Subject: [e2md] Regulatory advantage of "unused"

From: Dean Willis <[email-masked]>
Date: Wed, 24 Mar 2010 11:54:21 -0500

While explaining his concerns yesterday, Jon mentioned that one of the
worries about "unused" is that it might contribute to "site finder"
activity. As I understand it, a "helpful" service provider might, after
handling a query that returns "unused", decide to return to the user an
alternate target, perhaps to a competitor or something. We see this
behavior a lot when looking for web sites.

The worry is that if the operator KNOWS the number is "unused" that
they'll feel even more justified in returning something else.

However, Ray noted in our followup discussion that "unused" also
provides a regulatory point. Since this is real "carrier provisioned"
data, local regulators could reasonably forbid altering it ala "site
finder" and mandate that the "unused" record be returned to the querying
node.

This might well slant the discussion for "unused" towards having it
standardized in the IETF.

Opinions, please....

--
Dean

---

From: Lawrence Conroy <[email-masked]>
Date: Wed, 24 Mar 2010 17:10:33 +0000

Hi Dean, folks,
 Um .. when we originally did Unused née Void, the plan was to provide a hint that there was no one home, so don't even try. This is the internet equivalent of a tri-tone. That hasn't changed.

Now, it is possible for a comms service provider to send folk off to another destination if it gets back the reason code equivalent to tri-tone, but I had not realised that this was a problem in the real world.
You could say exactly the same about getting back 486 busy in the SIP, or only an H.323 URL from ENUM.

Thus I still don't understand the problem.
What are we going to do -- set the protocol police on such a wonky carrier that randomly re-directs calls?

atb,  Lawrence

On 24 Mar 2010, at 16:54, Dean Willis wrote:

> _______________________________________________
> e2md mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/e2md

---

From: "Richard Shockey" <[email-masked]>
Date: Wed, 24 Mar 2010 13:12:27 -0400

IT certainly depends on whether the usage is in closed networks or the Open
DNS but the determination of that IMHO is more governed by NRA
considerations. In closed environments this is a very straight forward use
case.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dean
Willis
Sent: Wednesday, March 24, 2010 12:54 PM
To: E.164 To MetaData BOF discussion list
Subject: [e2md] Regulatory advantage of "unused"

Opinions, please....

---

From: Jim Reid <[email-masked]>
Date: Wed, 24 Mar 2010 17:16:29 +0000

> they'll feel even more justified in returning something else.

Dean, I don't understand what point you're trying to make here. If an  
operator is minded to do Bad/Evil Things by making the DNS tell lies,  
they don't need the unused servicetype for that. The Sitefinder fiasco  
that you alluded to arose from improper use of wildcarding. No NAPTRs  
were harmed in that incident. And lots of ISPs are doing on-the-fly  
NXDOMAIN rewriting to redirect customers to a landing page: there was  
even an I-D about that.

IMO it's the IETF's job to document good and bad practices here and  
then leave it up to regulators to figure out how to enforce good  
behaviour and punish those who misbehave.

---

From: Dean Willis <[email-masked]>
Date: Wed, 24 Mar 2010 12:18:03 -0500

> What are we going to do -- set the protocol police on such a wonky carrier that randomly re-directs calls?

Well, the suggestion from Ray, as I understand it, is that "unused"
actually makes it easier to set the protocol police (the national
regulator) on the wonky carrier, because failing to return an existing
"unused" record is far more evidently wonky than is returning a
helpfully-synthesized response to a query that produced no result.

So, it's one thing for a carrier to guess that you misdialed and
helpfully point you in the right direction if your query got no result,
and something else entirely for that same carrier to divert you when
your target appears to be legitimate but "unused".

Please check out the history:

http://en.wikipedia.org/wiki/Site_Finder

--
Dean

---

From: [email-masked]
Date: Wed, 24 Mar 2010 09:18:04 -0800

> finder" and mandate that the "unused" record be returned to the querying

In any event, I simply can't see Jon's hypothetical misuse of "unused" 
being permitted under any regulatory régime - OFCOM I'm sure would throw a 
complete wobbly if BT tried to trap all your NUs and redirect you to some 
"helpful" DQ service instead.

