Subject: [weirds] FW: I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 30 Apr 2012 13:56:56 +0000

FYI, all. This is the first cut at a draft to describe a query protocol for name registries. Another document (or documents) to describe response formats is in the works.

Scott

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Monday, April 30, 2012 9:55 AM
To: [email-masked]
Subject: I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : Domain Name Registration Data Access Protocol Query Format
	Author(s)       : Scott Hollenbeck
                          Steve Sheng
                          Francisco Arias
	Filename        : draft-hollenbeck-dnrd-ap-query-00.txt
	Pages           : 13
	Date            : 2012-04-30

   This document describes a RESTful query format proposal for the
   Domain Name Registration Data Access Protocol.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-hollenbeck-dnrd-ap-query-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-hollenbeck-dnrd-ap-query-00.txt

The IETF datatracker page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-hollenbeck-dnrd-ap-query/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 30 Apr 2012 15:09:10 +0000

> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Hollenbeck, Scott
> Sent: Monday, April 30, 2012 9:57 AM
> To: [email-masked]
> Subject: [weirds] FW: I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt
> 
> FYI, all. This is the first cut at a draft to describe a query protocol
> for name registries. Another document (or documents) to describe
> response formats is in the works.

I've received a private note from someone suggesting that queries for registrar objects by ID and hosts by IP address should be included in this draft. Does that sound reasonable?

Scott

---

From: Andy Newton <[email-masked]>
Date: Mon, 30 Apr 2012 11:50:45 -0400

> I've received a private note from someone suggesting that queries for registrar objects by ID and hosts by IP address should be included in this draft. Does that sound reasonable?

Is it something the general public would be interested in? Or is it something a domain industry person wants? If its the former, it is probably a good idea. If it is the latter, then why aren't they using EPP or whatever?

In general, the broad internet using community doesn't tend to remember their own identifiers in registries. They only know the natural identifiers, such as domain names or IP addresses. So a look up of registrar's by ID is, in my opinion, a feature to make adopting the protocol harder while not doing much benefit for the broader internet public. But host lookups by IP addresses does seem like something an internet user may want to trouble shoot problems.

-andy

---

From: Francisco Obispo <[email-masked]>
Date: Mon, 30 Apr 2012 08:56:05 -0700

> In general, the broad internet using community doesn't tend to remember their own identifiers in registries. They only know the natural identifiers, such as domain names or IP addresses. So a look…

I agree with this comment, however, what if the same IP is being used by multiple host names?, In my opinion, we should only allow for FQDN and registrar's name.

If we need to provide a ip-to-name or a id search of some sort, we should do so in the 'searchable interface' instead.

Francisco Obispo 
email: [email-masked]
Phone: +1 650 423 1374 || INOC-DBA *3557* NOC
PGP KeyID = B38DB1BE

---

From: Dave Piscitello <[email-masked]>
Date: Mon, 30 Apr 2012 09:01:39 -0700

These would be interesting in a number of malicious registration/forensics scenarios. For example, think about DGAs that generate names across multiple registries (like Conficker). Now think about trying to pattern match to see if there is a common registrar being used or exploited. 

Since many information flows identify IP addresses initially and either resolve to names later or not at all, I suspect that this, too, would be valuable for any investigator.

These would also be extremely valuable if consensus policy were to consider and add reseller objects to the data model. This is my personal opinion and speculative as well. My company and members of the broader community may think differently.

On Apr 30, 2012, at 11:09 AM, Hollenbeck, Scott wrote:

> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds

---

From: Eric Brunner-Williams <[email-masked]>
Date: Mon, 30 Apr 2012 17:21:42 -0400

> These would be interesting in a number of malicious registration/forensics scenarios. For example, think about DGAs that generate names across multiple registries (like Conficker). Now think about…

i made, or thought i made, the point during the .C response that the
.C author's attempt to generate an inventory of rendezvous points had
more utility demonstrating the aggregate complexity and cost the
author was willing to incur, imposed by both registry and registrar,
and if memory serves, ignoring the conjectured, but undiscovered
complexity/cost boundary the .C author was unwilling to cross, my
analysis of the registrar-to-rendezvous-points showed no significant
correlation to com/net/org/biz/info registrars other than market share.

the similarity of string sets has been a known feature of ip
exploiting registrations for almost all of the current iana contract
period, though iterative uni-quiry into arbitrary points into the
adjacent string space seems to be the state of the query art.

> These would also be extremely valuable if consensus policy were to consider and add reseller objects to the data model. This is my personal opinion and speculative as well. My company and members o…

your company? that would be the rhs of "[email-masked]"?

