Subject: Re: [Last-Call] Last Call: Advancing the Registration Data Access Protocol (RDAP) to Internet Standard

From: John C Klensin <[email-masked]>
Date: Wed, 10 Feb 2021 16:18:18 -0500

Hi.

Questions about this that may bear some discussion (I'm not
necessarily opposed, just think we should be clear)...

The description in the supporting document indicates, as
required, "widespread deployment and successful operational
experience".   While I understand that this has been implemented
for many TLD and address registries and is in use by at least
some of those registries and their customers, RFC 7480, which
appears to be the core document of the collection, says:

"RDAP is a successor protocol to the very old WHOIS protocol."
in the abstract and proceeds to justify the specification of
RDAP in the Introduction and elsewhere in the document.  It is
now nearly seven years since RFC 7480 was published; WHOIS is
almost certainly more in use than ever (just because the
Internet and number of TLDs has grown); and there are continuing
efforts outside the IETF (e.g., in a seemingly-never-ending
sequence of ICANN committees and working groups) to define a
replacement for WHOIS and requirements for its use (at least for
DNS purposes).

So, three questions and a comment, with the understanding that
they may partially apply to 7482bis and 7483bis as well:

(1) While the requirements for Internet Standard do not require
acceptance in the marketplace, I believe the IETF has sometimes
interpreted evidence of the lack of such acceptance --which, at
least in terms of replacing WHOIS for DMS use, appears clear
here-- as an indication that we should not proceed with
advancing the document.  There may be reasons for advancing
these specifications anyway, but would it then be useful to
modify at least 7480 to make the relationships more clear?

(2) More basically, is there consensus in the IETF community
(not just in the regional and TLD registry communities) that
this is the way to go, doing so without any supporting or
explanatory documentation in the RFC Series, noting in
particular that RFC 3912 (the current Whois spec) is already at
Draft Standard and evidently much more widely deployed and used
and that these documents do nothing to deprecate it (the
comments in assorted SSAC reports referenced from RFC 7480 and
many subsequent ICANN reports about its deficiencies
notwithstanding).

(3) If there is actually IETF consensus to advance these two
documents without either updates or supplemental explanations,
could the supporting document in the datatracker, be updated to
reflect discussion and decisions related to the above issues
rather than simply asserting that "the RFC 6410 requirements...
have been met" which, given at least the Whois question, may be
a bit misleading even if that was not intended?

(4) Finally, if the intention of moving these documents to
Internet Standard at this time is, even partially, to act as a
forcing function for getting rid of WHOIS, can that please be
explicit rather than having people asking "why now" questions.
>From my perspective, if it is just a matter of an outgoing AD
trying to clean up as many loose end as possible, I have no
problem with that, but it would be good to be clear.

   thanks,
      john

--On Wednesday, February 10, 2021 11:46 -0800 The IESG
<[email-masked]> wrote:

> 
> The IESG has received a request from the REGEXT working group
> to make the following status changes:
> 
> - RFC7480 from Proposed Standard to Internet Standard
>     (HTTP Usage in the Registration Data Access Protocol
> (RDAP))
> 
> - RFC璁RFC  from Proposed Standard to Internet Standard
>     (Security Services for the Registration Data Access
> Protocol (RDAP))
> 
> The supporting document for this request can be found here:
> 
> https://datatracker.ietf.org/doc/status-change-rdap-to-interne
> t-standard/
> 
> The IESG plans to make a decision in the next few weeks, and
> solicits final comments on this action. Please send
> substantive comments to the [email-masked] mailing lists
> by 2021-02-24. Exceptionally, comments may be sent to
> [email-masked] instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
> 
> The affected documents can be obtained via
> https://datatracker.ietf.org/doc/rfc7480/
> https://datatracker.ietf.org/doc/rfc7481/
> 
> IESG discussion of this request can be tracked via
> https://datatracker.ietf.org/doc/status-change-rdap-to-interne
> t-standard/ballot/
> 
> 
> 
> _______________________________________________
> IETF-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-announce

---

From: S Moonesamy <[email-masked]>
Date: Sun, 14 Feb 2021 23:09:20 -0800

Hello,
At 11:46 AM 10-02-2021, The IESG wrote:
>     (HTTP Usage in the Registration Data Access Protocol (RDAP))
>
>- RFC7481 from Proposed Standard to Internet Standard
>     (Security Services for the Registration Data Access Protocol (RDAP))
>
>https://datatracker.ietf.org/doc/status-change-rdap-to-internet-standard/
>
>The IESG plans to make a decision in the next few weeks, and solicits final
>comments on this action. Please send substantive comments to the
>[email-masked] mailing lists by 2021-02-24. Exceptionally, comments may

The announcement is dated 2021-02-10 and the end of the Last Call is 
2021-02-24.  Why is the duration of the Last Call two weeks instead 
of the four weeks required for a reclassification request?

