Subject: RE: [ietf-provreg] the privacy problem statement

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 1 Apr 2003 07:38:32 -0500

> > If I remember correctly the feeling of the room in San 
> Francisco was that
> > this could be limited to the contact mapping.
> 
> No. I'm less sure we agreed on that. The words I kept hearing 
> were 'social
> data' but It wasn't explicit that was limited to contact mapping.
> 
> It might be my misunderstanding of what 'social data' and 
> 'contact mapping'
> are in this context.

Absent anything that resembles social data (as described in RFC 3375)
outside the contact mapping, I'm working with a definition of social data
that only applies to elements present in the contact mapping.

-Scott-

---

From: "Edmon Chung" <[email-masked]>
Date: Tue, 1 Apr 2003 20:39:48 -0500

I dont think a privacy profile for contact objects only is much useful...

The most prominent example is that a registry might mandate that the Admin
contact Address be displayed while other contacts may have them hidden.  If
a contact is the Admin contact of one domain and a billing contact for
another, and the contact object was created when s/he needed to be an Admin
contact, then s/he will be forced to also disclose his/her address for the
other domains that s/he is associated with.

I think privacy profile for domain mapping is as important... if not more
important

Edmon

---

From: janusz sienkiewicz <[email-masked]>
Date: Wed, 02 Apr 2003 11:43:56 -0500

Edward Lewis wrote:

> At 7:38 -0500 4/1/03, Hollenbeck, Scott wrote:
> In the IESG comment, "why do domain/contact/.. not have granular
> information about privacy?" domains are mentioned too.
>

Domains don't have any social data (<domain:registrant>, <domain:contact> are
just references to social data owned and maintained by registrars). That's
why domains should not be within the scope of any privacy mechanism.

>
> --
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis                                            +1-703-227-9854
> ARIN Research Engineer
>
> I've had it with world domination.  The maintenance fees are too high.

Janusz Sienkiewicz

---

From: Edward Lewis <[email-masked]>
Date: Wed, 2 Apr 2003 12:03:17 -0500

Randy,

While the group is preparing to address the comment below, this 
statement was made.  I think we need a little more clarification 
(hopefully not much) from you on this.

In the 'official' comment, you mentioned 'domain.'   Is there 
specific data you had in mind when writing the comment?

---

From: Edward Lewis <[email-masked]>
Date: Wed, 2 Apr 2003 11:20:50 -0500

---

From: Randy Bush <[email-masked]>
Date: Wed, 2 Apr 2003 09:13:39 -0800

> specific data you had in mind when writing the comment?

i meant the org data may have sensitive fields.  e.g., for an
extreme example, i am aware of domains where the org is vulnerable
to real-world attack, and hence wishes to hide its identity from
all but legitimate queries to do with domain maintenance.

i did not mean that i thought it reasonable to hide the
nameservers.

hope this helps.

randy