Subject: [wpkops] Survey Last Call

From: Rick Andrews <[email-masked]>
Date: Fri, 13 Dec 2013 08:54:35 -0800

WPKOPS,

I've been collating the questions we wanted answered to produce the snapshot of Web PKI use. Attached is a very nearly final draft. Tim has suggested this plan: you have until Wednesday 18 Dec (let's say close of business on Wednesday) to review and respond, then if at all possible it goes out to potential respondents by Friday 20 Dec, asking them to respond before Fri 31 Jan, 2014.

In addition to the questions, please look over the list of survey targets and email addresses to see if a) you see anything wrong, or b) you have a better contact than I do.

Thanks in advance for your help.

-Rick

---

From: Tom Ritter <[email-masked]>
Date: Fri, 13 Dec 2013 12:22:39 -0800

This is quite an extensive survey.  I wonder if it's length may reduce
response rate.  However, I think it does capture a lot of very important
information, and I'm anxious to see collected responses.  Perhaps it would
be appropriate to indicate that response is not required, but we are trying
to collect this information and that if they are unable to respond we'll
have to do our best to figure out their product's capabilities through
testing. (In my experience, some questions, like the wildcards, are likely
to need testing even if the company thinks they know how they work ;))

I did notice the following.  Apologies if these were ruled out in earlier
discussions.
 - OCSP Responder does not inquire after an ability to feed in a
certificate database for returning different answers for not-issued certs
 - OCSP Responder Nonce probably needs a "If the user configured it to"
option, or just add the word 'support' to the question
 - Perhaps it would be worth asking if you are able to tweak the SSL Record
Size for performance reasons

-tom

---

From: Rick Andrews <[email-masked]>
Date: Fri, 13 Dec 2013 14:00:24 -0800

Tom,

I agree that the length might be an issue, but there aren't many questions that I feel we could drop (maybe SPDY support, since strictly speaking it's not part of the web pki). I can explain when I send out the survey that we'd like all questions answered, but if that's not possible, answer as many as possible.

None of your points were discussed previously.

-          Feeding in a cert db: Is that as important as asking what response is given for non-issued certs?

-          Nonce - I'll add text as you suggest

-          Record size - I'll add text as you suggest.

BTW, to everyone else: I noticed that #&$%! Word mangled the formatting and lost the numbering in some places. I'm cleaning that up.

-Rick

From: wpkops [mailto:[email-masked]] On Behalf Of Tom Ritter
Sent: Friday, December 13, 2013 12:23 PM
To: [email-masked]
Subject: Re: [wpkops] Survey Last Call

This is quite an extensive survey.  I wonder if it's length may reduce response rate.  However, I think it does capture a lot of very important information, and I'm anxious to see collected responses.  Perhaps it would be appropriate to indicate that response is not required, but we are trying to collect this information and that if they are unable to respond we'll have to do our best to figure out their product's capabilities through testing. (In my experience, some questions, like the wildcards, are likely to need testing even if the company thinks they know how they work ;))

I did notice the following.  Apologies if these were ruled out in earlier discussions.
 - OCSP Responder does not inquire after an ability to feed in a certificate database for returning different answers for not-issued certs
 - OCSP Responder Nonce probably needs a "If the user configured it to" option, or just add the word 'support' to the question
 - Perhaps it would be worth asking if you are able to tweak the SSL Record Size for performance reasons

-tom

---

From: Tom Ritter <[email-masked]>
Date: Fri, 13 Dec 2013 14:03:53 -0800

On Dec 13, 2013 2:00 PM, "Rick Andrews" <[email-masked]> wrote:
Feeding in a cert db: Is that as important as asking what response is given
for non-issued certs?

Seem equivalent, I must have missed that one, so whichever.

-tom

---

From: Rick Andrews <[email-masked]>
Date: Fri, 13 Dec 2013 15:56:07 -0800

I'm attaching the cleaned up version - tiny content changes suggested by Tom, but for the most part, the same. I think the previous one was too difficult to read without proper formatting.

-Rick

From: wpkops [mailto:[email-masked]] On Behalf Of Rick Andrews
Sent: Friday, December 13, 2013 2:00 PM
To: Tom Ritter; [email-masked]
Subject: Re: [wpkops] Survey Last Call

Tom,

-Rick

-tom