Subject: [Ietf-not43] Comments on CRISP Requirements draft-06 and CRIS P Internet Resour ce Number Requirements draft-00

From: rlehning at smimetlaw.com (Ryan Lehning)
Date: Wed Nov 12 10:48:36 2003

Vittorio,

I really do appreciate the comments.  Rick's comments, "please define
accuracy. . .where are methods to be kept," etc. are equally relevant to
3.2.8.1 because that subsection says that the protocol has to be able to
return a result indicating a denial of access based on lack of authorization
or privacy contraints.  It doesn't specify what the authorization rules
would be or what the privacy constraints are.  

As to the second question, why is any work being done on CRISP now, before
the policy making process is complete?  Based on your suggestion, shouldn't
we therefore wait until all of the policy choices are made before specifying
any technical requirements?

As to your last question, I'm not quite sure what you mean.  Do you mean
that registrars are submitting false data to registries? (which in turn are
accessed via Whois queries of the registry)  They may be if the registrant
is not giving reigstrars correct information.  What I think you're asking is
this:  Is the registrar data element false when users query the registry for
Whois information?  It may be.  For example, if a registration is being
transferred, depending on where in the transfer process it is, a Whois query
may return false registrar information.  If a user follows your suggestion
and asks a registrar to provide registrant contact information, the
registrar may refuse or the registrar may refer the user to Whois which may
be inaccurate for the reason stated above.

Thanks,

Ryan      

-----Original Message-----
From: Vittorio Bertola [mailto:[email-masked]]
Sent: Wednesday, November 12, 2003 10:08 AM
To: Ryan Lehning
Cc: [email-masked]'
Subject: Re: [Ietf-not43] Comments on CRISP Requirements draft-06 and
CRIS P Internet Resour ce Number Requirements draft-00

Ryan Lehning ha scritto:
> Rick,
> 
> Thanks for the prompt response.  It strikes me that your comments are
> equally relevant to the Data Omission Protocol Requirement (3.2.8.1).

Sorry - don't want to flood you with comments - but which of his 
comments, and how?

I disagree with your statement. That paragraph does not define any 
country-dependant mechanism, does not refer to undefined concepts such 
as "accuracy", nor it requires the creation of a new set of reference 
values.

Furthermore, that paragraph deals with the situation where the protocol 
is not able to return the values it is built to return, because of 
policy constraints; the protocol needs to be able to cope with this 
situation, or, simply, it won't work. But that paragraph does not 
require the protocol to start supporting new data elements or extend it 
over its original purpose.

As for ICANN's SECSAC recommendation, as you possibly know, ICANN has 
just started a policy making process to deal with that and other 
recommendations, and to verify the consensus on whether Whois contact 
data elements should be changed and how. So before talking about extra 
items to be communicated by the protocol, I think it would be wiser to 
wait for that process to finish. It will not take long.

Then (replying to your other message):

> Finally, your solution, "if you need to know more, you might simply obtain
> the registrant and registrar contacts and then ask them directly," will
not
> work if the data is phony.  

Do you mean that registries return fake *registrar* information?

Thanks,
-- 
.oOo.oOo.oOo.oOo vb.
Vittorio Bertola - vb [a] bertola.eu.org
http://bertola.eu.org/    <-- Vecchio sito, nuovo toblog!

---

From: vb at bertola.eu.org (Vittorio Bertola)
Date: Wed Nov 12 12:35:07 2003

Ryan Lehning ha scritto:
> Vittorio,
> 
> I really do appreciate the comments.  

So do I. However, I'm quite a newbie on this list, so please anyone tell 
me if I'm going off topic. It's easy to move from technical issues to 
policy issues in a discussion like this, and only the former are 
appropriate on this list.

 > Rick's comments, "please define

Pardon me, I still don't get it. Your proposal says that the protocol 
should mark certain data as "verified as accurate", but does not define 
what "accurate" means. If the two people on the two ends of the wire 
define "accurate" in different ways, you will fail to ensure 
interoperability, and you will cause confusion. On the other hand, if 
you say "these data are being denied due to privacy constraints", it is 
just the server that speaks to the author of the query. There's no 
possible misunderstanding, as "privacy constraints do not allow me to 
reply" is a judgement to be made on one side of the connection only.

Unless what you mean is that "verified as accurate" in your proposal 
means "verified as accurate according to the registrar", which is a 
tautology, since the registrar will never purposedly give you data that 
are not the most updated ones it has (will it?).

> any technical requirements?

IMHO, that could be a good idea; work on CRISP has already taken a long 
time. Before making more modifications, I would wait to be sure that 
these would be the last and final ones. At least, this is what I advice 
as an engineer, when a customer comes to me to ask for a last minute 
feature addition, but I figure out that other people from his company 
are still discussing the matter, and more last minute change requests 
may come later.

It's better for everyone if the policy people agree on what needs to be 
done once for all, and then the specs are changed only once more, rather 
than twice or three or four times more.

> Whois information?  

Right.

 > It may be.  For example, if a registration is being
> may return false registrar information.

Ok, but I am sure that this regards a very small number of domain names, 
and you can get who the correct registrar is from the other registrar. 
Or perhaps you should have a "verified as accurate" marker on the 
registrar information too? :-)

> If a user follows your suggestion

Sorry, but if the registrar refuses to tell you privately who the 
registrant actually is, then why do you expect it to tell everyone 
publicly through its CRISP server?

Thanks,