Subject: [Ietf-not43] Mail address mandatory?

From: [email-masked] (Stephane Bortzmeyer)
Date: Tue, 13 Aug 2002 08:38:45 +0200

I read in draft-ietf-crisp-lw-user-00.txt:

     The target inetOrgPerson entries MAY have any number of attributes 
     defined, with any number of access restrictions, as required by 
     local security policies, government regulations or personal 
     privacy concerns. However, the mail attribute MUST be defined, 
     MUST be valid, and MUST have anonymous read permissions. 

Why is it so (MUST have anonymous read permissions)? The email address
is often precisely the attribute some people want to hide (because of
spammers).

Anyway, it should be a matter of policy, I don't think it is
appropriate to put it in the protocol.

---

From: [email-masked] (Eric A. Hall)
Date: Tue, 13 Aug 2002 08:44:04 -0500

> is often precisely the attribute some people want to hide (because of

The email address doesn't have to a primary account.

The reason I made it mandatory is that there is no other form of contact
information which is viable. Postal mail doesn't help when you are
suffering aa DoS attack from a specific network, for example.

There is another reason for using email addresses, which is that I plan to
define a lookup mechanism for contacts using the email addr as the lookup
key (EG, provide a way to find out which domains and netblocks are
associated with <[email-masked]>). DITs aren't all that functional or
friendly outside the protocol.

> appropriate to put it in the protocol.

Andy has made that argument in the past, too. In the end, it seems to me
that if there isn't any contact information available, there isn't any
benefit to the service.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: [email-masked] (Stephane Bortzmeyer)
Date: Fri, 16 Aug 2002 09:39:36 +0200

On Tue, Aug 13, 2002 at 08:44:04AM -0500,
 Eric A. Hall <[email-masked]> wrote 

> The email address doesn't have to a primary account.

[Sorry, I do not understand that one.]

> suffering aa DoS attack from a specific network, for example.

But phone contact helps in that case and I could say that "email does
not help when there is completely broken network configuration which
prevents email". No contact channel is 100 % reliable in every case,
that's why we must have several.
 
> associated with <[email-masked]>).

IPR people would love to have it but ordinary people (not big
corporations lawyers) may disagree. I see that as a registry policy
issue, which should not be forced by a technical protocol.

> Andy has made that argument in the past, too. 

People who agree with me must be really smart :-)

> In the end, it seems to me that if there isn't any contact
> information available, there isn't any benefit to the service.

For .eu, one of the ideas was to allow people to opt-out of all but
one contact information (they have to accept that at least one among
phone, fax or email, is public).

---

From: [email-masked] (Eric A. Hall)
Date: Fri, 16 Aug 2002 09:04:00 -0500

on 8/16/2002 2:39 AM Stephane Bortzmeyer wrote:
> On Tue, Aug 13, 2002 at 08:44:04AM -0500, Eric A. Hall
> <[email-masked]> wrote

> [Sorry, I do not understand that one.]

You are not required to use <[email-masked]>, but can instead use
<[email-masked]> if you don't want to expose your real address.

>> The reason I made it mandatory is that there is no other form of
>> contact information which is viable. Postal mail doesn't help when
>> you are suffering aa DoS attack from a specific network, for example.
>>
>

This sounds like a good reason to mandate TWO contact forms. There's no
way I'd get away with that so I picked one that had to be provided. People
can provide as much or as little as they want but they have to provide
this one at a minimum.

> For .eu, one of the ideas was to allow people to opt-out of all but one
> contact information (they have to accept that at least one among phone,
> fax or email, is public).

Can you please provide a pointer to the definitive policy statement? This
issue is not resolved in my mind either, and I'd like to see other texts
which may help.

>> There is another reason for using email addresses, which is that I
>> plan to define a lookup mechanism for contacts using the email addr
>> as the lookup key (EG, provide a way to find out which domains and
>> netblocks are associated with <[email-masked]>).
>

The profile will have to be voluntary. Since a favored email address will
reside in a single DIT -- but the associated resources will each reside in
their own independent DITs -- linking the different DITs will have to be
voluntary. EG, if I update my ntrg.com entry to point to [email-masked],
there is no way that the owner of the ntrg.com entry will be able to
update the [email-masked] entry. As such, I will have to make that update
myself, meaning that it would be voluntary.