There are currently two protocols for accessing registration data, 
i.e. Whois and RDAP.  Whois is still widely used.  There isn't any 
information in the about the current status of Whois and its 
relationship with the intended Internet Standard.  Is the "widespread 
deployment" about deploying the two protocols deployed side by side?

Regards,
S. Moonesamy

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 15 Feb 2021 14:44:22 +0000

> -----Original Message-----
> From: last-call <[email-masked]> On Behalf Of John C Klensin
> Sent: Wednesday, February 10, 2021 4:18 PM
> To: [email-masked]
> Subject: [EXTERNAL] Re: [Last-Call] Last Call: Advancing the Registration Data
> Access Protocol (RDAP) to Internet Standard
> 
> Caution: This email originated from outside the organization. Do not click links
> or open attachments unless you recognize the sender and know the content
> is safe.
> 
> Hi.
> 
> Questions about this that may bear some discussion (I'm not necessarily
> opposed, just think we should be clear)...
> 
> The description in the supporting document indicates, as required,
> "widespread deployment and successful operational
> for many TLD and address registries and is in use by at least some of those
> registries and their customers, RFC 7480, which appears to be the core
> document of the collection, says:
> 
> in the abstract and proceeds to justify the specification of RDAP in the
> Introduction and elsewhere in the document.  It is now nearly seven years
> since RFC 7480 was published; WHOIS is almost certainly more in use than
> ever (just because the Internet and number of TLDs has grown); and there
> are continuing efforts outside the IETF (e.g., in a seemingly-never-ending
> replacement for WHOIS and requirements for its use (at least for DNS
> purposes).
> 
> So, three questions and a comment, with the understanding that they may
> partially apply to 7482bis and 7483bis as well:
> 
> (1) While the requirements for Internet Standard do not require acceptance
> in the marketplace, I believe the IETF has sometimes interpreted evidence of
> the lack of such acceptance --which, at least in terms of replacing WHOIS for
> DMS use, appears clear
> here-- as an indication that we should not proceed with advancing the
> document.  There may be reasons for advancing these specifications anyway,
> but would it then be useful to modify at least 7480 to make the relationships
> more clear?

WHOIS and RDAP are completely independent, but Section 1 of 7480 already describes some of the issues with WHOIS that prompted the development of RDAP. What else is needed?

> (2) More basically, is there consensus in the IETF community (not just in the
> regional and TLD registry communities) that this is the way to go, doing so
> without any supporting or explanatory documentation in the RFC Series,
> noting in particular that RFC 3912 (the current Whois spec) is already at Draft
> Standard and evidently much more widely deployed and used and that these
> documents do nothing to deprecate it (the comments in assorted SSAC
> reports referenced from RFC 7480 and many subsequent ICANN reports
> about its deficiencies notwithstanding).
> 
> (3) If there is actually IETF consensus to advance these two documents
> without either updates or supplemental explanations, could the supporting
> document in the datatracker, be updated to reflect discussion and decisions
> related to the above issues rather than simply asserting that "the RFC 6410
> requirements...
> have been met" which, given at least the Whois question, may be a bit
> misleading even if that was not intended?
> 
> (4) Finally, if the intention of moving these documents to Internet Standard
> at this time is, even partially, to act as a forcing function for getting rid of
> WHOIS, can that please be explicit rather than having people asking "why
> now" questions.
> trying to clean up as many loose end as possible, I have no problem with that,
> but it would be good to be clear.

I'll leave the consensus questions for the IESG, but the intention of the request to advance the RDAP RFCs to Standard status is NOT to force deprecation of WHOIS. It's about recognizing the implementation and deployment success of RDAP. I imagine that there will need to be a "move WHOIS to Historic status" request at some point in the future if it ever falls into disuse.

Scott

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 15 Feb 2021 14:49:20 +0000

> From: last-call <[email-masked]> On Behalf Of S Moonesamy
> Sent: Monday, February 15, 2021 2:09 AM
> To: [email-masked]
> >The IESG has received a request from the REGEXT working group to make
> >the following status changes:
> >

[snip]

> There are currently two protocols for accessing registration data, i.e. Whois
> and RDAP.  Whois is still widely used.  There isn't any information in the about
> the current status of Whois and its relationship with the intended Internet
> Standard.  Is the "widespread deployment" about deploying the two
> protocols deployed side by side?