The likes of Sitefinder and other "wildcard" redirect services only exist 
because there's no equivalent regulation in the internet.

Ray

---

From: Dean Willis <[email-masked]>
Date: Wed, 24 Mar 2010 12:23:27 -0500

Jim Reid wrote:
> 
> Dean, I don't understand what point you're trying to make here. 

It's Jon's and Ray's points I'm trying to relate.

> If an

In practice, Sitefinder type things don't really require a wildcard;
instead they rely on a namerserver that synthesizes records on the fly
when it doesn't find a real record to report. They're aren't really
trying to be "evil", but to be helpful. The people running these things
think of them as value-added services.

The question is: are these name servers more likely to synthesize a
potentially misleading result when a query returns "unused" or when it
returns no records? Or does it make no difference at all in either case?

> IMO it's the IETF's job to document good and bad practices here and then
> leave it up to regulators to figure out how to enforce good behaviour
> and punish those who misbehave.

Giving the regulators an easy way to tell right from wrong might be helpful.

--
dean

---

From: Dean Willis <[email-masked]>
Date: Wed, 24 Mar 2010 12:25:49 -0500

[email-masked] wrote:
> being permitted under any regulatory régime - OFCOM I'm sure would throw
> a complete wobbly if BT tried to trap all your NUs and redirect you to
> some "helpful" DQ service instead.

I've stayed in any number of hotels where the local ISP redirected
failed HTTP URLs towards "local interest" alternatives based in keyword
matches. Do we want them doing this with phone numbers?

--
Dean

---

From: Hadriel Kaplan <[email-masked]>
Date: Wed, 24 Mar 2010 13:31:50 -0400

Not that I agree with him (I don't), but I think the concern is that if I put in an unused entry for 12345 in the public DNS, then evil-provider *knows* it can redirect it to advertisement, or a 411 service, or whatever.  Because it knows the number hasn't been handed out (or no longer is) to a real user.  Whereas if there's no key/record at all, then all it knows is it's not in that database, but may be a real number in the PSTN or whatever.
Maybe.  I dunno, I think it's a bogus concern as well.

-hadriel

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Jim Reid
> Sent: Wednesday, March 24, 2010 1:16 PM
> To: Dean Willis
> Cc: E.164 To MetaData BOF discussion list
> Subject: Re: [e2md] Regulatory advantage of "unused"
>

---

From: Dean Willis <[email-masked]>
Date: Wed, 24 Mar 2010 12:39:23 -0500

Hadriel Kaplan wrote:
> Not that I agree with him (I don't), but I think the concern is that
> if I put in an unused entry for 12345 in the public DNS, then
> evil-provider *knows* it can redirect it to advertisement, or a 411
> service, or whatever.  Because it knows the number hasn't been handed
> out (or no longer is) to a real user.  Whereas if there's no
> key/record at all, then all it knows is it's not in that database,
> but may be a real number in the PSTN or whatever.

Yes, I think that's it. I should add: Hadriel was around for the talk
with Jon too. But he conned me into sitting in the lumpy chair, so I
forgot about him...

--
Dean

---

From: Jay Daley <[email-masked]>
Date: Thu, 25 Mar 2010 08:13:41 +1300

Dean

> returns no records? Or does it make no difference at all in either case?

This is complete FUD.  There is no problem here, move on.

Jay

-- 
Jay Daley
Chief Executive
.nz Registry Services (New Zealand Domain Name Registry Limited)
desk: +64 4 931 6977
mobile: +64 21 678840

---

From: Jim Reid <[email-masked]>
Date: Wed, 24 Mar 2010 19:56:23 +0000

> It's Jon's and Ray's points I'm trying to relate.

It doesn't matter whose points you're channelling Dean. I still don't  
understand them or why they might be relevant. Just about anything on  
the interweb can be used for Bad Things, so why the unused/void  
servicetype gets singled out in this way is beyond me. I don't hear  
the Protocol Police cracking down on SMTP or SIP (to randomly pick two  
protocols) because they can be exploited by naughty people for  
unpleasant things.

> Giving the regulators an easy way to tell right from wrong might be  

I agree. A "DNS redirection considered harmful" RFC would be a useful  
part of that advice.