Re: [pkix] An alternative proposal Was: Fwd: New Version Notification for draft-hamilton-cmr-00.txt

["Kyle Hamilton" <[e-mail]>]

On Wed, Nov 2, 2011 at 6:01 PM, Phillip Hallam-Baker <[e-mail]> wrote:
> Corporations are not people. No really, they are not.

As long as the state disagrees, I must go with the state definition.  If I don't, then I'm living in a psychotic, delusional fantasy world which has no bearing on reality.

> This country already fought one civil war over the belief that people were
> property. Now there are people thinking that property is people. Both ways
> of thinking are wrong.

In principle, I agree with you.  In practice, I can't.  We must live with the living, and respect the dead who got us to this state.

>> The death of a corporation is not to be taken lightly.  It directly
>> impacts the lives of all of its employees, deprives the state of a taxpayer,
>> and reduces the amount of tax revenue the state can extract from that
>> corporation's employees.
>
> In this case we have real people's lives at stake. 
> Confusing the issue with hyperbole trivializes the issue.

Given that the IETF was set up under state contracts (DARPA), I must go with the state definition, because that's how the law works.  Don't like it?  Make political change in your sovereign, not the IETF.  NOTHING will be changed by your complaining that it's wrong.

Also, corporation-as-person has a really nice side effect profile: it permits discussion of "the RP's OCSP responder" which is instituted by corporate governance.  Until a trustworthy (with issuance data) publicly-available subscription OCSP service exists, I'm going to assume that the reason for RP-based OCSP is to spread revocation information throughout the corporate body like an inoculation.

That is where the disconnect between known-issued and known-revoked certificates is least obvious and particularly damaging.  The DigiNotar incident showed that the PKIX mechanisms were insufficient to meet the needs of the end-user.  Corporate risk managers had to instantly get new certificates, and thousands if not hundreds of thousands of guilders were spent by people (including corporations, via their paychecks to the natural people who perform the corporation's work) who were certified and had to do a new enrollment as a result.

Now, DigiNotar has really gotten people's attention because now it's not just the corporations who are hurt by this.

Hyperbole or not, I prefer to live in reality, where (however regrettably) the law says that corporations are people.  I'm not going to labor under any psychotic delusion that they have no standing under the law and cannot bring suit in their own names (which is part of the state definition of 'person', incidentally).  They are people, with birth (filing of articles of incorporation) and death (dissolution of corporation), until the law does not recognize them as such.

-Kyle H