In a previous post I discussed the general problem of validating and caching dynamic content. In order to implement the strategy outlined in that post I decided to create a new version of the lastmodified plugin originally created by Bob Schumaker. The lastmodified plugin was a good base to build on; however it didn’t do exactly what I wanted to do, and hence I couldn’t resist trying to improve on it. ...