Subject: GA-DIGEST V1 #1580
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST          Friday, February 7 2003          Volume 01 : Number 1580

----------------------------------------------------------------------

Date: Fri, 07 Feb 2003 03:01:09 -0800
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

Ram and all former DNSO GA members or other interested parties,

Ram Mohan wrote:

> Karl:
> I am mystified after reading your post.  I share similar beliefs to yours
> reg. data privacy.  Some of your statements seem to be derived from a
> different reading of my post than what I intended -- let me clarify.
>
> > The burden of proving that access to personally identifiable information
> > is a valid access ought to fall on the person requesting access, not on
> > the data subject.
>
> + Agreed.  I merely point out that Whois information has value beyond just
> marketers and ip/trademark folks.  Although network operators use
> address-registry whois information more than domain-registry, they do (also)
> use domain whois information.  Individuals should have the ability to
> protect information about themselves from being indiscriminately
> displayed/mined/sold.

  Individuals should have the already legally mandated right to keep
or restrict any and all of their personal and private information, including
Whois data from being even viewed by anyone without their expressed
written permission.  Currently what you suggest above in response to Karl's
well stated comments/remarks is still not sufficient, nor is the current
Final Report from the Whois Task force...

>
>
> > Why are people who feel they need to protect their privacy "egregious
> > violators".  Suppose you had young children, would you feel comfortable
> > publishing your (and thus their) addresses and phone numbers onto an open
> > directory?
>
> + You misread what I said.  I said that providing *only* individuals the
> right to provide access to data works as long as the premise is that the
> individual supplies accurate/valid data.  However, some of the most
> egregious violators (such as domain slammers) wantonly provide false
> information - and those trying to get "their" domain name restored to them
> have a problem.

  Reverse Domain Name slamming is primarily achieved by getting information
from Personal and private information from Whois.  The Sex.com case is a
good example. There are many more, many of which have been publicized
and shared in the recent past on this vary forum.

