<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>+1</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Why are we still debating restricting access to thin data?<br><br>--<div>John Bambenek</div></div><div><br>On Jun 6, 2017, at 19:41, Dotzero <<a href="mailto:dotzero@gmail.com">dotzero@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">Well written Andrew.<br><br>+1<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 6, 2017 at 2:22 PM, Andrew Sullivan <span dir="ltr"><<a href="mailto:ajs@anvilwalrusden.com" target="_blank">ajs@anvilwalrusden.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
On the call today there were arguments being made about why certain<br>
fields should not be publicly accessible. In effect, what we are now<br>
arguing about, in talking about what should be considered "thin data",<br>
is the definition of the set of data to which unauthenticated access<br>
should be permitted. (Let us please not get distracted by what is<br>
actually required by the RAA or anything like that just now, since the<br>
outcome of this policy discussion might change that.)<br>
<br>
There were several arguments put forth about whether the created on,<br>
updated on, and expiry dates should be included. Similarly, people<br>
discussed whether the domain status values should be included. I<br>
believe they must be.<br>
<br>
The Internet is unlike many other technologies because of its radical<br>
decentralization. That is not some sort of political choice, but<br>
instead a fundamental part of the design of the Internet: it's a<br>
network of networks (of networks…) formed by voluntary interoperation<br>
among the participants. Participants in the Internet interoperate<br>
without setting up formal contractual arrangements between all the<br>
participating parties. This feature is part of what has made the<br>
Internet so successful compared to other telecommunications systems,<br>
because the barrier to entry is really low. But that design comes at a cost.<br>
<br>
The cost is that there's not always a party to speak to, with whom one<br>
has a pre-existing relationship. If communications break down between<br>
two telephone customers, they know whom to call: the phone company.<br>
The phone company also has contractual (or sometimes treaty)<br>
relationships to other phone companies.<br>
<br>
The Internet doesn't work that way. If you and I are communicating<br>
over the Internet, there is no guarantee of direct contractual<br>
relationships all the way along the transit path: that's what open<br>
peering policies ensure. The way we make this work in fact is by<br>
placing the responsibility for troubleshooting out at the edges. And<br>
because of that, when I need to troubleshoot my site I need to have<br>
tools with which to do that.<br>
<br>
In domain-based communications (such as email, IP telephony, websites,<br>
money transfer, and thousands of other applications), when I encounter<br>
a problem with the communication I need to answer whether the problem<br>
is in _my_ network operation, or in the other end. Important data to<br>
rule out "the other end" is in the thin RDS data.<br>
<br>
Obviously, the nameserver and DNSSEC information in the RDS will allow<br>
me to tell whether what is in the global DNS is what ought to be<br>
there. For instance, if the RDS has one value for the name servers,<br>
but the DNS returns something else, there is a problem.<br>
<br>
Less obvious but just as important are the status values. If a name<br>
is on Hold or is pendingTransfer or something like that, it can tell<br>
me that something is up. A name that doesn't appear in the DNS but<br>
has a full complement of name servers in the RDS, for example, might<br>
be on hold; and I can't tell that without seeing the status values.<br>
<br>
In the same way, the dates in the RDS allow a troubleshooter to<br>
understand what might be wrong when things are broken. If a name is<br>
set to expire in a day and you're getting a parking page on the<br>
website, you have a clue about what is going on. Most of the examples<br>
cited in<br>
<a href="https://whoapi.com/blog/1582/5-all-time-domain-expirations-in-internets-history/" rel="noreferrer" target="_blank">https://whoapi.com/blog/1582/<wbr>5-all-time-domain-expirations-<wbr>in-internets-history/</a><br>
were trivial to understand for help desks that could see that a name<br>
that should have existed for some time was just hours old, because the<br>
created_on date was available. And if you start having trouble and<br>
see a domain was updated about the same time the trouble started, you<br>
have a pretty good clue that the problem is most likely at the target<br>
domain, and not in your own network.<br>
<br>
As for the question of why the global Internet infrastructure needs to<br>
help with this, the answer is that _that's what the infrastructure is<br>
for_. We have registrars and registries in order to co-ordinate these<br>
assignments and make those assignments available, in support of the<br>
distributed administration and operation of the Internet. If the<br>
infrastructure isn't providing this kind of information in order to<br>
help administrators of various Internet administrators, then it isn't<br>
doing its job.<br>
<br>
The Internet is a distributed system. If you want to make distributed<br>
systems work, you have to allow the operators to have enough<br>
information to do their jobs independently of one another. So,<br>
regardless of where one lands on whether any of this data is personal<br>
data, it makes no difference. If you want the domain name system to<br>
continue to work reliably, you have to publish this data.<br>
Centralization and locking the data up for just registrars simply<br>
won't scale.<br>
<br>
Best regards,<br>
<br>
A<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Andrew Sullivan<br>
<a href="mailto:ajs@anvilwalrusden.com">ajs@anvilwalrusden.com</a><br>
______________________________<wbr>_________________<br>
gnso-rds-pdp-wg mailing list<br>
<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/<wbr>listinfo/gnso-rds-pdp-wg</a></font></span></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>gnso-rds-pdp-wg mailing list</span><br><span><a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a></span><br><span><a href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg">https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a></span></div></blockquote></body></html>