WHOIS and RDAP are independent. The RDAP specifications already note that they were created to address the known issues with WHOIS. The "widespread deployment" comment refers to RDAP alone.

Scott

---

From: John C Klensin <[email-masked]>
Date: Mon, 15 Feb 2021 16:43:05 -0500

--On Monday, February 15, 2021 14:44 +0000 "Hollenbeck, Scott"
<[email-masked]> wrote:

>> From: last-call <[email-masked]> On Behalf Of
>> John C Klensin Sent: Wednesday, February 10, 2021 4:18 PM
>> To: [email-masked]
>> Subject: [EXTERNAL] Re: [Last-Call] Last Call: Advancing the
>> Registration Data Access Protocol (RDAP) to Internet Standard
>> 
>> Caution: This email originated from outside the organization.
>> Do not click links or open attachments unless you recognize
>> the sender and know the content is safe.
>> 
>> Hi.
>> 
>> experience".   While I understand that this has been
>> implemented for many TLD and address registries and is in use
>> by at least some of those registries and their customers, RFC
>> 7480, which appears to be the core document of the
>> collection, says:
>> 
>> RDAP in the Introduction and elsewhere in the document.  It
>> is now nearly seven years since RFC 7480 was published; WHOIS
>> is almost certainly more in use than ever (just because the
>> Internet and number of TLDs has grown); and there are
>> continuing efforts outside the IETF (e.g., in a
>> seemingly-never-ending sequence of ICANN committees and
>> working groups) to define a replacement for WHOIS and
>> requirements for its use (at least for DNS purposes).
>> 
>> So, three questions and a comment, with the understanding
>> that they may partially apply to 7482bis and 7483bis as well:
>> 
>> (1) While the requirements for Internet Standard do not
>> require acceptance in the marketplace, I believe the IETF has
>> sometimes interpreted evidence of the lack of such acceptance
>> --which, at least in terms of replacing WHOIS for DMS use,
>> appears clear
> WHOIS and RDAP are completely independent, but Section 1 of
> 7480 already describes some of the issues with WHOIS that
> prompted the development of RDAP. What else is needed?

A reading of 7480, especially in the context of the assertion of
widespread deployment, could lead a reasonable person to expect
that either WHOIS should be gone by now or that an explanation
of why its use has not very significantly decreased.   I can't
make general statements with any confidence but I think we have
often hesitated to move specifications to Internet Standard when
their documentation says that they are intended to solve
specific problems by replacing an earlier protocol when there is
evidence that the marketplace does not agree because that
earlier protocol is still in very active use.. perhaps in even
wider use than the supposed replacement.

So I am suggesting that a review and modification of the
Abstract and Section 1 of 7480 to make clear that, while
replacement/ superceding of WHOIS is progressing much more
slowly than the document and the relevant WG anticipated in
2015, you are still optimistic that it will succeed (as earlier
attempts to supercede WHOIS did not) and why... or that it is
valuable enough to be an Internet Standard regardless of what
happens to/with WHOIS.  At least the former could be done by
issuing a replacement document with adjustments to the relevant
language (my preference I think), by a revised statement
justifying the change in maturity level, or, I suppose (but do
not favor because of the difficulties of finding such things)
the implementation report.  

Whether that is "needed" or not depends on how the community
feels about advancing a document to Internet standard that
contains misleading language about its status.   But I suggest
that a clarification in some form would be desirable.

>...
>> Internet Standard at this time is, even partially, to act as
>> a forcing function for getting rid of WHOIS, can that please
>> be explicit rather than having people asking "why now"
>> questions.
 
> I'll leave the consensus questions for the IESG, but the
> intention of the request to advance the RDAP RFCs to Standard
> status is NOT to force deprecation of WHOIS. It's about
> recognizing the implementation and deployment success of RDAP.
> I imagine that there will need to be a "move WHOIS to Historic
> status" request at some point in the future if it ever falls
> into disuse.

Good about recognizing the implementation and deployment success
of RDAP.  I am just suggesting that 7480 strongly implies an
additional success criterion, one of superceding WHOIS.  That
has been less successful and I believe that the process of
advancing these documents should recognize that particular fact
on the ground.

Again, I don't object to advancing the RDAP specifications; I
just believe that the documentation should be accurate relative
to the facts in evidence.

 best,
   john

---

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Feb 2021 15:52:47 -0500

> of the four weeks required for a reclassification request?

