Subject: [weirds] fyi: WHOIS Policy Review Team Final Report

From: =JeffH <[email-masked]>
Date: Wed, 16 May 2012 10:40:53 -0700

http://www.icann.org/en/news/announcements/announcement-11may12-en.htm

WHOIS Policy Review Team Final Report

11 May 2012
Forum Announcement:	Comment Period Opens on	Date:	11 May 2012

Categories/Tags:	Reviews/Improvements
                         WHOIS Policy
                         Transparency/Accountability

Purpose (Brief):	
   The WHOIS Policy Review Team, constituted under ICANN's Affirmation of
   Commitments (AoC) agreement with the U.S. Department of Commerce, submitted
   its Final Report and Recommendations [PDF, 1.44 MB] to the ICANN Board and
   this document has been posted for public comment.

Public Comment Box Link:	
<http://www.icann.org/en/news/public-comment/whois-rt-final-report-11may12-en.htm>

---

From: "John Levine" <[email-masked]>
Date: 17 May 2012 01:33:57 -0000

This is a surprisingly good report.  I'd encourage people to read it,
at least the first section which summarizes the recommendations, and
send a comment to ICANN.

R's,
John

---

From: Wendy Seltzer <[email-masked]>
Date: Thu, 17 May 2012 04:23:20 -0400

> at least the first section which summarizes the recommendations, and

And I think it's an absurd report, with disproportionate emphasis on
WHOIS accuracy and proposed mandates, and insufficient attention to
privacy concerns.  Good thing we're not ICANN.

--Wendy

> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds

-- 
Wendy Seltzer -- [email-masked] +1 617.863.0613
Fellow, Yale Law School Information Society Project
Fellow, Berkman Center for Internet & Society at Harvard University
http://wendy.seltzer.org/
https://www.chillingeffects.org/
https://www.torproject.org/
http://www.freedom-to-tinker.com/

---

From: Patrick Vande Walle <[email-masked]>
Date: Thu, 17 May 2012 14:36:56 +0200

> privacy concerns.  Good thing we're not ICANN.

Wendy,

While  I largely concur with your vision of this report, I point out
that privacy is  mostly a matter of policy, and not standards. Hence,
the discussion on privacy on this list will be limited.

It is important to make sure that whatever standard this group will
produce will not prevent the use of an authentication framework with
different classes of users. 

My personal view is that this group also needs to come up with a clear
set of mandatory guidelines as to the implementation of such a
framework. Something that goes beyond simply saying "use HTTP AUTH". 
Would that be auth-basic, auth-digest, certificate based ?   If Iwere to
write a software client, or a Perl library to query this new system, I
would expect all queried registries to behave the same way.   If
registries are left to  implement authentication frameworks whichever
way they want,  that would be a lost opportunity to remedy the current
cacophony.

Patrick

---

From: Avri Doria <[email-masked]>
Date: Thu, 17 May 2012 14:43:12 +0200

+1 to both Wendy's and Patrick's comments.

While an issue may be a policy issue, the technical solutions should accommodate a wide range of policy alternatives.

Definitely interested on working on the definition of that framework.

avri

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 17 May 2012 09:40:32 -0400

On Thu, May 17, 2012 at 01:33:57AM -0000, John Levine wrote:
> This is a surprisingly good report.

It's interesting you say that.  I had exactly the opposite reaction.
There are problems both large and small.  The executive summary has a
bad definition of what a domain name is.  The report makes a number of
preposterous recommendations, like that ICANN should, for some reason,
start chasing all referrals in whois (because, apparently, people
don't know how to use whois and this will magically enable them to do
so), and attempts to extent ICANN's regulatory reach into areas where
it has no business (and where it will fail anyway).  It gets its
history wrong, and just ignores IRIS.  It makes the distinction among
the service, protocol, and data but does not attend to that
distinction throughout.  It points out, but offers no suggestions for
resolving, the basic inconsistency in what different communities want
from the registration data service.  Finally, it simply refuses to
engage with the question of whether the very limitations of the
protocol are a fundamental part of the problem.

The latter is the most serious issue, in my opinion, because it leads
them to make recommendations that are just as unrealistic as the last
five times ICANN has blathered on about whois.  Fixing the protocol
limitations is simply a necessary condition for doing anything about
all the rest of it.  I sent them a public comment pointing this out
after they posted their draft report (I also sent them private mail
pointing out the number of technical errors in the report, most of
which they appear to have left alone.  One sometimes gets the feeling
that ICANN committees just don't care about technical precision, and
this report doesn't help dispel that feeling).

I think the report is a shame.  It has taken several years and not
insignificant money to say a bunch of commonplaces, yet the report
doesn't really help do anything about the two most serious problems
with registration data: the protocols we have are poorly adapted to
serving the needs we have, and the set of needs we have is in any case
an internally inconsistent set.  The first is a technical issue, and
we here are in a position to do something about it if only we
understand what problems we need to solve.  The second is a basic
problem of public policy, in which different actors want vastly
different things from the same service.  One might have hoped that the
report would have provided a framework for figuring out how to make
those compromises, but it doesn't.

> I'd encourage people to read it,

On this we agree.

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: "Smith, Bill" <[email-masked]>
Date: Thu, 17 May 2012 15:32:56 +0000

Thanks all for your comments on the WHOIS report. I've taken the liberty
of forwarding a link to the WEIRDS ARCHIVE TO THE WHOIS Review Team. While
our work is officially (from an ICANN perspective) completed, most if not
all of us maintain an interest in and commitment to improving WHOIS
(protocol, data, and service).

While I can't speak for the team, your thoughtful comments are
appreciated. I will note that the Report is now in the hands of the ICANN
Board and additional comments may be submitted at
http://www.icann.org/en/news/public-comment/whois-rt-final-report-11may12-e
n.htm.

---

From: Eric Brunner-Williams <[email-masked]>
Date: Thu, 17 May 2012 11:55:58 -0400

> It's interesting you say that.  I had exactly the opposite reaction.

agree. and on just about every prior whois foodfight i've participated
in as a we-might-be-able-to-work-a-constructive-compromise participant.

turning to another claim ...

> ... I point out that privacy is mostly a matter of policy, and not standards...

there is data collection. the syntax and semantics are the subject of
specification(s).

there is data retention, data purposing, and data redistribution.
again, the syntax and semantics are the subject of specification(s).

there is data publication, access generally, ignoring the out-of-band
mechanism(s) above ("retention, purpose & redistribution"). again, the
syntax and semantics are the subject of specification(s).

> Hence, the discussion on privacy on this list will be limited.

persons who don't know what they are talking about will attempt to
limit the work of others to specify service primitives, arguing that a
primitive is a policy, and so out of scope.

i didn't bother to comment on ray's earlier observation that something
likely to be mechanism is mere policy, as among collaborative peers
the views will eventually be improved and shared.

here i bother as neither wendy nor patrick are, in my view,
technically competent contributors. least that seem to depreciate the
contributions of less technically competent contributors, i point out
that the not terribly useful binary valued "publish/don't-publish"
toggle to epp was added at the insistence of the then-current chair of
the ietf, who simply didn't understand the problem domain.

-e

---

From: SM <[email-masked]>
Date: Thu, 17 May 2012 10:05:55 -0700

Hi Wendy,
>privacy concerns.  Good thing we're not ICANN.

There was a presentation about privacy in SAAG.  Privacy tends to be 
a complex to resolve from a technical perspective due to lack of 
input about that aspect during the design of a protocol.

Regards,
-sm