Subject: [Asrg] Assume perfect knowledge by domain registry provisioners, so what?

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Thu, 08 May 2003 19:36:07 -0400

The discussion of RMX prompts me to ask a question.

Why should domain name registry operators and their registrars "care" about
this problem, and assuming they did "care", what could they know that would
be in their interests to know?

I ask this as a contributor to a domain name registry provisioning protocol,
a prior registry operator (gTLD and ccTLD) and registrar (current, voting),
as well as a minor ISP operator.

For reasons others have said sufficiently, and because I have thought about
an equivlant mechanism for a problem I once thought similar, I don't think
RMX is useful in this problem domain.

That said, I want to know if, assuming perfect knowledge in the universe of
dns provisioners (not publishers, that is seperate question), any actor(s)
in that universe could do anything that would have a first-order effect on
the present spam problem.

RMX advocates should have a story I can relate to the ICANN Registrars
Constituency meeting in Montreal next month.

Eric

Ob.Tech.: I've proposed making EPP peer-to-peer (beep transport mapping),
with a registrar-initiated session-establishment restriction removed, and
registry-initiated state-push, solving the escrow and trans-registry sets
of problems, and I'm mildly curious if there is a serious use case for any
parts of this arise from an ability to be causal in technical solutions to
spam.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: David Walker <[email-masked]>
Date: Thu, 8 May 2003 20:57:05 -0500

Well I hate to use this as an argument in favor of RMX but it is true (at 
least theoretically).

Assuming a wide implementation of RMX by DNS admins ticked that their domains 
were used as return addresses on spams, the spammers would have to register 
their own junk domains.  If mail admins started rejecting mail from these 
junk domains the spammers would have to register more junk domains.  More 
domains registered = more profit for a domain name registry operator.

On Thursday 08 May 2003 06:36 pm, Eric Brunner-Williams in Portland Maine 
wrote:
> I ask this as a contributor to a domain name registry provisioning
> protocol, a prior registry operator (gTLD and ccTLD) and registrar
> (current, voting), as well as a minor ISP operator.
>

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Thu, 08 May 2003 22:08:47 -0400

> More domains registered = more profit for a domain name registry operator.

Not compelling.

Putting on the registrar-hat, one of our big problem areas is credit card
charge-back. These result in real cost to us. Riding the crest of a wave
of technique-driven churn in the namespace (hypothetical RMX buyer model)
isn't attractive if it has the property of being even a few percentage
points more costly (charge-back) than the current buyer models. In round
numbers, its 9 to registrars, 6 of which goes to directly to the registry,
which doesn't refund charge-backs after some window sufficiently short to
bite some registrars frequently. So its $3 per high-risk-of-non-payment
transaction, with possible side-effects, before expenses and taxes. No sale.

If anything, we have a motive, and an existing mechanism, albeit with a
30 day temporal granularity, to prevent registrar roll-over by fraudulent
registrants.

Putting on the asrg-hat, that isn't the class of response I am looking for.

Please also don't assert truth for complex systems, it is a distraction.

Eric

---

From: David Walker <[email-masked]>
Date: Thu, 8 May 2003 23:54:17 -0500

On Thursday 08 May 2003 09:08 pm, Eric Brunner-Williams in Portland Maine 
> > More domains registered = more profit for a domain name registry
Of course not.  I would certainly hope not.  
> Please also don't assert truth for complex systems, it is a distraction.
I'll attempt to use more pleasing semantics in the future.

I can't imagine a scenario where a registry provider would be concerned about 
spam as a part of providing registry services.  A registry doesn't gain or 
lose because a registered domain is used for spam and they don't have any 
dutues in overseeing how a domain is used.

---

From: Mike Rubel <[email-masked]>
Date: Fri, 9 May 2003 02:19:05 -0700 (PDT)

> as well as a minor ISP operator.

Eric,

Are the following arguments useful to you?:

As the owner of several domains, my original reason for "inventing" RMX (I 
was unaware of Hadmut's proposal when I first wrote the article) was 
frustration at being unable to prevent spammers from using my domain name 
in their return address.

RMX is a proposal which will allow domain owners--your customers--to take 
back control over email sent out with their names attached to it.

Also, because there is a great deal of overlap between registry operators
and nameserver operators, some members of your group may be interested in 
providing RMX listings for their customers.

Any proposal which provides information that can help separate spam from
ham increases the value of email, and therefore the Internet and domain
names.  This is in the best interest of registry operators and their
registrars.

I can think of a few other arguments too, but it's 2:20AM, so I'm a bit
incoherent.  :)  Please email me off-list if you need more material.

Regards,
Mike

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 07:29:48 -0400

>           ... there is a great deal of overlap between registry operators
> and nameserver operators ...

I don't want to consider which system, provisioning or publication, should
be "driving" the other.

> Any proposal ...
> ... increases the value of email, and therefore the Internet and domain

I'd like to stick to those that have directly visible causation in this
problem domain.

Eric

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 08:40:05 -0400

> I'll attempt to use more pleasing semantics in the future.

