在 2016年10月27日星期四 UTC+8下午6:22:03，wangs...@gmail.com写道： > 在 2016年10月27日星期四 UTC+8上午8:09:06，Peter Kurrasch写道： > > I think these are both good points and my recommendation is that Mozilla > > deny GDCA's request for inclusion. > > > > > > We should not have to explain something as basic as document versioning and > > version control. If GDCA can not demonstrate sufficient controls over their > > documentation, there is no reason for the Internet community to place > > confidence in any of the other versioning systems that are needed to > > operate a CA. > > > > > > Question: Are auditors expected to review translations of CP or CPS docs > > and verify consistency between them? > > > > > > > > > > > > > > > > > > > > > > > > From: Jakob Bohm > > Sent: Saturday, October 22, 2016 9:07 AM > > To: mozilla-dev-s...@lists.mozilla.org > > Subject: Re: Guang Dong Certificate Authority (GDCA) root inclusion request > > > > > > On 21/10/2016 10:38, Han Yuwei wrote: > > > > > > I think this is a major mistake and a investgation should be conducted > > > for CPS is a critical document about CA. This is not just a translation > > > problem but a version control problem. Sometimes it can be lying. > > > > > > > Let me try to be more specific: > > > > When publishing a document called CPS version 4.3 the document with > > that number must have the same contents in all languages that have a > > document with that name and version number. > > > > When making any change, even just correcting a mistyped URL, the > > document becomes a new document version which should have a new and > > larger number than the number of the document before the change. > > Thus when a published document refers to a broken URL on your own > > server, it is often cheaper to repair the server than to publish a new > > document version. Some of the oldest CAs have been proudly > > publishing their various important files at multiple URLs corresponding > > to whatever was mentioned in old CP and CPS documents etc., only > > shutting down those URLs years after the corresponding CA roots were > > shut down. > > > > There can also be a "draft" document which has no number and which > > contains the changes that will go into the next numbered edition. Such > > a "draft" would have no official significance, as it has not been > > officially "published". For a well-planned change, the final "draft" > > would be translated and checked into the relevant languages (e.g. > > Chinese with mainland writing system, Chinese with Hong Kong and Macao > > Special Administrative Regions old writing system, English), before > > simultaneously publishing the matching documents with the same number > > on the same day. > > > > There are infinitely many version numbers in the universe to choose > > from. There are also computer programs that can generate new version > > numbers every time a draft is changed, but computers cannot decide when > > a version is good enough in all languages to make an official > > publication, and the computer generated version numbers are often > > impractical for publication because they count all the small steps that > > were not published. > > > > > > Enjoy > > > > Jakob > > -- > > Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com > > Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 > > This public discussion message is non-binding and may contain errors. > > WiseMo - Remote Service Management for PCs, Phones and Embedded > > _______________________________________________ > > dev-security-policy mailing list > > dev-secur...@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-security-policy > > We’d like to explain a few points. > > 1. We have already implemented version control on Chinese version CP/CPS, the > revision and release of CP/CPS are reviewed and approved by the security > policy committee (see section 1.5 in CP/CPS). The Chinese version CP/CPS is > also reviewed by our auditor. > > 2. The Chinese version CP/CPS is the formal documents we published in our > Website. In the initial phase of "Bug 1128392", we have summited the Chinese > version CP/CPS to Mozilla, and Mozilla release a basic review list in file > "1128392-CAInformation.pdf" which contains instructions for us to summit some > chapters of the CP/CPS in English version. We are not able to provide an > accurate English version CP/CPS, but we will do our best to finish this > translations and upload for reviewing process. We will upload the new English > version CP/CPS for reference ASAP. However the English version CP/CPS should > not be considered as formal documents. In case of any discrepancy between two > versions, the Chinese version shall prevail. > > 3. Our auditor only reviews the Chinese version CP/CPS. It is not their > responsibility to confirm the translated English versions.
Since Mozilla's working language is English (Not sure about this), it's your responsibility to provide an accurate translation of CPS. And I don't think the problem is poor translation. There is SO MANY DIFFERENCES between Chinese and English version. As a native Chinese speaker I don't believe the reason is poor translation but a bit more like you want to cover-up something. What I most concern is about the CA certs and alogrithms. The English version didn't include serveral CA certs and SM2 and can't be explained by translation. For Wosign's SM2 cert accident, I suspect the missing of SM2 is intented. What's more, there is another possibilty is that the English verison and Chinese version are maintained seperately. _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
