<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Everything is an option. It's an option to run anti-virus. It's
an option to have a firewall. It's an option to have an unpatched
windows machine sitting on the open internet. It's also an option
of not only what types of services you run but which specific
version/application. Because of the voluntary interconnectional
nature of the internet, we don't say because we can't specificly
delineate exactly HOW something is implemented means we cannot
craft policies to support broad use cases.</p>
<p>And we're all aware of Let's Encrypt which allows anyone to
request an SSL cert and identity for almost anyone else on the
internet (baring implementing CAA putting the burden on domain
owners to configure DNS records to prevent you from issuing
certificates in their name). It's precisely the "it's not our job"
mentality of various classes providers that is one of the biggest
if not the biggest contributor to not only cybercrime but the
difficulty in fighting it... <br>
</p>
<br>
<div class="moz-cite-prefix">On 9/29/2017 12:47 PM, Jeremy Malcolm
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:58394561-c3ad-a348-b002-7577a92f293e@eff.org">
<pre wrap="">On 29/9/17 10:29 am, Andrew Sullivan wrote:
</pre>
<blockquote type="cite">
<pre wrap="">So, we can't treat reputation service support as something that's nice
to have. It's necessary for the functioning of domain names on the
Internet, and therefore we must provide for it.
</pre>
</blockquote>
<pre wrap="">
Interesting argument, but not convincing to me. The reputation systems
that I'm aware of *are* optional to support. Some mail providers
subscribe to certain blocklists that others don't, some search engines,
browsers, and browser plugins will flag particular domains that others
don't, and so on. In the similar context of certificate authorities
that issue SSL certificates for domains, Let's Encrypt (which EFF is a
sponsor of) is often asked to refuse to issue certificates for
particular domains based on reputation, but has decided that that's not
part of its job. Consider the domain amazonaws.com, which host millions
of Amazon S3 buckets. There's a lot of phishing content stored under
that domain from time to time, but assigning a bad reputation to the
registered owner of amazonaws.com would be pointless and cause lots of
collateral damage. It hardly seems that it's an essential part of the
domain name system to be able to do that.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
gnso-rds-pdp-wg mailing list
<a class="moz-txt-link-abbreviated" href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>
<a class="moz-txt-link-freetext" href="https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg">https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
--
John Bambenek</pre>
</body>
</html>