>
>
> > If there are reasonable grounds to believe that someone has
> > violated a civil or criminal law, there are well established legal
> > procedures (many of which involve going before a neutral magistrate and
> > making a showing of those reasonable grounds) to obtain access to things
> > like domain name registration databases.
>
> + Indeed.  As long as you can find someone/someplace to serve.  Or if the
> domain name database has accurate information to go after that
> individual/group.  The OECD case showed some interesting practical
> challenges to this approach.
>
> > And let's be careful not to turn whois into Megan's law in reverse: in
> > which internet users are forced to publish their (and their children's)
> > names, addresses, and phone numbers for the benefit of any and all
> > predators.
>
> + I don't disagree with you on this.  I certainly get my share of spam,
> unsolicited calls, etc thanks to having accurate information available via
> Whois.
>
> In reality, domain name Whois information represents a shrinking percentage
> of the total Internet (and world) population -- its relevance reduces every
> passing year.  You can pick up far more detailed, segmented demographic
> information about me (or you) through product registration databases that
> get updated when people send in registration cards for everything they buy -
> and which they don't realize is often distributed without their permission.
>
> There needs to be a place where accurate domain contact information resides.
> Access to this information ought to be restricted and differentiated.
> Permission needs to be sought.  Current practice is often a mess, and
> abused.  Does this mean we should "completely disengage from the current
> system", as Ross suggests ?  Maybe Ross' suggestion is just about marketer
> use/abuse of Whois data, in which case I have nothing more to say on the
> topic.
>
> Back to my day job now.
>
> -ram
> ----- Original Message -----
> From: "Karl Auerbach" <[email-masked]>
> To: "Ram Mohan" <[email-masked]>
> Cc: <[email-masked]>; "'George Kirikos'" <[email-masked]>;
> <[email-masked]>
> Sent: Friday, February 07, 2003 1:01 AM
> Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?
>
> >
> > On Thu, 6 Feb 2003, Ram Mohan wrote:
> >
> > > Interesting thoughts and an interesting premise.  The problem is, that
> the
> > > groups you mention here (marketers, IP folks, etc) are not the only
> people
> > > who utilize Whois information.
> > >
> > > System operators (including technicians, systems administrators
> responding
> > > to abuse, etc) often depend solely on information found in Whois to
> > > determine next courses of action for serious network and other related
> > > issues.
> >
> > I disagree - Folks in NOCs *do* use something called "whois", but it most
> > often it is a distinct set of databases pertaining to IP address
> > allocations.
> >
> > Why do NOC folks use the IP "whois"?  Simply because the key that one has
> > for the lookup is less easily forged.  Domain names on purported spam
> > e-mail are only ocassionally accurate.  But the IP address on a TCP
> > connection has intrinsic value because a TCP connection can not be formed
> > unless both the source and destination address are actually reachable.
> >
> > Assuming for the moment that ISP's and such obtained value out of DNS
> > whois information - That still doesn't justify them mucking around unless
> > certain conditions are met:
> >
> >   1. That a person who acquires a domain name is informed from the outset
> > that such access will be performed by ISP people.  (I.e. actual or implied
> > consent by the data subject.)
> >
> >   2. The person who is doing the looking is actually a real ISP person
> > following up on a specific legitimate problem.
> >
> > It would not be all that hard for anyone claiming to be an "ISP" to jump
> > through some qualification hoops in order to gain a whois access
> > credential.  For instance, once a year.
> >
> > The burden of proving that access to personally identifiable information
> > is a valid access ought to fall on the person requesting access, not on
> > the data subject.
> >
> > > Your premise is also that all individuals provide accurate information.
> We
> > > know (you definitely do, as a registrar) that some of the most egregious
> > > violators make sure that they provide _false_ information.
> >
> > Why are people who feel they need to protect their privacy "egregious
> > violators".  Suppose you had young children, would you feel comfortable
> > publishing your (and thus their) addresses and phone numbers onto an open
> > directory?
> >
> > > Giving individuals the sole right to provide information about them
> > > seems to swing the pendulum too far one way.
> >
> > It's their information; they have the right to control it.
> >
> > > ....  However, your suggested solution provides a
> > > wonderful shelter for every spammer, DDoS violator and domain-slammer to
> > > hide behind.
> >
> > Nonesense.  If there are reasonable grounds to believe that someone has
> > violated a civil or criminal law, there are well established legal
> > procedures (many of which involve going before a neutral magistrate and
> > making a showing of those reasonable grounds) to obtain access to things
> > like domain name registration databases.
> >
> > Absent such a showing, there is no reason to violate privacy.  That is,
> > unless one accepts as a working premise that those who are accused are
> > considered guilty until they prove otherwise.
> >
> > > The Whois Task Force is working on providing meaningful recommendations
> > > that, among other things, addresses the issue of Bulk Whois.
> >
> > Until they establish that there is a reason for public publication of DNS
> > registration information in the first place, such recommendations are
> > fundamentally useless.
> >
> > > The IETF Provreg group is debating adding a <privacy> element as a
> > > standard part of the de-facto standard domain protocol (EPP).
> >
> > If you follow what is going on there, they are debating whether even to
> > include some very weak, and potentially useless, mechanisms, and only
> > because the IESG is holding the working group's feet to the fire.
> >
> > > Let's be careful not to throw the baby out with the bath water.
> >
> > And let's be careful not to turn whois into Megan's law in reverse: in
> > which internet users are forced to publish their (and their children's)
> > names, addresses, and phone numbers for the benefit of any and all
> > predators.
> >
> > --karl--
> >
> >
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,

- --
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 129k members/stakeholders strong!)
================================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 214-244-3801

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 10:25:00 +0100
From: Thomas Roessler <[email-masked]>
Subject: Re: [ga] Ester Dyson - the great fall from heaven

On 2003-02-07 02:07:08 -0500, Joe Baptista wrote:

>    Dyson cleans out her closet
>    By Bill Thompson
>    Posted: 06/02/2003 at 21:24 GMT

Where's that article from?

...

>    The unexpected confessional may have been prompted by her
>    current need to re-establish credibility with the net
>    community as she works to develop proposals for getting
>    ordinary users involved in the formulation of ICANN policy
>    through the At Large advisory committee which she chairs.

Just a brief correction: The ALAC has not yet determined who will
chair it.

