Re: Policy 2.5 Proposal: Require qualified auditors unless agreed in advance

2017-04-12 Thread Gervase Markham via dev-security-policy
On 12/04/17 11:37, Jakob Bohm wrote: > Does this (accidentally?) remove the ability of Mozilla to explicitly > distrust a specific formally qualified auditor, such as E HK? Good point. Not sure, but we should make that clear. Add to the end of that exception sentence ", or refuse audits from

Re: Policy 2.5 Proposal: Require qualified auditors unless agreed in advance

2017-04-12 Thread Jakob Bohm via dev-security-policy
On 12/04/2017 11:47, Gervase Markham wrote: Way back when, Mozilla wrote some requirements for auditors which were more liberal than "be officially licensed by the relevant audit scheme". This was partly because organizations like CACert, who were at the time pondering applying for inclusion,

Policy 2.5 Proposal: Require qualified auditors unless agreed in advance

2017-04-12 Thread Gervase Markham via dev-security-policy
Way back when, Mozilla wrote some requirements for auditors which were more liberal than "be officially licensed by the relevant audit scheme". This was partly because organizations like CACert, who were at the time pondering applying for inclusion, might need to use unofficially-qualified