Subject: Confirming the Nominet position

From: "Jay Daley" <[email-masked]>
Date: Wed, 26 May 2004 16:21:02 +0100

Here is a proper explanation of the Nominet position.

1.  Showstopper
Zone file enumeration is a show-stopper for us that will prevent us from 
fully implementing DNSSEC. So if DNSSEC stays in its current form then we 
will have to make a local determination about how/what we implement, which 
is still to be decided.  Our reason for this is our view of what is the 
appropriate policy to act in the best interests of our local community, 
which for some time has been to deny access to our zone files. 

2.  Late new comers
The criticism levelled about "late new comers" is well founded and I'm 
sorry that is the case.  This is something we should have raised some time 
ago.  Recognising that we were late with this we did try to avoid just 
unproductive foot stamping by the development of the NSEC2 draft as a 
positive alternative.  We are now committed to the process and we will be 
here to stay.  As evidence of this I should make clear that our next steps 
will be to get NSEC2 patches written for BIND and if possible NSD to allow 
proper interoperability testing.

3.  Way ahead
Ideally we would like NSEC2 to go forward properly, but I understand very 
well that this causes significant problems for many in this WG.  So we 
would be quite happy with a mechanism that allowed NSEC2 to be introduced 
later in a backwards compatible fashion, such as the previously suggested 
version field for NSEC.

3. Legal mumbo jumbo
I'm sorry if we appear to have been hiding behind legal mumbo jumbo, this 
was not our intention.  So I need to be clear that our legal advice is 
ancillary to our view in (1) above, not the determining factor. 

However, for those of you that have asked, this is the gist of our legal 
advice...

As compilations, zone file databases are protected under EU law by 
?Database Right?. As a derivative work of the main register from which 
they are sourced, they are likely also to attract copyright protection in 
addition to or in place of database right.

Both database right and copyright are negative rights in that they 
prohibit certain acts (primarily, copying the whole or a substantial part 
of the materials) but do not grant positive rights (unlike, for example, a 
patent, which grants a monopoly on the material involved). Database right 
is unique to countries which implement European Community law, but 
copyright is more universal. 

If legal rights would be infringed with copying, then is it not better to 
allow the copying, and then rely on the law to assist against any 
infringers?  The short answer is ?no?, and here the analogy of locking 
one?s house or car despite laws against burglary and theft may be helpful. 
 Prevention is not always better than cure, if one is led to make an 
overly restrictive solution in order to prevent a minor risk.  However, if 
the risk of harm is major, and is highly likely to take place, and will be 
expensive and difficult to put right after the event, then in those 
circumstances, prevention is very definitely better than cure.

The problem with both copyright and database right arises with 
enforcement, particularly in respect of electronic data such as a zone 
file.  Firstly it can be hard to identify whether a data mining event has 
taken place, in the context of the high volume of traffic affecting the 
nameservers on a day to day basis. If a technical department cannot show 
this, there is nothing that a legal department can do. Even if it is clear 
that it is happening, the technical department may not be able to trace 
who has done it, because the use of multiple proxies can make it 
impossible (or prohibitively expensive) to find it. Even if this can be 
done, the person(s) involved may be abroad. If they are in a difficult 
jurisdiction (even including eastern Europe, which is part of the EU) the 
differences in language and legal systems add to the expense and 
complexity of pursuing legal proceedings. 

Jay

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Robert Elz <[email-masked]>
Date: Fri, 28 May 2004 18:13:25 +0700

Date:        Wed, 26 May 2004 16:21:02 +0100
    From:        "Jay Daley" <[email-masked]>
    Message-ID:  <[email-masked]>

  | 1.  Showstopper
  | Zone file enumeration is a show-stopper for us that will prevent us from 
  | fully implementing DNSSEC. So if DNSSEC stays in its current form then we 
  | will have to make a local determination about how/what we implement, which 
  | is still to be decided.  Our reason for this is our view of what is the 
  | appropriate policy to act in the best interests of our local community, 
  | which for some time has been to deny access to our zone files. 

