Subject: New attempt to kill "whois"

From: Frank Ellermann <[email-masked]>
Date: Tue, 23 Aug 2005 00:50:24 +0200

Okay, ball in play again, after killing RfC 954 forcing
"us" to use 1032 they now intend to kill RfC 1032, see
http://ietf.org/internet-drafts/draft-sanz-rfc1032-historic-00

Andy Newton is the author of several IETF CRISP drafts,
that is the cross-registry-information-service-protocol
replacing "whois" for the purposes of registries, e.g.
http://ietf.org/internet-drafts/draft-ietf-crisp-iris-lwz-04

Marcos Sanz (with Gerhard Winkler) was the author of
http://purl.net/xyzzy/home/test/draft-sanz-whois-srv-01.txt
He's also working for DENIC, and probably he does not like
the de.whois.rfc-ignorant.org entry.

In theory I could dispute this entry after DENIC added the
"?" function to whois.denic.de, but that's beside the point,
and IIRC I did this some months ago on the RFCI list.

I'm interested in public available whois servers to find
relevant addreses for abuse reports in my "rxwhois" client
<http://purl.net/xyzzy/src/rxwhois.cmd> - therefore I try
to stay up to date with efforts like the expired draft-sanz,
or whois-servers.net, or the persistent attempts to destroy
simple Internet infrastructure like "whois" in favour of
complex solutions.

If "we" (TINW) lose 1032 after 954 the last resort is the
shaky ground of 1591, claiming that it's the base for some
ICANN rules.  Even if that "works" it would kill the RFCI
whois zone for most ccTLDs, we'd end up with the TLDs also
covered by ICANN's WDPRS plus a few special cases like gov,
mil, us, e164.arpa, etc.

Good news, apparently RfC 1032 is referenced in 1034, 1035,
1031, 2052, 2053, 2065, 3074, 1123, 1480, 1464, 1401, 1386,
1348, and 1183.  Most of these RfCs referencing 1032 might
be obsolete / informational / experimental /  irrelevant,
but at least 1034, 1035, and 1123 are important.  So this
attempt to get rid of 1032 might run into difficulties.

Difficulty number one:  I set a Cc: to the IETF list, bye

http://lists.megacity.org/pipermail/rfci-discuss/2004-October/002989.html

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 23 Aug 2005 17:38:47 +0200

On Tue, Aug 23, 2005 at 12:50:24AM +0200,
 Frank Ellermann <[email-masked]> wrote 
 a message of 44 lines which said:

> Okay, ball in play again, after killing RfC 954 forcing "us" to use
> 1032 they now intend to kill RfC 1032,

Killing RFC 954 was the right thing to do because RFC 954 made a
cardinal mistake: it specified a protocol (useful, widely in use, now
specified in RFC 3912), *and* a policy. THIS IS NOT IETF
BUSINESS. IETF should not specify policy, wether for TLDs or for
anyone else, only policies for its own internal processes.

> therefore I try to stay up to date with efforts like the expired
> draft-sanz, or whois-servers.net, or the persistent attempts to
> destroy simple Internet infrastructure like "whois" in favour of
> complex solutions.

Nobody suggested to kill the whois protocol, just the badly written
and obsolete RFCs which were requiring violations of various european
laws regarding privacy. Neither ICANN or IETF should specify privacy
policy for a ccTLD.

(And I prefer the whois protocol to IRIS but this is a technical issue
while killing RFC 954 was a political one, and a right one.)

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 23 Aug 2005 17:35:23 -0400

> laws regarding privacy. Neither ICANN or IETF should specify privacy

I believe Frank's concern is that he wants the ability to refuse
services to sites who have not published accurate contact information
through whois.  If a ccTLD were to, for instance,  refuse to publish any
contact information (even if the registrant *wanted* it published) this
makes his life difficult.

I'd hope that European privacy laws would be flexible enough to allow
for voluntary publication of contact information by TLD operators.

					- Bill

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Wed, 24 Aug 2005 01:11:02 +0200

>for voluntary publication of contact information by TLD operators.

