w o r k -- i n -- p r o g r e s s
--This is wip-V0.05 as of 20091213. -
+
++This is wip-V0.06 as of 20100623. +Comments: +
-+Policy starts: +
-0. Preamble
+0. Preamble
This section is not part of the licence but may be explanatory. Skip to licence.
-+
0.1 Being that,
@@ -39,7 +79,8 @@ Being that, for the direct benefit and RELIANCE of its Community of signed-up users ("Members"), RELIANCE being defined as the Member's act in making a decision, - including taking a risk, in whole or in part based on the certificate, + that takes on a risk or liability, + in whole or in part based on the certificate, and
+
0.2 And that,
@@ -72,12 +113,12 @@ And that, to provide for a high degree of choice and control over certificates; -+
0.3 And that, in offering the USE of certificates to the end-user,
+
0.4 And that,
@@ -122,7 +163,7 @@ And that, to its end-users;+
0.5 We both, CA and Vendor, agree that,
@@ -155,9 +196,9 @@ the following Licence and Disclaimer is offered by CAcert to Vendor. 3rd Party Vendor - Licence and Disclaimer -We (the Vendor and the CA) @@ -167,7 +208,7 @@ Your agreement is given by your distribution of the root within your distribution of your root list.
-The relationship between the Vendor and the end-user @@ -187,14 +228,14 @@ expectation for explicit agreement by the end-user, because of the methods and restrictions of delivery.
-CA offers this licence to permit Vendor to distribute CA's roots within Vendor's root list to Vendor's end-users.
-Vendor agrees
@@ -205,7 +246,7 @@ Vendor agrees to advise the end-user of the NRP-DaL appropriately. -Vendor agrees to make available CA's root key @@ -224,9 +265,9 @@ CA is the person making claims is likely to be material in a dispute over claims.
-Vendor's relationship with end-users creates risks, liabilities @@ -243,7 +284,7 @@ in NRP-DaL.
-Notwithstanding the general disclaimer on liability above, @@ -253,16 +294,16 @@ This is the same limit of liability that applies to each member of the CAcert Community.
-The Choice of Law is that of NSW, Australia. Policies in force within CAcert are incorporated.
-We agree that all disputes arising out @@ -285,37 +326,43 @@ The following parts are not part of the above licence, but may shed light.
-Liability agreement between CA and Vendor -suggests that the end-user be presented with the name of the CA. +suggests that the end-user be presented with the name of the CA +in any act where the certificate is USED. This is useful for identifying the particular characteristics of the CA, and accepts that all CAs are different. Each CA has its ways of checking, its relevent laws, and its -particular view as to the interests of the end-user. +particular view as to the interests of the end-user, +and it is PKI practice and CPS practice that the +obligation falls on the end-user to understand this.
The Vendor should present the name of the CA so as to inform -the end-user of what can be known. -In the event that the Vendor does not present the CA, -the CA is taking on all the risk and liability that the -CA is equivalent to others, which can only be rationally -measured as the lowest-common-denominator, that is, -the lowest of the liabilities that is accepted across all -CAs that are shipped by the CA. -This would generally be zero. +the end-user of what can be known about the claim being made. +In the event that the Vendor does not present the CA's name, +the CA is taking on the risk and liability that is +equivalent to other CAs. Such a position can be seen +rationally as the lowest-common-denominator, that is, +the claim is no better than the worst claim made by the +worst of CAs. +Therefore the liability that is accepted by this CA is +the lowest that can be applied to any CA in the same position. +This liability limit would generally be zero. +Any additional liability would therefore fall to the Vendor.
If the CA has been presented to the end-user, the end-user -is able to discriminate. -In this case, it is reasonable for the CA to offer to share -the liability, and to accept some limit -to that liability. +is able to discriminate. CAs are no longer equivalent. +In this case, it is reasonable for the CA to share +the liability, over and above the lowest common denominator, +up to the limit expressed in the above licence.
@@ -327,7 +374,7 @@ to the end-user must be disclaimed totally. In other words, set to zero.
-To reasonably show the name of the CA is undefined, @@ -345,7 +392,7 @@ same information, however this is not quite how it is tested in law; instead, it is more of a gut-feeling.
-This licence is not intended to limit the ability of @@ -357,6 +404,40 @@ to be aware of this licence and to take appropriate steps. The primary Vendor discharges any responsibility to the re-distributor by making available this licence on the same basis as its other licences. +See §1.4-1. +
+ ++As a convention of contract law, the participants +are typically called parties. +The CA is the first party. +The Member is the second party, +under a direct contract with CA +(CCA). +
+ ++The end-user however is typically not a direct party to the contract +known as +NRP-DaL +because she has typically not seen it nor agreed to it. +In deference to this difficult position, she is termed +the second person rather than second party, +and more formally known as a Non-Related Person to +underscore that situation. +
+ ++Therefore, +in order to keep the above terms constant and less confusing, +any distributor is therefore termed the third person. +Hence this present agreement is between the first and third persons, +and the title reflects that. +(The use of the term Vendor does not imply there is a sale, +it is only industry convention to include free distributors +under this label.)