Subject: Re: [Asrg] Assume perfect knowledge by domain registry provisioners, so what?

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 09 May 2003 02:19:17 -0500

> From: David Walker <[email-masked]>
> 
> I can't imagine a scenario where a registry provider would be 
> concerned about
> spam as a part of providing registry services.  A registry doesn't gain or
> lose because a registered domain is used for spam and they don't have any
> dutues in overseeing how a domain is used.
> 
Spammers do not use their real info  when registering domains. However 
ICANN as part of their policy and as stated in their written contracts 
with the registrars and registries requires all domains to have valid 
contact information in the WHOIS database. Unfortunatly this rule has 
not been widely enforced and the pnly registrar that I am aware of being 
fined or warned is Verisign. But theoritically speaking if this rule is 
enforced then the registrars will care if the domain has valid info. 
Thus they will come to care about domains being used for spam since they 
can be fined by ICANN.

That in turn will lead to spammers using contact info of others, postal 
mailbox services, domains registered via proxy (like the service provide 
by godaddy.com), etc. Also they will now have a greater incentive to 
hack into DNS, registrars and hijack domains via false transfers (like 
the sex.com case). However that will lead them more into the physical 
world where they can be easier to trace. Plus using other people's info 
might be a bigger crime than spam itself and will attract attention of 
LEA.

I would suggest in general that the working group should recommend to 
ICANN a stricter enforcement of the WHOIS rules (securing the DNS to 
guard against attacks that will increase might help too).
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 07:09:27 -0400

>                            ... theoritically speaking if this rule is 

An appeal to a operational business interest is what I'm looking for,
though I'm willing to entertain candidate claims of marketing problem
or marketing opportunity, not an appeal to regulatory enforcement.

If the data that is provided a gTLD registrar, or to ccTLD registrar who
operates on a cost-recovery plus margin business model, by a registrant,
is sufficient for successful billing, the data is "registrar-sufficient".
It is not "intellectual-property-constituency-sufficient". For reasons of
inter-registrar, even inter-registry competition, whois data base mining
is _perceived_ to be both a business issue (unfair competition), and in
some way related to spam -- in both senarios contact data is harvested.
A paper by Ari [1] summarizing work done by CDT invalidates the primacy of
the second claim.

To summarize:
	o spammers do not use their real info when registering domains,
	  they steal from registrars, and possibly from registries.
	o spammers are not restricted to registrars and registries which
	  are in whole or in part under a regulatory regime in which ICANN
	  participates.
	o I'm not going to comment on whether the .com and .net registry
	  operator, and former .org registry operator, and operator of a
	  set of cctld registries, the 40% market-share registrar for the
	  com/net/org set of registries, or a vendor of certs, is acting
	  in good-faith, or in bad-faith -- only that it is an actor.

Everything in your note ultimately is independent of the knowledge that
a mesh of communicating registry-provisioning entities could make shared
data to registrars and registries which is contemporanious to detection,
by any means, of a new emitter. I must have posed the problem poorly.

I don't consider whois:43 to be any part of the solution-space. I write
that as the (former) co-chair of the whois-fix BoF (IETF), and as one of
many active in removing or modifying the ICANN bulk transfer requirement
for registrars, and the author of a draft [2] proposing that the status
of rfc954 be changed from "standard" to "historic". The IESG view on the
issue can be disscerned in the exchanges between its members and myself
in the archives of the PROVREG WG, to be brief, their position is that
a mechanism for registrant "opt-out" of publication via 954 is manditory
to implement, and optional to deploy.

I promise not to comment on 954 again.

Eric

[1] http://www.cdt.org/speech/spam/030319spamreport.pdf
[2] http://www.ietf.org/internet-drafts/draft-brunner-rfc954-historic-00.txt
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 09 May 2003 11:38:02 -0400

Yakov Shafranovich <[email-masked]> wrote:
> ICANN a stricter enforcement of the WHOIS rules

  I support this proposal.

  Does anyone have time to write a proposal for BCP, to fight spam
by better applying existing network policy?

  Alan DeKok.

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 09 May 2003 16:39:39 +0100

> by better applying existing network policy?

I'm sure this has been done a few times... in "local" forms
there's 
http://www.ripe.net/ripe/docs/ripe-206.html
for instance.

Of course this is aimed at ISPs.

--

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 09 May 2003 16:51:45 +0100

> ICANN a stricter enforcement of the WHOIS rules 

You're probably familiar with this document:

http://www.icann.org/gnso/whois-tf/report-19feb03.htm

There's an interesting minority report at the bottom.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 9 May 2003 10:55:34 -0600 (MDT)

> There's an interesting minority report at the bottom.

Only those who are spammer fighters instead of spam fighters object
to nonsense in domain registration contact data.  People who prefer
reducing spam to "getting back at" or otherwise counting coup on
spammers don't care what tags spammers use in their whois data, except
that we prefer common threads for a given group of spammers to ease
recognizing familiar sources when maintaining our blacklists.  The
campaigns of spammer fighters against bogus whois data have caused us
grief and are a waste of time.  The most you can force spammers to do
is pick random names, addresses, and telephone numbers from telephone
directories that are undetectably bad for the lifetime of the domain
name instead of exercising their individual and distinctive creativity.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 13:01:55 -0400

> http://www.icann.org/gnso/whois-tf/report-19feb03.htm

Yes. I am. I've been aware of this work since its inception, and have
discussed it with Paul Kane, chair of the authoring body, at several
points during its genesis. I made no public comment on the report, it
has been the subject of discussion on the registrars constitutency list.

As I wrote earlier (<[email-masked]>)
> I don't consider whois:43 to be any part of the solution-space.

See Vernon's "badges? we don't need no stinking badges!" note on the
non-utility of whois data. The paraphrase is mine.

Eric