This was my judgment as responsible AD: we normally do 4-week last
calls for individual requests and two-week last calls for documents
coming from working groups.  Why would this be different?

I do see that RFC 6410 specifies four weeks.  If the community thinks
that's necessary here, I will happily extend the last call and let my
successor handle the status change from there.

> deployment" about deploying the two protocols deployed side by side?

We're talking about widespread deployment of RDAP -- this set of
documents doesn't have anything to do with Whois.  While we expect
that Whois may fade away at some point, it clearly hasn't yet and
won't soon, and there's no attempt here to change that.

Barry, ART AD

---

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Feb 2021 15:55:18 -0500

Would it be acceptable to change the text in the status-change
document to clarify the situation with respect to Whois?

It seems unfortunate to re-issue these two RFCs with no substantive
changes, just to say "No, really, this is going to Internet Standard
but Whois is still around and will be for a while, and that doesn't
change."

Barry

On Mon, Feb 15, 2021 at 4:43 PM John C Klensin <[email-masked]> wrote:
> --
> last-call mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/last-call

---

From: John C Klensin <[email-masked]>
Date: Wed, 17 Feb 2021 23:59:45 -0500

> document to clarify the situation with respect to Whois?

Yes.  In my original note, I wrote, as one option "...could be
done by ... [or]  by a revised statement justifying the change
in maturity level".   That would certainly be consistent with
the above.
 
> It seems unfortunate to re-issue these two RFCs with no
> substantive changes, just to say "No, really, this is going to
> Internet Standard but Whois is still around and will be for a
> while, and that doesn't change."

I have to admit to being Old School enough to believe that the
IETF (and its predecessors) were better off when any change to
the text or assertions of a specification, other than obvious
editorial errors, was addressed with a new RFC rather than
assorted comments, statements, notices, errata, and notes
scattered around the web. Perhaps because of that, I read the
requirements for advancing a document unchanged as favoring a
new document in this case (and perhaps interpret "substantive"
differently as a further result).  But I (and others who believe
that way) lost that battle long ago, so elaborating on this in
the status-change document is probably a reasonable approach.

thanks,
   john

>> >> Subject: [EXTERNAL] Re: [Last-Call] Last Call: Advancing
>> >> the Registration Data Access Protocol (RDAP) to Internet
>> >> Standard
>> >> 
>> >> Caution: This email originated from outside the
>> >> organization. Do not click links or open attachments
>> >> unless you recognize the sender and know the content is
>> >> safe.
>> >> 
>> >> Hi.
>> >> 
>> >> implemented for many TLD and address registries and is in
>> >> use by at least some of those registries and their
>> >> customers, RFC 7480, which appears to be the core document
>> >> of the collection, says:
>> >> 
>> >> "RDAP is a successor protocol to the very old WHOIS
>> >> protocol." in the abstract and proceeds to justify the
>> >> specification of RDAP in the Introduction and elsewhere in
>> >> the document.  It is now nearly seven years since RFC 7480
>> >> was published; WHOIS is almost certainly more in use than
>> >> ever (just because the Internet and number of TLDs has
>> >> grown); and there are continuing efforts outside the IETF
>> >> (e.g., in a
>> >> require acceptance in the marketplace, I believe the IETF
>> >> has sometimes interpreted evidence of the lack of such
>> >> acceptance --which, at least in terms of replacing WHOIS
>> >> for DMS use, appears clear
>> A reading of 7480, especially in the context of the assertion
>> of widespread deployment, could lead a reasonable person to
>> expect that either WHOIS should be gone by now or that an
>> explanation of why its use has not very significantly
>> decreased.   I can't make general statements with any
>> confidence but I think we have often hesitated to move
>> specifications to Internet Standard when their documentation
>> says that they are intended to solve specific problems by
>> replacing an earlier protocol when there is evidence that the
>> marketplace does not agree because that earlier protocol is
>> still in very active use.. perhaps in even wider use than the
>> supposed replacement.
>> 
>> 2015, you are still optimistic that it will succeed (as
>> earlier attempts to supercede WHOIS did not) and why... or
>> that it is valuable enough to be an Internet Standard
>> regardless of what happens to/with WHOIS.  At least the
>> former could be done by issuing a replacement document with
>> adjustments to the relevant language (my preference I think),
>> by a revised statement justifying the change in maturity
>> level, or, I suppose (but do not favor because of the
>> difficulties of finding such things) the implementation
>> report.
>> 
>> >> Internet Standard at this time is, even partially, to act
>> >> as a forcing function for getting rid of WHOIS, can that
>> >> please be explicit rather than having people asking "why
>> >> now" questions.
>> > intention of the request to advance the RDAP RFCs to
>> > Standard status is NOT to force deprecation of WHOIS. It's
>> > about recognizing the implementation and deployment success
>> > of RDAP. I imagine that there will need to be a "move WHOIS
>> > to Historic status" request at some point in the future if
>> > it ever falls into disuse.
>> 
>> Good about recognizing the implementation and deployment
>> success of RDAP.  I am just suggesting that 7480 strongly
>> implies an additional success criterion, one of superceding
>> WHOIS.  That has been less successful and I believe that the
>> process of advancing these documents should recognize that
>> particular fact on the ground.
>> 
>> just believe that the documentation should be accurate
>> relative to the facts in evidence.
>> 
>>  best,
>>    john
>> 
>> --
>> last-call mailing list
>> [email-masked]

