[Gnso-ppsai-pdp-wg] Fwd: What is content and what isn't

[Michele Neylon - Blacknight]

Forwarding on behalf of Eric

Mr Michele Neylon
Blacknight Hosting & Domains
http://www.blacknight.host/
http://www.mneylon.social

Begin forwarded message:

From: Eric Brunner-Williams <ebw at abenaki.wabanaki.net<mailto:ebw at abenaki.wabanaki.net>>
Date: 29 October 2014 21:14:32 GMT
To: Michele Neylon - Blacknight <michele at blacknight.com<mailto:michele at blacknight.com>>
Subject: Fwd: Re: [Gnso-ppsai-pdp-wg] What is content and what isn't

Michele,

Apparently I'm not (yet) able to contribute to the list. Would you be so kind as to forward this?

Eric


-------- Original Message --------
Subject:        Re: [Gnso-ppsai-pdp-wg] What is content and what isn't
Date:   Wed, 29 Oct 2014 12:35:53 -0700
From:   Eric Brunner-Williams <ebw at abenaki.wabanaki.net><mailto:ebw at abenaki.wabanaki.net>
To:     gnso-ppsai-pdp-wg at icann.org<mailto:gnso-ppsai-pdp-wg at icann.org>
CC:     Glen de Saint Géry <Glen at icann.org><mailto:Glen at icann.org>


I don't know if this will go to the list -- I haven't been active since January.

I suggest that the terminal label in a dot-terminated sequence of labels, aka "the domain name", e.g., "example" in example.com<http://example.com>, and the resources associated with a dot-terminated sequence of labels, differ.

The former may be discovered by several means, e.g., string search through bulk access, random poking on whois, payload in transport protocol data, etc.

The later may only be discovered by resolution -- that is -- resources disclosed by the dns, or by direct access to the resources, usually hosts.

Restated, as I'm sure everyone is aware, names, infringing or not, are not the same as resources, malign or not, associated with the names via the dns.

What I suggest, because I don't think everyone agrees on what "content" might mean, is that the two flavors Steve referred to during yesterday's call:

Abuse comes in two flavors:  abuse that derives from registration of the domain name itself, and abuse that derives from how the domain name is used.

really are quite different, and that "content" as I suspect most here intend does _not_ include properties of resource records that would interest, even alarm, network operators (nominally included in the ISPCP within the GNSO). Examples of non-"content" resource record properties of interest or alarm are correlations of A records (hosts), of NS records (nameservers) with blocks of addresses or nameservers previously known to be ... interesting or alarming, as well as the TTL (time to live) value of resource records (enabling FastFlux and friends).

In lieu of "content", perhaps the clunkier but less vague term of "resolved resources" could be used. Then we would know when we are discussing a static property of a string (well, one likely to last a year or so in the current common registration model) or the dynamic properties of resolution of a FQDN.

Thank for your patience,
Eric


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-ppsai-pdp-wg/attachments/20141029/9d9048cc/attachment.html>