- -- 
Thomas Roessler                        http://log.does-not-exist.net/
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 04:49:10 -0500 (EST)
From: Joe Baptista <[email-masked]>
Subject: Re: [ga] Ester Dyson - the great fall from heaven

On Fri, 7 Feb 2003, Thomas Roessler wrote:

> On 2003-02-07 02:07:08 -0500, Joe Baptista wrote:
>
> >    Dyson cleans out her closet
> >    By Bill Thompson
> >    Posted: 06/02/2003 at 21:24 GMT
>
> Where's that article from?

http://www.theregister.co.uk/content/6/29225.html

> >    The unexpected confessional may have been prompted by her
> >    current need to re-establish credibility with the net
> >    community as she works to develop proposals for getting
> >    ordinary users involved in the formulation of ICANN policy
> >    through the At Large advisory committee which she chairs.
>
> Just a brief correction: The ALAC has not yet determined who will
> chair it.

does it matter any more.  there's no more confidence left.  this year will
see tha rats abadoning ship in droves.

a pity - as i said many moons ago icann had a unique opportunity - and it
failed.

regards
joe baptista

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 01:56:44 -0800 (PST)
From: Karl Auerbach <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

On Fri, 7 Feb 2003, Ram Mohan wrote:

> > Why are people who feel they need to protect their privacy "egregious
> > violators".  Suppose you had young children, would you feel comfortable
> > publishing your (and thus their) addresses and phone numbers onto an open
> > directory?
> 
> + You misread what I said.  I said that providing *only* individuals the
> right to provide access to data works as long as the premise is that the
> individual supplies accurate/valid data.  However, some of the most
> egregious violators (such as domain slammers) wantonly provide false
> information - and those trying to get "their" domain name restored to them
> have a problem.

How does one know that a domain name holder is a "slammer"?  Certainly
there has to be a greater showing than a simple assertion.  In other
words, the mechanisms that I propose - that a showing that there are
reasonable grounds to believe that the accused domain name holder is
impinging on the rights of the data accessor - ought to apply as a
precondition to any and all access to registration data.

> > If there are reasonable grounds to believe that someone has
> > violated a civil or criminal law, there are well established legal
> > procedures (many of which involve going before a neutral magistrate and
> > making a showing of those reasonable grounds) to obtain access to things
> > like domain name registration databases.
> 
> + Indeed.  As long as you can find someone/someplace to serve.

The legal system has been able to deal (albeit sometimes slowly) with
anonymous and hidden identies.  Essentially the one who claims that
his/her rights are being infringed initiates a legal proceeding that isn't
quite that awful "in rem" stuff but rather something that is designed to
mature into a normal in personam procedure.  Think of it as bringing
process against "john doe" and the first step is to figure out who "john
doe" is.  In our domain name situation that process will usually involve
some sort of invocation of the domain name registrar to disclose the
registration data.

The actual procedures to do this will vary from jurisdiction to
jurisdiction.  Now I do recognize that most normal folks won't have means
to travel half way around the world to exercise some arcane process just
to try to figure out who is messing with their rights.  But we can take a
cue from the UDRP system - We've already set up UDRP system, it seems that
that gives us a pretty good suggestion about how to we could create a
private, worldwide, inexpensive, contractual based way to empower someone
to decide when DNS registrars/registries ought to open their registration
records to someone who has been harmed.

> > And let's be careful not to turn whois into Megan's law in reverse: in
> > which internet users are forced to publish their (and their children's)
> > names, addresses, and phone numbers for the benefit of any and all
> > predators.
> 
> + I don't disagree with you on this.  I certainly get my share of spam,
> unsolicited calls, etc thanks to having accurate information available via
> Whois.

We've got to get out of the "spam" mentality - the damage that can befall
a person or his family as the result of a privacy violation can be much
greater than a few dozen (or in my case, a few hundred) spams a day.  
Consider things like identity theft, or stalking, or worse.

> There needs to be a place where accurate domain contact information resides.