---

From: John C Klensin <[email-masked]>
Date: Thu, 18 Feb 2021 00:30:57 -0500

--On Wednesday, February 17, 2021 15:52 -0500 Barry Leiba
<[email-masked]> wrote:

>> The announcement is dated 2021-02-10 and the end of the Last
>> Call is 2021-02-24.  Why is the duration of the Last Call two
>> weeks instead of the four weeks required for a
>> reclassification request?
> 
> This was my judgment as responsible AD: we normally do 4-week
> last calls for individual requests and two-week last calls for
> documents coming from working groups.  Why would this be
> different?
> 
> I do see that RFC 6410 specifies four weeks.  If the community
> thinks that's necessary here, I will happily extend the last
> call and let my successor handle the status change from there.

Speaking personally, I think the issues here are subtle ones
involving process and precisely what the documents (and any
status-notices) have to say and not, e.g., whether the
fundamental characteristics of RDAP are appropriate for
advancement.  I count both my concerns and SM's as just that
sort of subtle issue.  Given that you --and, especially since
you are stepping down-- I trust the rest of the IESG has noticed
the RFC 6410 requirement so that we will not, I hope, have this
issue in the future, and in the interest with leaving your
successor with a minimum of loose ends that can be easily
resolved, let me suggest a compromise:

(i) for now, leave  things as they are unless someone stands up
and says "I see issues here that others don't seem to and need
more time".

(ii) If there are a flurry of comments around 23 or 24 February,
ask, using both this list and IETF-Announce for anyone who needs
more time to immediately speak up.  

If you don't get either, wrap this up.

However, to quibble once more...

>> There are currently two protocols for accessing registration
>> data, i.e. Whois and RDAP.  Whois is still widely used.
>> There isn't any information in the about the current status
>> of Whois and its relationship with the intended Internet
>> Standard.  Is the "widespread deployment" about deploying the
>> two protocols deployed side by side?
> 
> We're talking about widespread deployment of RDAP -- this set
> of documents doesn't have anything to do with Whois.  While we
> expect that Whois may fade away at some point, it clearly
> hasn't yet and won't soon, and there's no attempt here to
> change that.

Well, this set of documents does have something to do with Whois
because the original authors, in their wisdom, decided, not to
explain why a new registration data protocol was needed in the
abstract but to make explicit comparisons to Whois and the need
to replace it.   If we were evaluating RDAP as an experiment
--normally a much lower bar than a move to Internet Standard --
it would be entirely reasonable to ask whether it had not
accomplished what it set out to accomplish and was therefore not
a success.   Were RDAP not as widely deployed as it is in spite
of not replacing Whois, I'd consider that a major issue.  As it
is, I think that the change notice and text be very clear but
otherwise probably not worth holding things up over.

Just my opinion, of course.
    john

---

From: Barry Leiba <[email-masked]>
Date: Fri, 19 Feb 2021 10:38:01 -0500

> in maturity level".   That would certainly be consistent with

Does this work for you?  If not, please adjust and counter-propose:

OLD
This status change, therefore, requests a change in status for RFCs
7480 and 7481 from Proposed Standard to Internet Standard.

NEW
This status change, therefore, requests a change in status for RFCs
7480 and 7481 from Proposed Standard to Internet Standard.

While it is a stated goal in RFC 7480 that "RDAP is a successor
protocol to the very old WHOIS protocol," WHOIS remains widely
deployed and in active use, and is likely to be so for some time.  This
action addresses only the maturity of RDAP itself, and makes no
statement nor implication about WHOIS.

END

Barry

---

From: Barry Leiba <[email-masked]>
Date: Fri, 19 Feb 2021 10:39:48 -0500

> If you don't get either, wrap this up.

I like that approach, and thanks for suggesting it.  Let's proceed
with that plan and see where it goes.

