Subject: [weirds] ICANN 45 report

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 19 Oct 2012 03:57:14 -0400

Colleagues,

I attended part of the ICANN 45 conference in Toronto this week.  I
was asked by a couple of staffers to come and give an update on the
progress of WEIRDS and answer some questions that various
constituencies had.  This is a quick report mostly for your
information; I don't think we have any immediate action items here,
but we might want to chat about some of what I heard.

In general, this is a topic of big interest among the various
constituencies.  On Tuesday I gave the same brief update presentation
to the ccTLD, registry, registrar, and ISP constituencies.  The
questions they had were:

1) One ccTLD participant brought up the "Why should we bother?"
argument.  Basically, there's a cost for them to provide the service
and very little immediate benefit.  I made it clear that in my role as
a working group co-chair and participant, there's nothing we're
bringing to the table that can or should compel anyone to implement
it; we're simply interested in describing the format of the question
and the format of the answer.  ICANN has no policy control over ccTLDs
either, so there's no pressure there.  I hinted, rather, that the
impetus to implement may well come from the community; a security
vendor, for example, who relies on the availability of WHOIS data to
make a determination about the source of some traffic may well
conclude that the non-availability of WHOIS service about that source
is an indication that those sources aren't good net citizens and
perhaps have something to hide, and default to a defensive posture,
which would leave those sources very unhappy.  Unfortunately I don't
believe that point was heeded.

2) The ISP constituency asked whether we intend to support thick and
thin WHOIS services equally.  The protocol we're designing, per my
recollection, is actually agnostic on this point; it could serve both
equally.

3) Several times the question of policy came up.  I made it clear that
our work would simply enable policies at the discretion of the
operator, and not enforce any particular policy.  They all seemed to
like that.

4) During the registrar session they asked about timing between ICANN
beginning to discuss contractual language around WEIRDS adoption
versus our timelines.  I told them what our proposed new milestones
list looks like and also told them they could perhaps declare some of
our drafts as "core" and mandatory for immediate adoption while
waiting for others as later optional add-ons.

On Wednesday there was a more general session.  Some of the points raised there:

5) Recent ICANN reports and statements include some requirements
they've established of which WEIRDS may not be aware.  I invited them
to bring these to our attention (it would've been nice, of course, for
this to have happened during our chartering process) specifically for
consideration, though with no promise that any of them would be
adopted.  That is, I would prefer to have it on the record that we
discussed and rejected them rather than not discussing them at all.
The two I recall in particular were support for WHOWAS (queryable
historical data about domain registrations) and some kind of
certification of the validity of the returned data.  This latter one
might be a consideration for the security document.

6) ICANN is proposing to support open source development of WEIRDS
client and server code to encourage adoption.  That may or may not be
possible to start before the WG concludes, but we should commit to
supporting that work as well.

7) ICANN has commissioned some deep statistical studies about who's
using WHOIS data and how today.  When the report is published, we
should take a look at it to see if there's anything in there we need
to take as input to our work.  At the same time, they were unaware of
the WHOIS data inventory work being undertaken by a subset of WEIRDS,
and that might be information they would find useful as well.

Let me know if anyone has questions about these points.  Also, any of
you that attended these sessions and have other feedback to relay,
please feel free to do so.

-MSK

---

From: SM <[email-masked]>
Date: Fri, 19 Oct 2012 02:01:49 -0700

Hi Murray,

Thanks for the report.

>supporting that work as well.

The RFP for the above was issued in May 2012.  It's not like this is 
some new initiative.  It would be highly unusual for an IETF working 
group to commit to support the above.

>7) ICANN has commissioned some deep statistical studies about who's

That may be related to the survey where it is explained that "for the 
non-technical think about DOS commands before Windows became 
available".  That does not sound like deep statistical studies to me.

>and that might be information they would find useful as well.

I read the above as meaning that ICANN is not aware of the Whois data 
inventory work which was discussed on the mailing list.  That's odd 
given that there have been some ICANN folks posting to the mailing list.

Regards,
-sm

---

From: Andy Newton <[email-masked]>
Date: Fri, 19 Oct 2012 11:37:25 +0000

On 10/19/12 3:57 AM, "Murray S. Kucherawy" <[email-masked]> wrote:

>historical data about domain registrations)

We have a WHOWAS service. It is a much different critter than Whois.
Asking for a WHOWAS service is much more than putting a REST interface
atop a Whois server. While such thing is interesting and I don't want to
speak against the desire, the effort can be an order of magnitude greater
than RDAP as it is currently specified. I think this is out of scope.

