Subject: [apps-discuss] Applications Area Directorate Review for draft-ietf-weirds-object-inventory-05

From: Claudio Allocchio <[email-masked]>
Date: Mon, 27 Oct 2014 11:23:58 +0100 (CET)

Document: draft-ietf-weirds-object-inventory
Title: Registration Data Access Protocol Object Inventory Analysis
Reviewer: Claudio Allocchio
Review Date: 27 October 2014
IETF Last Call Date: 24 October 2014
IESG Telechat Date: 30 October 2014

Summary:

this document attempta a usefule surver of what existing WHOIS servers can 
disclose "in public" for their registries contents. However there is a 
strong differenc in the accuracy of the selected statistical sample 
between RIRs and DNRs, thus before publishing this Informational document, 
I suggest making this fact more clear and evident. There may be data 
elements which ARE very useful for RDAP which just do not show up at all, 
but may be accessible after authentication.

Major Issues:

3 Methodology
The method used to collect data from existing whois servers, specifically 
for DNR objects, does not mention at all that many ccTLDs whois servers 
are "protected" against autmated queries, or just "closed" because of 
security and/or privacy reasons (avoid mass queries to find out available 
domains etc...). Of course this has an inflence on the data you collect, 
thus at least there should be a note mentioning this. Also, not all ccTLDs 
have a "nic.xx" existing domain, as this is not conpulsory. Last but not 
the least, many ccTLDs registries just "block" or do not support anymore 
whois queries again for privacy/security reasons and completely rely on 
authehticated web services. This makes the whole query method much less 
reliable than the RIR one (it did on 64% of the existinf DNR in all).

This is somehow mentioned in 5.5 Limitations (nic.ccTLD choice) but again 
no mention o the above "security / privacy" related issues. This is not 
enough IMHO.

Minor Issues:

none.

Nits:

none.

------------------------------------------------------------------------------
Claudio Allocchio             G   A   R   R          [email-masked]
                         Senior Technical Officer
tel: +39 040 3758523      Italian Academic and       G=Claudio; S=Allocchio;
fax: +39 040 3758565        Research Network         P=garr; A=garr; C=it;

            PGP Key: http://www.cert.garr.it/PGP/keys.php3#ca

---

From: Ning Kong <[email-masked]>
Date: Mon, 27 Oct 2014 18:43:55 +0800

Hi Claudio,

Thanks for your comments.
Because we only queried each WHOIS server once, so the query rate limitation was not a problem for us.
But you’re right that we could only get the public data from WHOIS servers having nic.ccTLD, so our data was not very common. 

We’ll add more explanation to clarify the issue you mentioned on the limitation section in the next version.

Cheers,
Ning

> 在 2014年10月27日，下午6:23，Claudio Allocchio <[email-masked]> 写道：
> 
> 
> this document attempta a usefule surver of what existing WHOIS servers can disclose "in public" for their registries contents. However there is a strong differenc in the accuracy of the selected statistical sample between RIRs and DNRs, thus before publishing this Informational document, I suggest making this fact more clear and evident. There may be data elements which ARE very useful for RDAP which just do not show up at all, but may be accessible after authentication.
> 
> Major Issues:
> 
> 3 Methodology
> The method used to collect data from existing whois servers, specifically for DNR objects, does not mention at all that many ccTLDs whois servers are "protected" against autmated queries, or just "closed" because of security and/or privacy reasons (avoid mass queries to find out available domains etc...). Of course this has an inflence on the data you collect, thus at least there should be a note mentioning this. Also, not all ccTLDs have a "nic.xx" existing domain, as this is not conpulsory. Last but not the least, many ccTLDs registries just "block" or do not support anymore whois queries again for privacy/security reasons and completely rely on authehticated web services. This makes the whole query method much less reliable than the RIR one (it did on 64% of the existinf DNR in all).
> 
> This is somehow mentioned in 5.5 Limitations (nic.ccTLD choice) but again no mention o the above "security / privacy" related issues. This is not enough IMHO.