Barry

---

From: John C Klensin <[email-masked]>
Date: Fri, 19 Feb 2021 12:30:28 -0500

--On Friday, February 19, 2021 10:38 -0500 Barry Leiba
<[email-masked]> wrote:

>> > Would it be acceptable to change the text in the
>> > status-change document to clarify the situation with
>> > respect to Whois?
>> 
> This status change, therefore, requests a change in status for
> RFCs 7480 and 7481 from Proposed Standard to Internet Standard.
> 
> NEW
> This status change, therefore, requests a change in status for
> RFCs 7480 and 7481 from Proposed Standard to Internet Standard.
> 
> deployed and in active use, and is likely to be so for some
> time.  This action addresses only the maturity of RDAP itself,
> and makes no statement nor implication about WHOIS.
> 
> END

Barry,

I think that is possibly ok and thanks for suggesting the text.
I think it would be better if you (or Scott) could add a
sentence or two about _where_ RDAP is deployed and in use.   For
most of the users of the Internet who have heard of either Whois
or RDAP, "Whois" = "DNS lookup". For them, the claim that RDAP
is widely deployed is questionable.  I'd write the sentences,
but I don't have the data.  

For example, if it is in wide use in the address registries,
let's say that.  If it is the actual back end for the web-based
interfaces for a significant number of TLD registries, let's say
that (even if you have to weight "number of TLD registries by
number of registrants to make that true)?   If, when I use the
Whois protocol to access information in those registry
databases, I'm really using a front-end shim over RDAP, say that
too.

I suspect all of those things may be true but, again, I don't
have the data.   Scott and Andy certainly should (in a more
ideal world, the information would even be in the implementation
report0, so this should be matter or a sentence or three, not a
research project.

thanks,
    john

---

From: Joe Abley <[email-masked]>
Date: Fri, 19 Feb 2021 13:09:18 -0500

Hi John,

> but I don't have the data.  

I'm not sure I've heard of anybody who thinks that whois means DNS lookup, although if by "DNS lookup" you mean access to a domain registry, then I would say RDAP is, in fact, widely- if not fully-deployed today in that sense.

> let's say that.

I can't speak to the address registries, but there has been significant deployment in domain registries over the past couple of years, e.g. see <https://deployment.rdap.org <https://deployment.rdap.org/>>.

I am not current on the contractual requirement to provide RDAP service; the last I heard there some open questions about how SLAs for RDAP services should be formulated and I do not believe those have yet been resolved. However, it seems highly likely that a contractual requirement for RDAP services will emerge for all contracted parties in due course, "contracted parties" being ICANN policy speak, loosely, for accredited gTLD registries and registrars. RDAP addresses a difficult question for ICANN that otherwise does not have an obvious solution.

There have also been questions as to whether in the future whois services might be provided centrally by someone like ICANN in order to preserve the service for the benefit of legacy tools and clients that depend on it, but which itself uses RDAP services provided by registries as a back-end. Whois in effect becomes a proxy for retrieving data from RDAP services without authentication, i.e. public data. So it is possible that whois services will not go away from the perspective of clients who wish to find out information about domains, even at the same time that the contractual obligations on (for example) registry operators are reduced and no longer require individual whois services to be provided.

> If it is the actual back end for the web-based
> number of registrants to make that true)?

I am not aware that there is any readily-available source of data that would describe the use of RDAP internally, behind web-based interfaces offered by domain registries; it also seems possible that it would be difficult to obtain accurate survey data for that question, given the potential for commercial sensitivities to make it difficult for some parties to answer.

> If, when I use the

Again, I think this is a deployment choice that seems plausible in the abstract, but finding useful data regarding actual, deployed services might be a challenge.

> report0, so this should be matter or a sentence or three, not a

I think the principal motivation for RDAP deployment to proceed, aside from contractual obligations, is the increasing understanding that data disclosure for legitimate reasons (e.g. law enforcement with a court order) requires authorisation. Authorisation is not possible within the whois protocol and the practical result is that much of the data that has been published through whois in the past is now routinely redacted, which makes life difficult for law enforcement and is known to hamper legitimate investigations into crime.