Actually, that's fine.   No-one (here anyway) can force anyone to
implement anything.   If you don't implement DNSSEC, or just partially
implement it (somehow), that's your choice.   Sometime in the future, if
UK users wonder why their DNS security isn't up to the standard of everyone
else's, you can explain to them why that is in their best interests.  If
they agree with your explanation, and justification (you can blame this
WG for forcing NSEC on DNSSEC if you want) then no problems.   If they
don't agree with you, then as I understand how nominet works (which I very
well might not), you'd eventually end up replaced by someone who would
implement DNSSEC.

  | 3. Legal mumbo jumbo
[...]
  | However, for those of you that have asked, this is the gist of our legal 
  | advice...
  | 
  | As compilations, zone file databases are protected under EU law by 
  | ?Database Right?. As a derivative work of the main register from which 
  | they are sourced, they are likely also to attract copyright protection in 
  | addition to or in place of database right.

Leaving aside the question of whether or not those rights actually
exist in the DNS zone files (a topic that can be debated, but namedroppers
is not the correct forum for that), what needs explaining is not what
those are, but why you'd want to enforce them.   That copyright exists
in some work (like perhaps this e-mail) doesn't mean that the holder of
the right is required to enforce it against anyone else.   Go ahead, copy
this message as much as you like without my permission - I won't be coming
after you.

The laws here aren't ones that are forcing anyone into any action wrt
the DNS zone files (unlike perhaps whois data), nothing in them is
compelling you to restrict access to the zone file.

The rationale for this can't rationally be to protect the domain name
owners from having their data found - the DNS data (particularly this
kind of DNS data - delegations in upper level domains) is publicly
available, it has to be to work.  The data can be found anyway.

The only thing that NSEC is making easier is extracting a more complete
list of what is in the domain (if not necessarily a perfect one), more
quickly than without NSEC.    That difference cannot really make any
difference to anyone who is registering a name - whether they get "found"
in an hour, or a week, cannot be of any material difference.

What's left is the desires of the TLD (or similar) operator themselves,
and how they want to handle this data.

Is there any compelling reason that can be offered as to just why it is
so important to you as a TLD operator to prevent zone enumeration?
Anything compelling enough that this WG should go back and start making
changes (and perhaps even worse, adding options - just about the last thing
the DNS needs now are even more different ways to do things).

Please don't tell me "our stakeholders demand it" - like Ted Hardie,
mention of "stakeholders" in a context like that drives me insane.   If
your stakeholders (whatever that means) have good reasons, just tell me
the reasons.   If they don't, then they're irrelevant to me, and should be
to you as well.

kre

---

From: [email-masked]
Date: Sat, 29 May 2004 22:18:42 +1200

[ Moderators note: Post by non-subscriber.  With the massive amount of
   spam, it is easy to miss and therefore delete relevant posts 
   by non-subsrcibers. Please fix your subscription addresses. ]

>the reasons.   If they don't, then they're irrelevant to me, and should be

The reason in NZ is basically abuse.  If a registry provided a full list
of domains (or a means of obtaining one without strict conditions), one
can pretty much guarantee that within a short space of time that list
will be used (at a minimum) to construct a spam list either using
harvested whois data and/or guessed mailbox names.  

Such behaviour in the past has caused astonishing amounts of outrage,
hence NZ's current policy.  

For NZ, the immediate positive impact of implementing DNSSECbis is, in
the absence of wide-scale awareness and deployment, and the absence of a
signed root, is basically nothing, beyond the feel-good factor of being
on the leading edge.  That "nothing" should become "something"
eventually, but over a timescale of years.

The negative impact is the immediate availability of a full list of
current names for spam and other forms of abuse, something that is
likely to be highly unpopular among those with an interest in NZ DNS
policy.

That makes being an early adopter of DNSSEC a difficult sell unless the
zone walking issue is addressed.  That's on top of more technical issues
such as the additional time and resources required to sign large registry
zones.

I can't say I like the word "stakeholder" very much either, but in this
case the "stakeholders" are the ones paying the piper, and a registry
ignores them at its peril.  I speak from bitter experience on this.

-- don