-andy

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 19 Oct 2012 11:41:42 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Andy Newton
> Sent: Friday, October 19, 2012 7:37 AM
> To: Murray S. Kucherawy; [email-masked]
> Subject: Re: [weirds] ICANN 45 report
> 
> atop a Whois server. While such thing is interesting and I don't want
> to speak against the desire, the effort can be an order of magnitude
> greater than RDAP as it is currently specified. I think this is out of
> scope.

That was my reaction when I heard the question from the audience. It's more than what we're chartered to do.

Scott

---

From: Arturo Servin <[email-masked]>
Date: Fri, 19 Oct 2012 10:15:32 -0200

Thanks for the report.

	I was a bit worried that ICANN (as policy-entity not the people that
work there and have been very helpful in the process) wanted to make and
set protocols around whois. Now it seems very clear that both IETF and
ICANN have a very clear idea of their responsibilities and the scope of
their work.

Cheers,
as

On 19/10/2012 05:57, Murray S. Kucherawy wrote:
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds
>

---

From: Wendy Seltzer <[email-masked]>
Date: Fri, 19 Oct 2012 08:43:15 -0400

On 10/19/2012 03:57 AM, Murray S. Kucherawy wrote:
> certification of the validity of the returned data. 

The second one (or a variant third) I heard was a field/flag for whether
data had been validated.  There's (contested) discussion in ICANN
contract negotiations about requiring data validation or verification
for domain name registration, so it might be desirable to indicate on a
per-record or per-field basis whether data had been validated or
identity verified.

--Wendy

> This latter one

-- 
Wendy Seltzer -- [email-masked] +1 617.863.0613
Fellow, Berkman Center for Internet & Society at Harvard University
Visiting Fellow, Yale Law School Information Society Project
http://wendy.seltzer.org/
https://www.chillingeffects.org/
https://www.torproject.org/
http://www.freedom-to-tinker.com/

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 19 Oct 2012 13:23:25 +0000

> Behalf Of Wendy Seltzer
> Sent: Friday, October 19, 2012 8:43 AM
> To: [email-masked]

How does one "validate" a domain name, name server, or IP address, or is this really about contact information?

Scott

---

From: Don Blumenthal <[email-masked]>
Date: Fri, 19 Oct 2012 09:43:34 -0400

>this really about contact information?

It's the most recent in the eternal Whois accuracy debate, this time
around if and when registrars should check registration contact
information.

Don

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 19 Oct 2012 10:28:13 -0400

> How does one "validate" a domain name, name server, or IP address, or is this really about contact information?

It is of course about contact data, but actually there is a possible
way to use this for IP addresses and name servers: some registries
have a policy of regularly checking delegations for cross-cut matches,
and undertaking administrative steps against registrations that don't
do this according to policy.  The large gTLDs don't, but some ccTLDs
do.

That could perhaps be useful information, becuase sometimes resolution
problems boil down to mistakes at the zone cut.  When troubleshooting,
you'd be able to tell whether the registry thought the delegation data
was correct at some point in the past.  You'd need a "checked on"
attribute for this to be useful.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Arturo Servin <[email-masked]>
Date: Fri, 19 Oct 2012 12:49:32 -0200

Perhaps a new field in the objects on draft-ietf-weirds-json-response, i.e

{
         "handle" : "XXXX",
         "names": [ "Joe Bob, Inc.", "Bobby Joe Shopping" ],
	...
	"validated": [yes],

}

Regards,
as

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 19 Oct 2012 10:54:10 -0400

>          "names": [ "Joe Bob, Inc.", "Bobby Joe Shopping" ],

I'd say valdidated-date or something.  The presence of the field
indicates validation, and the date tells you when.  It's no use to
know that data was validated at some point in the past, if you can't
tell when it happened.  (Having validated my address when I registered
some names would tell you nothing about whether it's right today.)

A

-- 
Andrew Sullivan
[email-masked]

---

From: SM <[email-masked]>
Date: Fri, 19 Oct 2012 07:59:54 -0700

Hi Wendy,
>per-record or per-field basis whether data had been validated or

This might be an optional field.  If it is optional, the choice is 
between saying nothing about it or setting a requirement (re quoted 
text).  Your guess is as good as mine as to whether anyone will 
object to the latter.

Regards,
-sm

---

From: "Smith, Bill" <[email-masked]>
Date: Fri, 19 Oct 2012 15:36:05 +0000

An extensible value for validated might be useful rather than a simple yes no.

---

From: Arturo Servin <[email-masked]>
Date: Fri, 19 Oct 2012 13:49:55 -0200

Fair enough. A date seems to be the most appropriate.

Regards,
as

---

From: "Smith, Bill" <[email-masked]>
Date: Fri, 19 Oct 2012 16:32:31 +0000

Actually I was suggesting something far more extensible.

I am not suggesting that we define the extensions, only that we provide the mechanisms for others to do so. We should not prescribe the information required for those mechanisms, but rather the means to provide that information in a form that can be consumed/used by others.

Date might be one of the (simple) mechanisms offered, and other forms would be left for future development by others.

---

From: "John Levine" <[email-masked]>
Date: 19 Oct 2012 23:15:31 -0000

>Actually I was suggesting something far more extensible.

It seems to me vanishingly unlikely that we will ever get registries
and registrars to give us more than a validation date.  But if you
think something more complex would be useful, how about writing up
some examples and use cases?

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 19 Oct 2012 16:57:38 -0700

On Fri, Oct 19, 2012 at 2:01 AM, SM <[email-masked]> wrote:
> The RFP for the above was issued in May 2012.  It's not like this is some
> new initiative.  It would be highly unusual for an IETF working group to
> commit to support the above.

Why do you say that?  I've been part of several working groups where
implementations are done by participants, and the development of the
specification was influenced by the evolution of the implementations
and vice versa.  That's the kind of thing I have in mind.

> non-technical think about DOS commands before Windows became available".
> That does not sound like deep statistical studies to me.

That wasn't the nature of the study.  When the preliminary version
gets published (very soon, they said), I'll post a link to it here.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 19 Oct 2012 16:59:22 -0700

> than RDAP as it is currently specified. I think this is out of scope.

I tend to agree, though if by accident we happen to come up with
something easily extended to a WHOWAS sort of thing, that would be
dandy.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 19 Oct 2012 17:00:44 -0700

> How does one "validate" a domain name, name server, or IP address, or is this really about contact information?

I had the same question at first but it looks like that's been
clarified here.  I suggest that in our reply definition we include a
very precise explanation of what "validate" means in this context.

-MSK

---

From: "John Levine" <[email-masked]>
Date: 20 Oct 2012 10:07:08 -0000

>and vice versa.  That's the kind of thing I have in mind.

The RFP said that the contractor would follow WEIRDS and implement
whatever we come up with.  I know that more than one of the groups
that submitted proposals are active here, so it would certainly be
nice to get feedback about implmentation issues, but I don't see that
we need to do anything special about it.  If implementers, ICANN or
otherwise, run into snags, they (we?) can just say something.

By the way, has anyone heard whether ICANN picked a contractor and
if so who it is?  The bids closed months ago.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 20 Oct 2012 10:15:58 -0000

>> How does one "validate" a domain name, name server, or IP address, or
>is this really about contact information?
>

The problem is that it can mean a very wide variety of things:

* Check that an IP is routed, that an appropriate server answers,
and/or that an appropriate server has the right DNS records for a
delegated domain.

* Check that an alleged phone number is syntactically valid, e.g.,
has the right number of digits and that that prefix digits are
in use.

* Call the phone number and see who answers, either mechanically
by having a robot read off a code that the registrant types into a
web page, or by humans talking to whoever answers.

* Check that an alleged email address is syntactically valid and has
appropriate DNS records, will accept a message, accepts a message and
doesn't bounce, and/or that someone clicks a URL in the message.

* Check that a postal address is valid, in countries where it's
possible to do that.

* Mail something to the postal address with a verification code to
enter.

etc. etc.

I know people who do all these things for various sorts of signup
verifications.  And there are doubtless more that I haven't seen.

We could try and come up with a set of categories, i.e., syntax valid,
semantics valid, contact verified, but it sounds to me like an area
where we don't know what we're doing.  So unless someone offers an
actual implementation of something more than a validation date, I'd
rather not guess.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: "Smith, Bill" <[email-masked]>
Date: Sat, 20 Oct 2012 18:44:27 +0000

Sent from my iPhone

On Oct 20, 2012, at 3:16 AM, "John Levine" <[email-masked]> wrote:

<snip>

> actual implementation of something more than a validation date, I'd

Which is why an extensible mechanism is preferable. An example would be TLS and its ability to support new key and encryption methods.

A small set of defined categories, perhaps one, would be defined along with a mechanism to add others allowing others to extend our work as needs arise. Seems like a desirable, and easy-to-implement feature given TLS and other examples.

---

From: SM <[email-masked]>
Date: Sat, 20 Oct 2012 10:19:55 -0700

Hi Murray,
>and vice versa.  That's the kind of thing I have in mind.