Joe

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 19 Feb 2021 20:45:03 +0000

> From: John C Klensin <[email-masked]>
> Sent: Friday, February 19, 2021 12:30 PM
> To: Barry Leiba <[email-masked]>
> Cc: [email-masked]; Hollenbeck, Scott <[email-masked]>
> >> Yes.  In my original note, I wrote, as one option "...could be done
> >> by ... [or]  by a revised statement justifying the change
> > deployed and in active use, and is likely to be so for some time.
> > This action addresses only the maturity of RDAP itself, and makes no
> most of the users of the Internet who have heard of either Whois or RDAP,
> "Whois" = "DNS lookup". For them, the claim that RDAP is widely deployed is
> questionable.  I'd write the sentences, but I don't have the data.
> 
> For example, if it is in wide use in the address registries, let's say that.  If it is
> the actual back end for the web-based interfaces for a significant number of
> TLD registries, let's say that (even if you have to weight "number of TLD
> registries by
> Whois protocol to access information in those registry databases, I'm really
> using a front-end shim over RDAP, say that too.
> 
> ideal world, the information would even be in the implementation report0,
> so this should be matter or a sentence or three, not a research project.

[SAH] A proposal for a few more sentences:

RDAP is fully deployed and operational at all five Regional Address Registries. RDAP implementation and operation is a contractual requirement for all ICANN-accredited domain name registries and 2,370 registrars. The IANA "Bootstrap Service Registry for Domain Name Space" describes 820 unique RDAP base URLs that are are associated with several thousand generic top-level and country code domain name RDAP servers that are operated by domain name registries.

Scott

---

From: John C Klensin <[email-masked]>
Date: Fri, 19 Feb 2021 16:16:28 -0500

Scott,

That is precisely the sort of statement / additional sentences I
was looking for.  Thanks.

Barry, if you could add Scott's paragraph, I think all of the
requirements (as well as my personal aesthetic sense) would be
satisfied and we would avoid setting any precedents of moving
documents to Internet Standard with handwaving, rather than
specifics, about deployment.

thanks again,
    john

--On Friday, February 19, 2021 20:45 +0000 "Hollenbeck, Scott"
<[email-masked]> wrote:

>> let's say that.  If it is the actual back end for the
>> web-based interfaces for a significant number of TLD
>> registries, let's say that (even if you have to weight
>> "number of TLD registries by
>> databases, I'm really using a front-end shim over RDAP, say
>> that too.
>> 
>> ideal world, the information would even be in the
>> implementation report0, so this should be matter or a
>> sentence or three, not a research project.
> 
> RDAP is fully deployed and operational at all five Regional
> Address Registries. RDAP implementation and operation is a
> contractual requirement for all ICANN-accredited domain name
> registries and 2,370 registrars. The IANA "Bootstrap Service
> Registry for Domain Name Space" describes 820 unique RDAP base
> URLs that are are associated with several thousand generic
> top-level and country code domain name RDAP servers that are
> operated by domain name registries.

---

From: Barry Leiba <[email-masked]>
Date: Fri, 19 Feb 2021 17:15:34 -0500

Do you want my paragraph also, or just Scott's?

Barry

---

From: John C Klensin <[email-masked]>
Date: Fri, 19 Feb 2021 18:19:20 -0500

I was assuming both.  Yours talks about Whois and its
replacement; Scott's push a much more solid foundation under why
it is sensible to move ahead with RDAP.

    john

--On Friday, February 19, 2021 17:15 -0500 Barry Leiba
<[email-masked]> wrote:

>> That is precisely the sort of statement / additional
>> sentences I was looking for.  Thanks.
>> 
>> >> For example, if it is in wide use in the address
>> >> registries, let's say that.  If it is the actual back end
>> >> for the web-based interfaces for a significant number of
>> >> TLD registries, let's say that (even if you have to weight
>> >> number of registrants to make that true)?   If, when I use
>> >> the Whois protocol to access information in those registry
>> >> I suspect all of those things may be true but, again, I
>> >> don't have the data.   Scott and Andy certainly should (in
>> >> a more ideal world, the information would even be in the
>> > Registry for Domain Name Space" describes 820 unique RDAP
>> > base URLs that are are associated with several thousand
>> > generic top-level and country code domain name RDAP servers
>> > that are operated by domain name registries.
>>

---

From: Barry Leiba <[email-masked]>
Date: Fri, 19 Feb 2021 18:21:43 -0500

Indeed; just checking what you had in mind   I’ll make the change soon.

b

---

From: Barry Leiba <[email-masked]>
Date: Fri, 19 Feb 2021 19:51:11 -0500

I have made the change:

Barry

---

From: "S. Moonesamy" <[email-masked]>
Date: Sun, 21 Feb 2021 12:23:07 -0800

Hi John,
>databases, I'm really using a front-end shim over RDAP, say that

I doubt that RDAP is in wide use in Africa.  The questions are 
usually about Whois.  The only time I heard someone asking about RDAP 
was during a (non-technical) session in Angola.