No disagreeement there - but that information is information about DNS
registrations and is recorded for that purpose.  There is no need for it
to be open to the public for unfettered and unmonitored access.  And
moreover, "accurate information" doesn't necessarily mean the identity of
some person who is ultimately accountable for the domain name; it could be
some intermediary which might itself have to be penetrated to work up the
chain of control.  Yes, this is hard.  Sometimes may be nearly as hard to
find who really controls a domain name as it does to figure out who inside
ICANN makes a decision that is published under the IANA label.  ;-)

> ...Does this mean we should "completely disengage from the current
> system"

I don't think so.  But I do think that it means that we need to change the 
default mode of thinking from "open access" to "access only after a 
demonstrated legitimate reason accompanied by believable identification 
of the person asking for access".

Your point that DNS is but a small part of the privacy problem is quite
well taken.  But I can't solve the other parts, but you and I can help
solve the DNS part.

		--karl--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 07 Feb 2003 05:16:29 -0500
From: Sotiris Sotiropoulos <[email-masked]>
Subject: Re: [ga] Ester Dyson - the great fall from heaven

Joe Baptista wrote:

> a pity - as i said many moons ago icann had a unique opportunity - and it
> failed.

Some may see it as a success...  Not me, of course.  But some...

Regards,

.Sotiris

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 12:07:29 +0100
From: "DNSO SECRETARIAT" <[email-masked]>
Subject: [ga] GNSO Council gTLD com. MP3 recording Feb. 6, 2003

[To: [email-masked], [email-masked]]
[To: [email-masked], [email-masked]]

Please find the MP3 recording of the GNSO Council - new gTLDs committee  -
teleconference held on:
Thursday 6 February, 2003.
http://www.dnso.org/dnso/mp3/20030206.GNSO-teleconf.mp3

Happy listening!
GNSO Secretariat

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 07 Feb 2003 12:12:23 +0100
From: "J-F C. (Jefsey)  Morfin" <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

As you know, Jeff, the Internet technical development is carried by 
lawyers. This is the big lesson of ICANN. IETF did not analyze what a 
domain name is and document it, so lawyers are trying.

The leading thinking at IETF (from the Congress collectively developed 
network technology) is "internetting". As Vint Cerf and Bob Khan reminded 
us a few week ago that US Gov's "internetting" prevailed over the French 
Louis Pouzin's and Inria (French Gov Labs) conception of "Catenet". The 
whole issue (names, ICANN, etc.) rrot there.

- - Internetting is a mutual *access* concept (one to one among many): there 
is no network middleware as such. This is a (n inter)connexion thinking.

- - Catenetting was to chain all the different network systems into a single 
continuity (you could receive datagrams on many different IP addresses on 
the same machine/system and concatenate them into a single flow). Together 
with some BBN people who shared in Internet and Inria, this rooted the OSI 
thinking  It was a communication thinking.

A typical example is what IETF names OPES (draft accepted yesterday as an 
RFC. Example: the web page the server sends to you uses gif files, but the 
OPES can replace them with jpeg). IETF thinks of them as "Pluggable Edge 
Services". OSI has not worked on them, but documented where they should be 
at the core of the network (cf. X.400). Tymnet called them Network Extended 
Services, buried in the network user's relations servicing continuity 
(Tymnet Extended Services was a relations thinking).

What all this means in term of domain names?

- - Congress' technology considers the domain name as an expandable regstrant 
side access tool (you can lose it, transfer it and renew it). This supports 
the ICANN commercial thinking, Verisign, Registrars, etc.

- - oher technologies consider the domain name as an alphanumeric pointer 
relating the user's mnemonic way to cal the registrant to the current site 
IP address. So it is a sotfware class both inheriting from the the mnemonic 
brainwaire class (free, life long, privacy protected, owned by the holder) 
and from the IP address hardware class (can be changed, may be charged, 
technolgy dependent). Your Judge will replace the IETF which has declared 
itself incompetent in brainware: will he be competent enough in hardware 
and software?

Just remember the simple three (and not two) steps action yours if you want 
to access IBM on the net.

1. brainware: your brain tries to resolve the mnemonic "IBM" into IBM.com, 
IBM.net IBM.us and then go to Goggle.
2. sofwtare: the DNS resolves "IBM.com" into an IP address.
3. hardware: the IP address resolves into a MAC on the machine .