-e

---

From: Dave Piscitello <[email-masked]>
Date: Mon, 30 Apr 2012 15:44:03 -0700

On Apr 30, 2012, at 5:21 PM, Eric Brunner-Williams wrote:

i made, or thought i made, the point

Yes, you did. I'm expanding that to considering the volumes of registration data that people o/t registries and registrars store. Individual investigators, researchers in academia or organizations that have tens of thousands of whois records associated with malicious registrations, phished domains, malware hosting domains, etc. At the moment, much of this information is not easily normalized. Also, certain companies provide historical whois as a service. All of these would benefit from structured, searchable data, and there's keen interest in registrar and reseller info. The 2H2012 APWG Global Phishing Survey, for example, made use of Domain Tools historical Whois to identify "phished registrars" (Presented last week during APWG Prague, I wrote about it today).

your company? that would be the rhs of "[email-masked]<mailto:[email-masked]>"?

Apologies, that is ambiguous. In this case, I'm speaking of ICANN.
I suspect no one at Core Competence disputes my opinion but I did send this from the ICANN address not [email-masked]<mailto:[email-masked]> :-)

---

From: Byron Ellacott <[email-masked]>
Date: Tue, 1 May 2012 09:35:22 +1000

> I've received a private note from someone suggesting that queries for registrar objects by ID and hosts by IP address should be included in this draft. Does that sound reasonable?

I find the notion of asking a domain registrar for information about an IP address to be confusing.  Is the user expecting to know who they should contact about that IP address, are they expecting to find all the possible mappings of labels to that IP address , or are they expecting to have the domain query service perform a reverse lookup for them?  Whichever case it may be, I find it unlikely that a domain query service can give a satisfactory answer.

  Byron

---

From: "John Levine" <[email-masked]>
Date: 1 May 2012 02:42:59 -0000

>> I've received a private note from someone suggesting that queries for
>registrar objects by ID and hosts by IP address should be included in
>this draft. Does that sound reasonable?
>
>Is it something the general public would be interested in? Or is it
>something a domain industry person wants? If its the former, it is
>probably a good idea. If it is the latter, then why aren't they using
>EPP or whatever?

Hosts by IP address is definitely useful to the hoi polloi.

Objects by ID might be useful if there are responses to queries that
include IDs, and that's what you have to do to find out what the ID
means.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 1 May 2012 02:46:31 -0000

>I find the notion of asking a domain registrar for information about an
>IP address to be confusing.  Is the user expecting to know who they
>should contact about that IP address, are they expecting to find all the
>possible mappings of labels to that IP address , or are they expecting
>to have the domain query service perform a reverse lookup for them? 

For a name registry or registrar, I'd be thrilled to get a list of
name servers they know about that resolve to that IP.  A common bad
guy trick is to register a bunch of names, stick them all on the same
servers, but use a different subdomain name for each one, e.g. foo.biz
has name server ns1.foo.biz and bar.biz has ns1.bar.biz , but they're
really the same IP.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 1 May 2012 04:13:42 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Andy Newton
> Sent: Monday, April 30, 2012 8:51 AM
> To: Hollenbeck, Scott
> Cc: [email-masked]
> Subject: Re: [weirds] I-D Action: draft-hollenbeck-dnrd-ap-query-00.txt
> 

I would like to be able to, given a domain name, get back a unique identifier for the registrant (owner, for example), with some expectation that it's stable.  Then if some other domain name comes back showing the same registrant ID, I know the two are related.

Bonus if I can say "give me all records for which the owner's registrant ID is X", but I'm guessing that's a long shot.

> In general, the broad internet using community doesn't tend to remember
> their own identifiers in registries. They only know the natural
> identifiers, such as domain names or IP addresses. So a look up of
> registrar's by ID is, in my opinion, a feature to make adopting the
> protocol harder while not doing much benefit for the broader internet
> public. But host lookups by IP addresses does seem like something an
> internet user may want to trouble shoot problems.

I think you're right for human consumers of the data, but automated systems might have an actual use for it.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 1 May 2012 04:14:43 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of John Levine
> Sent: Monday, April 30, 2012 7:47 PM
> To: [email-masked]
> For a name registry or registrar, I'd be thrilled to get a list of name
> servers they know about that resolve to that IP.  A common bad guy
> trick is to register a bunch of names, stick them all on the same

Ditto here.

-MSK

---

From: James Mitchell <[email-masked]>
Date: Tue, 1 May 2012 15:06:29 +1000

Registries will limit the number of hosts returned from an IP address
query. This limit might be lifted should the registry offer different
classes of service for consumers such as law enforcement agencies etc.
Knowing the limit has been reached would be useful.

One should note that Base Agreement & Specifications (Specification 4) of
the new gTLD Applicant Guidebook
<http://newgtlds.icann.org/en/applicants/agb/base-agreement-specs-11jan12-e
n.pdf> requires Registries to provide name server responses for IP address
input.

James