[gnso-rds-pdp-wg] Calling it quits

Mon Oct 30 04:17:30 UTC 2017

John,

Those use cases are different from the anti-* ones I mentioned. But they are not IP concerns either...

... andI don't think those credibility use cases should be resolved with gated access, because credibility requires public data for everyone to see. Perhaps they are the ones to get consent from the registrant; for instance, if a merchant wants to accept payment provider X, that payment provider can demand that only domains with published RDS data can join. Same thing with CAs: if you want an SSL certificate that depends on RDS data, ask your registrar to make the information public. Otherwise, no SSL certificates for you.
(Note that CAs have other means of confirming control of a domain, like DNS records, e-mail etc. for DV certificates, but for OV and EV certificates, RDS transparency can be a must)

So one feature of a privacy-by-design RDS system should be allowing a registrant to not be private if he or she wants so; if someone wants to stand out for transparency, that should be allowed.

Rubens

> On Oct 30, 2017, at 7:46 AM, John Horton <john.horton at legitscript.com> wrote:
> 
> Just remember that the fact that the information is bogus is, itself, important and useful in some cases. In our work with banks and payment providers, that's considered a high-risk factor at a minimum, and may actually bar an account being provided in other cases (unless it's genuinely Mickey Mouse, of course! He should always have a merchant account.). So, in that case, it's important not just to correlate but to specifically know what the Whois is, if you will. Banks and payment providers, and those of us who help them assess and monitor merchants for potentially useful information to prevent money laundering and similar activity, need to know the information currently contained in the Whois record to assess who actually has control rights over the domain name or if it's bogus, etc.
> 
> Neil, whatever, man. :) Good luck!
> 
> John Horton
> President and CEO, LegitScript
> 
> 
> Follow LegitScript: LinkedIn <http://www.linkedin.com/company/legitscript-com>  |  Facebook <https://www.facebook.com/LegitScript>  |  Twitter <https://twitter.com/legitscript>  |  Blog <http://blog.legitscript.com/>  |  Newsletter <http://go.legitscript.com/Subscription-Management.html>
> 
> 
> 
> On Mon, Oct 30, 2017 at 3:25 AM, Rubens Kuhl <rubensk at nic.br <mailto:rubensk at nic.br>> wrote:
> I've been involved in abuse fighting for quite some time, and my interest in WHOIS data was to correlate objects, not to get the information behind one of them, since that information was bogus, mostly.
> 
> So I understand why IP concerns want access to actual WHOIS data, but for anti-*, a simple related query could be enough. So instead of knowing if phishing.com <http://phishing.com/> belongs to Mickey Mouse, you could access rdap.registrar.com/phishing.com?related=yes <http://rdap.registrar.com/phishing.com?related=yes> and know that the same registrant has also registered farming.com <http://farming.com/>, banknameaccounts.com <http://banknameaccounts.com/> so now you can expand the investigation into those objects.
> 
> Knowing that Mickey Mouse registered those domain could bring me some laughs, but no actionable intelligence.
> 
> 
> Rubens
> 
> 
> 
>> On Oct 29, 2017, at 9:27 PM, Neil Schwartzman <neil at cauce.org <mailto:neil at cauce.org>> wrote:
>> 
>> All,
>> 
>> I've decided to withdraw from this and other anti-abuse groups. My best wishes on a successful conclusion to the critically important work you do here. Please don’t mess it up for anti-abuse researchers! For real - our work is what keeps the Internet running, whether you know it, appreciate it, care about it. or not. I am much inclined to believe you do care.
>> 
>> We need access to WHOIS as is, or same level of access of WHOIS WHATWILLBE.
>> 
>> this might be some credentialed, qualified paid access, but please believe me - we Antis aren’t just saying this to be trenchant. Any strident comments come from a fear for all of our future without this cornerstone to our work. I was going to cobble together a use of WHOIS in my work for a day and it took so long because I use it so much, the thing ended up at several tens of thousands of words, and was really boring to read.
>> 
>> Anything less, and things will become an even bigger sewer than it already is. I know you all care, from different angles, so please do bear these words in mind. You argue amongst yourselves, from a position of personal belief in the great goodness this thing of ours has inherent to it. It is a good thing, a great thing, and I intent to use that greatness.
>> 
>> I’ve decided to tackle an easier project; rather than dealing with WHOIS @ ICANN, I’m going to try to bring peace to the Middle East.
>> 
>> Read all about it: HATE: The Reason I Quit Spamfighting <https://medium.com/@neilschwartzman/hate-the-reason-i-quit-spamfighting-866a162d5629>
>> 
>> 
>> Yours truly,
>> 
>> 
>> Neil Schwartzman
>> Executive Director
>> Coalition Against Unsolicited Commercial Email
>> http://cauce.org <http://cauce.org/>
>> Tel : (303) 800-6345 <tel:(303)%20800-6345>
>> Twitter : @cauce
>> 
>> 
>> 
>> 
>> _______________________________________________
>> gnso-rds-pdp-wg mailing list
>> gnso-rds-pdp-wg at icann.org <mailto:gnso-rds-pdp-wg at icann.org>
>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
> 
> _______________________________________________
> gnso-rds-pdp-wg mailing list
> gnso-rds-pdp-wg at icann.org <mailto:gnso-rds-pdp-wg at icann.org>
> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20171030/6bb2e121/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 496 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20171030/6bb2e121/signature-0001.asc>