[gnso-rds-pdp-wg] We should not build atop whois (was Re: Domain Name Certification )

[David Cake]

I thoroughly support Holly here. We should all use the SAC 51 terminology, because it removes confusion about protocol vs RDS. 

Sent from my iPad

> On 10 Jan 2018, at 8:42 pm, Paul Keating <Paul at law.es> wrote:
> 
> Andrew,
> 
> As I see it, your comments are addressing the technical underpinnings of
> WHOIS and not the DATA.  I believe that the others are addressing the data
> and the continuing need of other systems to continue to access the data.
> 
> Paul
> 
> 
> On 1/10/18, 12:29 AM, "gnso-rds-pdp-wg on behalf of Andrew Sullivan"
> <gnso-rds-pdp-wg-bounces at icann.org on behalf of ajs at anvilwalrusden.com>
> wrote:
> 
>>> On Tue, Jan 09, 2018 at 10:40:19PM +0000, benny at nordreg.se wrote:
>>> 
>>> My point is that the purpose for collecting data to RDS should not be
>>> build upon the needs for other systems build on top the present Whois
>> 
>> If that's what you think, then I believe we disagree very strongly.
>> Many of the problems with respect to the registration databases and
>> with respect to regisration data directory services can be traced
>> directly to the problems with whois.  It seems to me that this litany
>> has been recited before (more than once by me), so those who remember
>> it can stop reading; but to remind people what I'm talking about with
>> respect to these data and policy problems, here are a few:
>> 
>>   1.  WHOIS was designed in an era when the entire names registry
>>   was completely centralised, in the NIC.  So, it did not need to
>>   become a distributed system, and it wasn't designed for
>>   distributed operation.  (To be clear: the NICNAME specfication is
>>   in RFC 812, which is dated March 1982.  The first DNS
>>   specification is in RFC 882, from November of 1983.  NICNAME
>>   didn't have to deal with a distributed database _at all_: it was
>>   about the HOSTS.TXT file and the related metadata.  Obviously,
>>   people knew DNS was coming, but it wasn't a thing yet.)
>> 
>>   2.  Adding references to whois in order to make a distributed
>>   protocol -- rwhois, whois++, and some other flavours -- never
>>   really worked.  This meant that it was unreliable which
>>   (registrar) database you'd get some whois information from, which
>>   meant you often got stale data from the wrong registrar.  This,
>>   more than anything else, was the incentive behind "thick"
>>   registries, which is why registries ended up having information
>>   about registrants, with whom they do not strictly speaking have a
>>   direct contractual relationship.  (I observe that now we seem to
>>   be treating an awful lot of data that is collected by registrars
>>   and transmitted to registries as just "data that is collected",
>>   which was why I was trying to figure out the delimitation of the
>>   RDS some months ago.)
>> 
>>   3.  WHOIS was designed as a simple-minded human-consumable
>>   call-and-response protocol when internationalisation didn't work
>>   reliably on a single computer, never mind on the network.  So it
>>   knows nothing about different types of data and therefore cannot
>>   handle the data in different ways according to context.
>>   Therefore, the ICANN whois policies have all kinds of extraneous
>>   rules about formatting, how "fields" need to be handled, and so
>>   on.  None of this belongs in a policy, but it's there because the
>>   protocol was wrong.
>> 
>>   4.  WHOIS was designed and deployed for a network in which
>>   practically all the users were also developers of the network, and
>>   where the scope of the users of the network was controlled because
>>   of contractual arrangements permitting connection in the first
>>   place.  Therefore, it has no notion of "context" and cannot do
>>   anything to determine who is asking a query or to determine
>>   authorization.  Many of the debates about privacy turn out to be
>>   debates abount access, not whether the data should be collected in
>>   the first place.  We keep tripping over this now, even though
>>   we're supposed to be alert to it.
>> 
>>   5.  The fact of unfettered access has meant that people who want a
>>   domain name -- but who, quite reasonably, do not want to pay extra
>>   to prevent their cell phone number and home address from being
>>   published to 2 billion of their closest friends -- simply lie
>>   about their information in an effort to obscure it.  Others who
>>   are lying, of course, are hiding because they're doing something
>>   untoward.  There is today literally no way to distinguish these
>>   cases because the first class of people are sympathetic victims of
>>   WHOIS, a protocol created two years before the founder of Facebook
>>   was born.
>> 
>> We have got to get over the idea that the existing whois is _any_ kind
>> of model for what we ought to be trying to do.  Anyone with the
>> faintest technical background can look at the early specification of
>> WHOIS/NICNAME and recognise a protocol that was designed to be exactly
>> good enough for the purpose at hand.  Indeed, RFC 3912 (which
>> obsoleted the previous WHOIS protocol specifications in 2004) is quite
>> explicit that whois has some fundamental inadequacies that need to be
>> fixed.  Please stop claiming that "whois" -- either the protocol or
>> all the collections of policies that have been built on top of that
>> miserable hangover of a protocol -- is any guide for what we should
>> do.  It is not.
>> 
>> Best regards,
>> 
>> A
>> 
>> -- 
>> Andrew Sullivan
>> ajs at anvilwalrusden.com
>> _______________________________________________
>> gnso-rds-pdp-wg mailing list
>> gnso-rds-pdp-wg at icann.org
>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
> 
> 
> _______________________________________________
> gnso-rds-pdp-wg mailing list
> gnso-rds-pdp-wg at icann.org
> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg