Subject: [weirds] Security Requirements: Availability

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 15 Oct 2012 13:41:59 +0000

There's a general DDoS security consideration that will need to be addressed. We can probably include a normative reference to RFC 4732 to address that issue.

I'm not aware of more specific availability requirements. Are there any?

Scott

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 15 Oct 2012 13:57:06 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Hollenbeck, Scott
> Sent: Monday, October 15, 2012 9:42 AM
> To: [email-masked]'
> Subject: [weirds] Security Requirements: Availability
> 
> There's a general DDoS security consideration that will need to be
> addressed. We can probably include a normative reference to RFC 4732 to
> address that issue.
> 

I should note that the "Inventory of WHOIS Service Requirements Final Report" describes a need for abuse contacts. That need can be translated into a "RDAP MUST provide the ability to manage abuse contacts" (feel free to suggest alternate text) requirement.

Scott

---

From: Andy Newton <[email-masked]>
Date: Thu, 18 Oct 2012 17:27:39 +0000

On 10/15/12 9:57 AM, "Hollenbeck, Scott" <[email-masked]> wrote:
>
>I should note that the "Inventory of WHOIS Service Requirements Final
>Report" describes a need for abuse contacts. That need can be translated
>into a "RDAP MUST provide the ability to manage abuse contacts" (feel
>free to suggest alternate text) requirement.

Manage? I could go with view, display, expose, etcŠ, but not manage.

-andy

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 18 Oct 2012 17:49:49 +0000

> From: Andy Newton [mailto:[email-masked]]
> Sent: Thursday, October 18, 2012 1:28 PM
> To: Hollenbeck, Scott; [email-masked]'
> Subject: Re: [weirds] Security Requirements: Availability
> 
> >Report" describes a need for abuse contacts. That need can be
> >translated into a "RDAP MUST provide the ability to manage abuse
> >contacts" (feel free to suggest alternate text) requirement.
> 
> 

Agreed, bad choice of word. Thanks for the feedback.

Scott

---

From: Peter Koch <[email-masked]>
Date: Mon, 22 Oct 2012 16:49:05 +0200

> I should note that the "Inventory of WHOIS Service Requirements Final Report" describes a need for abuse contacts. That need can be translated into a "RDAP MUST provide the ability to manage abuse…

I am not sure I understand: is this a protocol or an operational requirement?
And the presence or absence of certain records or attributes really
looks like a policy requirement - unless this was meant to say that
even under worst conditions the server was supposed to provide
abuse information. That again would be an operational requirement.
Also, my Karthago, this is _but one_ list of requirements that may not
apply here.

-Peter

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 22 Oct 2012 15:13:04 +0000

> Behalf Of Peter Koch
> Sent: Monday, October 22, 2012 10:49 AM
> To: [email-masked]
> even under worst conditions the server was supposed to provide abuse
> information. That again would be an operational requirement.

My take: it's an operational requirement that has an implied protocol requirement. I think the protocol requirement is that there MUST be a way to ask for and deliver information about different types of contacts.

Scott

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 28 Oct 2012 02:18:43 -0700

> My take: it's an operational requirement that has an implied protocol requirement. I think the protocol requirement is that there MUST be a way to ask for and deliver information about different ty…

I don't think I've ever seen a requirement that involves being able to
request that the reply contain specific fields, or even specific
fields and no others.  I suppose I've been imagining a port 43 analog,
i.e., "tell me everything you know and are willing to tell me about X"
which will hopefully contain the field(s) desired.  The current query
document doesn't seem to support anything more specific, although I
admit recently I've only skimmed it.

Is this something into which we need to dive deeper, or am I just
making more work here?

-MSK

---

From: Arturo Servin <[email-masked]>
Date: Sun, 28 Oct 2012 07:37:07 -0200

I think we discussed we did. Not sure if it was in Vancouver, during
the BoFs or in the list but we did.

	So far today we have not done because the protocol is unable, but I
guess there is interest for a feature that can produce two (or more)
sets of information depending of the user credentials. What information
to deliver to the set of users if a matter of policy, but my opinion is
that we should provide the mechanism.

Regards,
as

On 28/10/2012 07:18, Murray S. Kucherawy wrote:
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 28 Oct 2012 02:41:57 -0700

> that we should provide the mechanism.

I'm talking about the ability to ask a different/specific question,
not the ability of a server to give a different answer based on who
asked.  The latter is clearly in scope already.

-MSK

---

From: Arturo Servin <[email-masked]>
Date: Sun, 28 Oct 2012 09:17:10 -0200

Understood now.

Regards,
as