I'm ok with the above.  John Levine said it better than I could.

Regards,
-sm

---

From: "John R Levine" <[email-masked]>
Date: 20 Oct 2012 21:47:04 +0100

> Which is why an extensible mechanism is preferable. An example would be 
> TLS and its ability to support new key and encryption methods.
>
> A small set of defined categories, perhaps one, would be defined along 
> with a mechanism to add others allowing others to extend our work as 
> needs arise. Seems like a desirable, and easy-to-implement feature given 
> TLS and other examples.

Are the extensions per-data type?  Per field?  Global?  Can there be more 
than one verification field per data field?  Do all fields of the same 
time in a record need consistent verification info?

Since you seem to have a clearer idea of how this would work, write it up. 
Then the people who will be publishing the data can see what you have in 
mind and they can say whether there's any likelihood that someone will 
implement it.

Regards,

---

From: "Linlin Zhou" <[email-masked]>
Date: Mon, 22 Oct 2012 10:28:44 +0800

> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Murray S. Kucherawy
> Sent: Friday, October 19, 2012 3:57 PM
> To: [email-masked]
> Subject: [weirds] ICANN 45 report
> 
> Colleagues,
> 
> 7) ICANN has commissioned some deep statistical studies about who's using
> WHOIS data and how today.  When the report is published, we should take a
> look at it to see if there's anything in there we need to take as input to
our work.

It would be nice and I'd like to take a look at it. When it will be
published?

> At the same time, they were unaware of the WHOIS data inventory work being
> undertaken by a subset of WEIRDS, and that might be information they would
> find useful as well.
> 
Share this information here. We've already submitted the
draft-zhou-weirds-dnrd-ap-object-inventory-00(
http://tools.ietf.org/html/draft-zhou-weirds-dnrd-ap-object-inventory-00).

Linlin

---

From: Peter Koch <[email-masked]>
Date: Mon, 22 Oct 2012 10:14:35 +0200

> believe that point was heeded.

the question could have been read as "could you please elaborate
on the problem statement" and that part has not been addressed well
in that very session.  While i applaud the outreach effort in general,
i'm increasingly concerned by the flawed perception that ICANN is _the_
venue for discussing or collecting requirements with critical questions
being responded to just with the hint that 'if you're not under ICANN
contract, we don't force you to implement anything'.

-Peter

---

From: Peter Koch <[email-masked]>
Date: Mon, 22 Oct 2012 10:17:04 +0200

> time in a record need consistent verification info?

ENUM might (not) serve as an example for handling validation.
At least you'd want to know who validated when under what validation policy.
So, there's a registry for validation policies to be defined along
with a validation policy framework. Good luck.

-Peter

---

From: Olaf Kolkman <[email-masked]>
Date: Mon, 22 Oct 2012 12:05:34 +0200

> if so who it is?  The bids closed months ago.

I disclosed NLnet Labs was bidding, we did not win the bid. I am not sure if it is public who won the bid.

In the context of the point brought up earlier, here's a platitude: any running-code experience should be welcomed and taken into account.

--Olaf

NLnet
Labs
Olaf M. Kolkman

www.NLnetLabs.nl
[email-masked]

Science Park 400, 1098 XH Amsterdam, The Netherlands

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 22 Oct 2012 11:08:54 +0000

> Behalf Of Smith, Bill
> Sent: Saturday, October 20, 2012 2:44 PM
> To: John Levine
> Cc: [email-masked]
> Subject: Re: [weirds] validate, was ICANN 45 report
> 
> 
> 
> Sent from my iPhone
> 
> needs arise. Seems like a desirable, and easy-to-implement feature
> given TLS and other examples.

Then would you mind providing appropriate text and JSON examples? I still don't have a good sense of what's really needed here beyond some very vague high-level assertions.

Scott

---

From: Andy Newton <[email-masked]>
Date: Tue, 23 Oct 2012 14:08:31 +0000

On 10/22/12 7:08 AM, "Hollenbeck, Scott" <[email-masked]> wrote:

>Then would you mind providing appropriate text and JSON examples? I still
>don't have a good sense of what's really needed here beyond some very
>vague high-level assertions.

I'm a little lost on the extensibility but we have that anyway. I would
think the standard data model should be a boolean and/or a date and/or a
URI referencing the validation policy.

-andy

---

From: Edward Lewis <[email-masked]>
Date: Wed, 31 Oct 2012 09:10:20 -0400

>	Fair enough. A date seems to be the most appropriate.

A date or "never".

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

2012...time to reuse those 1984 calendars!