Dear Bill,
voluntary publication of information has an extremely flexible and 
powerfull tool at its disposition. It is named the web.

As a ccTLD Registry we do _not_ publish any information. For three reasons:
- this is the best way to be sure we respect privacy laws everywhere.
- we do not have the budget.
- we do not see the need.

Should a registrant want to publish his data, we are not opposed if 
he pays the cost. Such a whois service's cost would not be to deliver 
one registrant's data, but to receive requests for all the non 
documented registrants and the DoS.
jfc

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 24 Aug 2005 10:27:42 +0200

On Tue, Aug 23, 2005 at 05:35:23PM -0400,
 Bill Sommerfeld <[email-masked]> wrote 
 a message of 29 lines which said:

> services to sites who have not published accurate contact
> information through whois.

Very bad idea, IMHO. But it's true that, if you refuse email from
".com" domains, you have much less spam :-)

> If a ccTLD were to, for instance, refuse to publish any contact
> information (even if the registrant *wanted* it published) this

The vast majority of the ccTLD in the world have no whois server
(check the "whois server" field in the IANA whois) and often not
publication of contact information at all. But this is irrelevant: how
many times did you see Nigerian scams coming from the ".ng" domain?

> I'd hope that European privacy laws would be flexible enough to
> allow for voluntary publication of contact information by TLD
> operators.

Certainly.

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 24 Aug 2005 07:49:47 -0700

(somewhat offtrack...)
--On 24. august 2005 10:27 +0200 Stephane Bortzmeyer <[email-masked]> 

> many times did you see Nigerian scams coming from the ".ng" domain?

well, actually <http://www.iana.org/cctld/cctld-whois.htm> gives a list of 
TLDs with, among other things, the location of their whois servers.

.ng has no whois server listed; the others I sampled had.

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 24 Aug 2005 20:47:55 +0200

JFC (Jefsey) Morfin wrote:

> voluntary publication of information has an extremely
> flexible and powerfull tool at its disposition. It is
> named the web.

Sure, and reporting trouble also has some powerful tools,
send a mail to postmaster@ or abuse@ or similar addresses.

The whois info is for cases where this does not work as
expected, server down or hopelessly misconfigured, and
other cases where straight-forward approaches fail.

Personally I'm not interested in any other whois data -
okay, sometimes the nameserver, and while I don't need
it I understand that others might try phone calls if a
phone number is offered (so the published data should
be correct).

> As a ccTLD Registry we do _not_ publish any information.

Out of curiosity, which country code are you talking
about ?  BTW, setting up a whois server is simpler than
a Web server.
                         Bye, Frank

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 24 Aug 2005 21:17:28 +0200

Stephane Bortzmeyer wrote:

>> I believe Frank's concern is that he wants the ability to
>> refuse services to sites who have not published accurate
>> contact information through whois.

> Very bad idea, IMHO. But it's true that, if you refuse email
> from ".com" domains, you have much less spam :-)

You confused this with .biz ;-)  No, personally I don't need
this ability, maybe I would consider it as (least important)
factor in a scoring system.

No, I want a working address if abuse@ / abuse.net failed,
and a hint which steps I can skip for known "rfc-ignorants".
The whois data is the last resort.

For ICANN's gTLDs the WDPRS offers an adsitional step.

> The vast majority of the ccTLD in the world have no whois

Not exactly.  107 have a working whois server as far as I
can judge it (excl. two with no contact data).  Add some
special cases (e.g. for UK and ZA it depends on the SLD).

> (check the "whois server" field in the IANA whois)

That's often obsolete / incomplete, see also:

http://lists.megacity.org/pipermail/rfci-discuss/2005-July/003568.html

BTW, privacy laws in the EU and elsewhere are one thing,
but there are also laws protecting customers, at least
"commercial" Web sites must offer contact data.  For a
very broad definition of "commercial", e.g. I don't have
a domain (=> no whois data) but "must" publish contact
data on an essentially private site.

No 2119 MUST, it's a legal "must", two lawyers have three
opinions, three lawyers have six opinions, etc. ;-)  But
DE is definitely a part of the EU.

                        Bye, Frank