Anyone, "lawyer or/and technician", can understand this; if not prevented 
by a life long and legal confusion between netting and internetting.

Another way to understand this is to consider the OSI model and the TCP/IP 
model: there is no "protocol stack" as such: the lower layers are the same; 
the upper layers difference only show whatis specificly network dependent.

The internetting being also used as a network system, this buries the 
netting within the end user system (and Windows 2005 will burry them very 
very deep into the "data storage part", trying to keep control as much as 
they can through the "standards" - the ICANN DNS). This is why if you want 
to stay consistent with OSI layers and to extend them to the upper layers 
(interapplication, assistancy, user/communities; structures, society) you 
have to rethink the user's system architecture.

But then you discover you do not need any root anymore, nor Windows 2005, 
and you become a "nethilist :-).

jfc

At 03:34 07/02/03, Jeff Williams wrote:

>Marc and all former DNSO GA members or other interested parties,
>
>   As you should know of may recall Marc, the Calif. Supreme court
>is to hear a case to perhaps determine if a Domain Name is actually
>owned by the registrant.  I posted that case filing on this very
>forum some time ago.  I believe the arguments are to be heard
>later this month.
>
>   There is no need for a piece of paper to show ownership of a stock
>so why is or should there need or seem to need to be a piece of paper
>to show ownership or registration of a Domain Name?  None!
>
>   The problem here is showing who registered or is the registrant of
>record is a non-problem itself.  Rather the personal data such as
>their home address, and phone # are not needed and are a potential
>violation of their personal privacy as well as security.
>
>Marc Schneiders wrote:
>
> > An aspect of whois that, I think, is often neglected, is the sense of
> > security of 'ownership' that it gives the registrant. The domain name
> > industry is a fully online business. As a registrant you don't get a piece
> > of paper to prove that you have some rights in a domain. Registrants will
> > start asking about that, if there is no public whois to prove who holds
> > the domain. Of course this problem (if it is one) can be solved by
> > attaching this feeling of ownership to the password to log in to change
> > nameservers, and perhaps an optional whois, for those who want their
> > details in there.
> >
> > And if it is optional all the accuracy problems we are dealing with
> > disappear :-)
> >
> > --
> > This message was passed to you via the [email-masked] list.
> > Send mail to [email-masked] to unsubscribe
> > ("unsubscribe ga" in the body of the message).
> > Archives at http://www.dnso.org/archives.html
>
>Regards,
>
>--
>Jeffrey A. Williams
>Spokesman for INEGroup LLA. - (Over 129k members/stakeholders strong!)
>================================================================
>CEO/DIR. Internet Network Eng. SR. Eng. Network data security
>Information Network Eng. Group. INEG. INC.
>E-Mail [email-masked]
>Contact Number: 214-244-4827 or 214-244-3801
>
>
>
>
>---
>Incoming mail is certified Virus Free.
>Checked by AVG anti-virus system (http://www.grisoft.com).
>Version: 6.0.449 / Virus Database: 251 - Release Date: 27/01/03

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 07 Feb 2003 12:21:56 +0100
From: "J-F C. (Jefsey)  Morfin" <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

Would I be wrong in your opinon with the following scheme?

1. the registrant is given a real smart title of his domain name (CD)
2. that CD includes the necessary program and key to maintain his DNS data.
3. he freely updates his DNS data but they are accepted though an e-mail 
check whey one verifies the e-mail entered into the SOA.
4. the WHOIS is made an LDAP meta system containing the DN, the mail and 
the IP. The user is free to add/maintain more info (he checks them on his 
DN Management program)
5. regular checks are carried by ISPs about the e-mail (if the mail does 
not respond, they certainly have ways of contacting their customer).

jfc

On 07:01 07/02/03, Karl Auerbach said:

>On Thu, 6 Feb 2003, Ram Mohan wrote:
>
> > Interesting thoughts and an interesting premise.  The problem is, that the
> > groups you mention here (marketers, IP folks, etc) are not the only people
> > who utilize Whois information.
> >
> > System operators (including technicians, systems administrators responding
> > to abuse, etc) often depend solely on information found in Whois to
> > determine next courses of action for serious network and other related
> > issues.
>
>I disagree - Folks in NOCs *do* use something called "whois", but it most
>often it is a distinct set of databases pertaining to IP address
>allocations.
>
>Why do NOC folks use the IP "whois"?  Simply because the key that one has
>for the lookup is less easily forged.  Domain names on purported spam
>e-mail are only ocassionally accurate.  But the IP address on a TCP
>connection has intrinsic value because a TCP connection can not be formed
>unless both the source and destination address are actually reachable.
>
>Assuming for the moment that ISP's and such obtained value out of DNS
>whois information - That still doesn't justify them mucking around unless
>certain conditions are met:
>
>   1. That a person who acquires a domain name is informed from the outset
>that such access will be performed by ISP people.  (I.e. actual or implied
>consent by the data subject.)
>
>   2. The person who is doing the looking is actually a real ISP person
>following up on a specific legitimate problem.
>
>It would not be all that hard for anyone claiming to be an "ISP" to jump
>through some qualification hoops in order to gain a whois access
>credential.  For instance, once a year.
>
>The burden of proving that access to personally identifiable information
>is a valid access ought to fall on the person requesting access, not on
>the data subject.
>
> > Your premise is also that all individuals provide accurate information.  We
> > know (you definitely do, as a registrar) that some of the most egregious
> > violators make sure that they provide _false_ information.
>
>Why are people who feel they need to protect their privacy "egregious
>violators".  Suppose you had young children, would you feel comfortable
>publishing your (and thus their) addresses and phone numbers onto an open
>directory?
>
> > Giving individuals the sole right to provide information about them
> > seems to swing the pendulum too far one way.
>
>It's their information; they have the right to control it.
>
> > ....  However, your suggested solution provides a
> > wonderful shelter for every spammer, DDoS violator and domain-slammer to
> > hide behind.
>
>Nonesense.  If there are reasonable grounds to believe that someone has
>violated a civil or criminal law, there are well established legal
>procedures (many of which involve going before a neutral magistrate and
>making a showing of those reasonable grounds) to obtain access to things
>like domain name registration databases.
>
>Absent such a showing, there is no reason to violate privacy.  That is,
>unless one accepts as a working premise that those who are accused are
>considered guilty until they prove otherwise.
>
> > The Whois Task Force is working on providing meaningful recommendations
> > that, among other things, addresses the issue of Bulk Whois.
>
>Until they establish that there is a reason for public publication of DNS
>registration information in the first place, such recommendations are
>fundamentally useless.
>
> > The IETF Provreg group is debating adding a <privacy> element as a
> > standard part of the de-facto standard domain protocol (EPP).
>
>If you follow what is going on there, they are debating whether even to
>include some very weak, and potentially useless, mechanisms, and only
>because the IESG is holding the working group's feet to the fire.
>
> > Let's be careful not to throw the baby out with the bath water.
>
>And let's be careful not to turn whois into Megan's law in reverse: in
>which internet users are forced to publish their (and their children's)
>names, addresses, and phone numbers for the benefit of any and all
>predators.
>
>                 --karl--
>
>
>--
>This message was passed to you via the [email-masked] list.
>Send mail to [email-masked] to unsubscribe
>("unsubscribe ga" in the body of the message).
>Archives at http://www.dnso.org/archives.html
>
>
>
>---
>Incoming mail is certified Virus Free.
>Checked by AVG anti-virus system (http://www.grisoft.com).
>Version: 6.0.449 / Virus Database: 251 - Release Date: 27/01/03

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 07 Feb 2003 07:00:18 -0500
From: Esther Dyson <[email-masked]>
Subject: Re: [ga] Ester Dyson - the great fall from heaven

Not only that; it is already determined that I will *not* chair it.... but 
who will is still not clear.