I enjoy Baldric in Black Adder, for whom every plan is "cunning", but that
is comedy. 

> dutues in overseeing how a domain is used.

Spammers generally don't pay for domain names.
Spammers generally don't pay for bandwidth.
Spammers generally don't pay for ...

It may well be that the cost to registry provisioning actors is insufficient
to motivate operational change, or regulatory change. It may also be that no
benefit can accrue to registry provisioning actors. That is what I'm trying
to determin.

Incidently, one registrar I know of markets their operational technique as
having registrant-desired anti-spam properties.

Claims for duty exist. See Prima Toy (pokey.com), "reserved names" in ICANN
contracts, and various national laws, actual or proposed, viz,
http://www.house.gov/rules/pence.pdf?tag=nl. There are mailing lists for
claims.

Eric

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 9 May 2003 07:05:13 -0600 (MDT)

> From: David Walker <[email-masked]>

> ...

Some registrars have asserted that they will cancel registrations of
domains for spamming.  Some have even followed through.  For example,
Domains by Proxy has been zapping spammers using its anonymizing
registration service.  The operators of .BZ have recently shocked the
world by terminating a spammer on the pretex of a bad contact address.
There are others who get less attention because they are not popular
among spammers.

Registries and registrars can gain or lose because a registered domain
is used for spam, because the reputation of the domain suffers.  Users
who really hate spam and see only spam from a new TLD are likely to
blacklist it.  I suspect that domain names in .bz and .biz are worth
a lot less to organizations who want to send legitimate mail than
names in .com because of this effect.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 10:21:04 -0400

Morning Vernon,

Could you expand on "zapping spammers" and [registrar name]'s proxy 
product? Is this a reference to the provisioning of non-unique data
(registrar agent contact data) rather than unique (registrant) data
to the registrar's whoisdb (RRP provisioning) or registry's whoisdb
(EPP provisioning), or some administrative DoS based upon contract
T&C breach by the (proxied) registrant (or its agents)?

> world by terminating a spammer on the pretex of a bad contact address.

Ha! I'll have to pass that along to Edmon. I only learned last month his
outfit operates .bz. (Originally a "cunning plan" by some Baldrik@VGRS 
for market confusion when Neu* launched .biz).

> There are others who get less attention because they are not popular

Any data? We can correlate it against Lotter's surveys, the RIPE data,
etc.

> names in .com because of this effect.

Personally, I think repurposing ccTLDs risks failure to meet the duty and
trustee lnaguage of section 3, rfc1591. For many ccTLDs that have been
repurposed, the failure is not hypothetical. I no longer work for, or with,
the .biz (and .us) registry operator. Do operational practices have some
potential or actual consequences which may affect name use? You bet. It
means spending some of that $5-and-change/name-year on brand protection.

You've pointed to the complex sequence of events (sunrise-to-steady-state)
and operational practices of ICANN and non-ICANN actors as having some real
consequences. I agree. A registry that re-launches with a thousand-dollar
price point (100/year, refundable for insert-circumstances), is unlikely to
be a haven for spam, assuming they actually collect before provisioning is
converted to publication. That's the most extream case in the cash-as-filter
conduct spectrum that I know of.

Thanks for the note. I look forward to your reply.

Eric

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 9 May 2003 09:09:38 -0600 (MDT)

> From: Eric Brunner-Williams in Portland Maine <[email-masked]>

> ..
> product? 

See http://groups.google.com/groups?q=author%3Aabuse%40domainsbyproxy.com

>                   ...  A registry that re-launches with a thousand-dollar

It's worthwhile to remember that the current majority of spam is not
the only kind.  When the senders of other kinds finally get deploy their
congresscritters and direct enough attention from law enforcement to
stop the current flood of frauds and nonsense, the other kinds will remain.
The other kinds come from organizations that feel more comfortable
paying $1000 than $10 or $100 for services such as domain registration.
They're the Fortune 50,000 that assume that software with $150/seat
license fees must be better than software with no license fees.

Making spam more expensive can ato most shift the character of the
contents of spam.  Higher costs will not end it, as demonstrated
by postal junk mail.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 11:47:48 -0400

> See http://groups.google.com/groups?q=author%3Aabuse%40domainsbyproxy.com

Thanks.

Apropos of nothing, a registrar has been causal in moving the retail price 
point for gTLD domains down to sub-10. Two times this floor price presently
appears sufficient to meet the cost of spam-specific registrar or re-seller
agent intervention.

> the only kind. ...

Thanks. I've been fixating on the low-cost transients. For the cost-capable
models (persistent), the "reputable businesses with endpoint identifiers,
aka personal indentifiers" problem, different treatment.

The P3P Specification Working Group has a "P3P beyond HTTP" task force,
which cheritably might include disclosure ((via the <access> element), via
protocols other than HTTP, SOAP, etc., e.g., including SMTP) of how the
recipient's address was acquired or may be unacquired or corrected, and so
on. It also has a "Compact policies" task force for which an xml-2-ebnf
transform is possible. An xml-2-XYZ (aka "developer-readable language")
wire encoding optimization already exists for HTTP cookies.

Eric