Esther

At 04:25 AM 2/7/2003, Thomas Roessler wrote:
>On 2003-02-07 02:07:08 -0500, Joe Baptista wrote:
>
> >    Dyson cleans out her closet
> >    By Bill Thompson
> >    Posted: 06/02/2003 at 21:24 GMT
>
>Where's that article from?
>
>...
>
> >    The unexpected confessional may have been prompted by her
> >    current need to re-establish credibility with the net
> >    community as she works to develop proposals for getting
> >    ordinary users involved in the formulation of ICANN policy
> >    through the At Large advisory committee which she chairs.
>
>Just a brief correction: The ALAC has not yet determined who will
>chair it.
>
>--
>Thomas Roessler                        http://log.does-not-exist.net/
>--
>This message was passed to you via the [email-masked] list.
>Send mail to [email-masked] to unsubscribe
>("unsubscribe ga" in the body of the message).
>Archives at http://www.dnso.org/archives.html

Esther Dyson                    Always make new mistakes!
chairman, EDventure Holdings
writer, Release 3.0 (on Website below)
[email-masked]
1 (212) 924-8800    --   fax  1 (212) 924-0240
104 Fifth Avenue (between 15th and 16th Streets; 20th floor)
New York, NY 10011 USA
http://www.edventure.com

The conversation continues..... at
http://www.edventure.com/conversation/

PC Forum 2003 - March 23 to 25, Phoenix
Who? what? where? Data comes alive!

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 07 Feb 2003 14:56:06 +0200
From: "Charles Shaban" <[email-masked]>
Subject: Re(2): [ga] Ester Dyson - the great fall from heaven

Now this is what I call bad news, may I ask why? I think you are one
of the people who should be the number one candidate for this.

Regards

Charles Sha'ban
=============
[email-masked] writes:
>Not only that; it is already determined that I will *not* chair
>it.... but 
>who will is still not clear.
>
>Esther

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 08:21:45 -0500
From: "Cade,Marilyn S - LGCRP" <[email-masked]>
Subject: RE: [ga] whois.txt, ala robots.txt, as a standard ?

Putting up a web site is not the same thing as contacting an ISP and subscribing and getting an email account. Some may wish the assumptions regarding those actions and what the expectation of privacy is are the same, but I don't see how they are.

The difference between those acts is pretty profound. In one case, one subscribes to a domain name for the purpose of         holding one's self out to communicate with the public. ISPs provide a reasonable expectation of privacy to the subscriber, and their service agreements specify what that is. The agreements which registrars should provide information about the publication of data in the WHOIS. 

When you put up a web site, you are inviting the public at large to visit your site and to use the content on it; perhaps with subscription, perhaps for free. 

Yes, I understand that some people think that domain names are substituable for email addresses. That's an interesting, and unproven model for the "average" user. Not the techie oriented crowd who hangs around ICANN, but those everyday users of the Internet and other communications services who are focused on their daily lives, and their businesses, not on technology and its fascinations. :-) THAT was not meant as in any way critical, just a note that well, there are are millions of email users out there and they are quite happily served by ISPs. AND the ISPs are quite happy serving them. 

As to policy questions, versus personal opinions, the question of whether all data that is presently in the WHOIS should be there is a topic yet to be discussed as policy; the question of whether there is a need for differentiated access to data elements is yet to be discussed as policy.   The WHOIS TF will be recommending further policy examination. The final report on some of its work is published for final comment. When we say "final report", we mean final report about this particular set  of work. The Council will determine further work, but I expect that there will be support for next steps.

Secondly, Karl, you are both right and wrong regarding WHAT WHOIS. I've had conversations with both system administrators adn enforcement teams from various companies -- they tell me that in fact both kinds of WHOIS are used and that both are higly inaccurate, filled with "aged" data, and with purposeful errors, ... that is, unless there is overcrowding at various residential locations at the North Pole and non-resident citizens of the US are invited to bunk in, in apparently the numbers of dozens to hundreds at the U.S. White House. Oh, yes, one more, and unless "XXX" has now become a working area code in the US.  Accuracy remains a problem in both "kinds" of WHOIS -- IP and DNS. :-)

Marilyn Cade

- -----Original Message-----
From: Ross Wm. Rader [mailto:[email-masked]]
Sent: Friday, February 07, 2003 1:25 AM
To: Karl Auerbach; Ram Mohan
Cc: 'George Kirikos'; [email-masked]
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

Its the right track Karl, but the right answer is:

> Assuming for the moment that ISP's and such obtained value out of DNS
> whois information - That still doesn't justify them mucking around unless
> certain conditions are met:

1. The registrant has given the accessor (ISP in your example) specific
permission to access and use their data.

                     -rwr

Got Blog? http://www.byte.org

"People demand freedom of speech as a compensation for the freedom of
thought which they seldom use."
 - Soren Kierkegaard

- ----- Original Message -----
From: "Karl Auerbach" <[email-masked]>
To: "Ram Mohan" <[email-masked]>
Cc: <[email-masked]>; "'George Kirikos'" <[email-masked]>;
<[email-masked]>
Sent: Friday, February 07, 2003 1:01 AM
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

>
> On Thu, 6 Feb 2003, Ram Mohan wrote:
>
> > Interesting thoughts and an interesting premise.  The problem is, that
the
> > groups you mention here (marketers, IP folks, etc) are not the only
people
> > who utilize Whois information.
> >
> > System operators (including technicians, systems administrators
responding
> > to abuse, etc) often depend solely on information found in Whois to
> > determine next courses of action for serious network and other related
> > issues.
>
> I disagree - Folks in NOCs *do* use something called "whois", but it most
> often it is a distinct set of databases pertaining to IP address
> allocations.
>
> Why do NOC folks use the IP "whois"?  Simply because the key that one has
> for the lookup is less easily forged.  Domain names on purported spam
> e-mail are only ocassionally accurate.  But the IP address on a TCP
> connection has intrinsic value because a TCP connection can not be formed
> unless both the source and destination address are actually reachable.
>
> Assuming for the moment that ISP's and such obtained value out of DNS
> whois information - That still doesn't justify them mucking around unless
> certain conditions are met:
>
>   1. That a person who acquires a domain name is informed from the outset
> that such access will be performed by ISP people.  (I.e. actual or implied
> consent by the data subject.)
>
>   2. The person who is doing the looking is actually a real ISP person
> following up on a specific legitimate problem.
>
> It would not be all that hard for anyone claiming to be an "ISP" to jump
> through some qualification hoops in order to gain a whois access
> credential.  For instance, once a year.
>
> The burden of proving that access to personally identifiable information
> is a valid access ought to fall on the person requesting access, not on
> the data subject.
>
> > Your premise is also that all individuals provide accurate information.
We
> > know (you definitely do, as a registrar) that some of the most egregious
> > violators make sure that they provide _false_ information.
>
> Why are people who feel they need to protect their privacy "egregious
> violators".  Suppose you had young children, would you feel comfortable
> publishing your (and thus their) addresses and phone numbers onto an open
> directory?
>
> > Giving individuals the sole right to provide information about them
> > seems to swing the pendulum too far one way.
>
> It's their information; they have the right to control it.
>
> > ....  However, your suggested solution provides a
> > wonderful shelter for every spammer, DDoS violator and domain-slammer to
> > hide behind.
>
> Nonesense.  If there are reasonable grounds to believe that someone has
> violated a civil or criminal law, there are well established legal
> procedures (many of which involve going before a neutral magistrate and
> making a showing of those reasonable grounds) to obtain access to things
> like domain name registration databases.
>
> Absent such a showing, there is no reason to violate privacy.  That is,
> unless one accepts as a working premise that those who are accused are
> considered guilty until they prove otherwise.
>
> > The Whois Task Force is working on providing meaningful recommendations
> > that, among other things, addresses the issue of Bulk Whois.
>
> Until they establish that there is a reason for public publication of DNS
> registration information in the first place, such recommendations are
> fundamentally useless.
>
> > The IETF Provreg group is debating adding a <privacy> element as a
> > standard part of the de-facto standard domain protocol (EPP).
>
> If you follow what is going on there, they are debating whether even to
> include some very weak, and potentially useless, mechanisms, and only
> because the IESG is holding the working group's feet to the fire.
>
> > Let's be careful not to throw the baby out with the bath water.
>
> And let's be careful not to turn whois into Megan's law in reverse: in
> which internet users are forced to publish their (and their children's)
> names, addresses, and phone numbers for the benefit of any and all
> predators.
>
> --karl--
>
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
>
>

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #1580
*************************