Regards,
S. Moonesamy

Board Chair, AFRINIC

---

From: John C Klensin <[email-masked]>
Date: Mon, 22 Feb 2021 18:45:44 -0500

Joe (and SM to save an extra note),

I'm a little confused by parts of your note as I don't see
anything in IETF's criteria for Internet Standards that should
be affected in any way by what ICANN is doing, what it is
requiring, who is a contracted party or not, whether ICANN
enforces its contractual provisions, etc.  Your mentioning them
and their rules in this context brings up memories from a time
long ago when regulators were insisting that only products
supporting certain protocols were allowed to be sold.  Many
companies and organizations who had users or customers with no
interest in those protocols responded to those requirements by
creating Implementations that were only good enough to allow the
appropriate box to be marked on a "do you comply with the
regulatory requirement" form.  If that occurred with some IETF
protocol, the question for the IETF would be whether that sort
of "check-off" implementation and deployment as part of products
or systems that were primarily supporting something else should
count as deployment for Internet Standard criteria purposes.
However, I had no reason to believe that is going on here,
precisely because ICANN does not appear to be requiring it yet.

Similarly, while I believe you are probably correct about the
principal motivation for RDAP deployment to proceed, neither the
motivation, nor what might happen in the future, appear to me to
be relevant to whether the specifications should advance to
Internet Standard.  

And, Subramanian, while I think we should worry, and worry a
good deal, if RDAP is deployed and in use everywhere (or almost
everywhere) but in Africa, the criterion involves deployment;
there is no requirement for deployment everywhere.

I guess the bottom line question is whether the new text
describing the justification for the advancement works for both
of you or if more tweaking is in order.

best,
    john

--On Friday, February 19, 2021 13:09 -0500 Joe Abley
<[email-masked]> wrote:

>> I think that is possibly ok and thanks for suggesting the
>> text. I think it would be better if you (or Scott) could add a
>> sentence or two about _where_ RDAP is deployed and in use.
>> For most of the users of the Internet who have heard of
>> either Whois or RDAP, "Whois" = "DNS lookup". For them, the
>> claim that RDAP is widely deployed is questionable.  I'd
>> write the sentences, but I don't have the data.  
> 
> I'm not sure I've heard of anybody who thinks that whois means
> DNS lookup, although if by "DNS lookup" you mean access to a
> domain registry, then I would say RDAP is, in fact, widely- if
> not fully-deployed today in that sense.
> 
> I can't speak to the address registries, but there has been
> significant deployment in domain registries over the past
> couple of years, e.g. see <https://deployment.rdap.org
> <https://deployment.rdap.org/>>.
> 
> I am not current on the contractual requirement to provide
> RDAP service; the last I heard there some open questions about
> how SLAs for RDAP services should be formulated and I do not
> believe those have yet been resolved. However, it seems highly
> likely that a contractual requirement for RDAP services will
> emerge for all contracted parties in due course, "contracted
> parties" being ICANN policy speak, loosely, for accredited
> gTLD registries and registrars. RDAP addresses a difficult
> question for ICANN that otherwise does not have an obvious
> solution.
> 
> There have also been questions as to whether in the future
> whois services might be provided centrally by someone like
> ICANN in order to preserve the service for the benefit of
> legacy tools and clients that depend on it, but which itself
> uses RDAP services provided by registries as a back-end. Whois
> in effect becomes a proxy for retrieving data from RDAP
> services without authentication, i.e. public data. So it is
> possible that whois services will not go away from the
> perspective of clients who wish to find out information about
> domains, even at the same time that the contractual
> obligations on (for example) registry operators are reduced
> and no longer require individual whois services to be provided.
> 
>> interfaces for a significant number of TLD registries, let's
>> say that (even if you have to weight "number of TLD
>> registries by number of registrants to make that true)?
> 
> I am not aware that there is any readily-available source of
> data that would describe the use of RDAP internally, behind
> web-based interfaces offered by domain registries; it also
> seems possible that it would be difficult to obtain accurate
> survey data for that question, given the potential for
> commercial sensitivities to make it difficult for some parties
> to answer.
> 
>> If, when I use the
> Again, I think this is a deployment choice that seems
> plausible in the abstract, but finding useful data regarding
> actual, deployed services might be a challenge.
> 
> I think the principal motivation for RDAP deployment to
> proceed, aside from contractual obligations, is the increasing
> understanding that data disclosure for legitimate reasons
> (e.g. law enforcement with a court order) requires
> authorisation. Authorisation is not possible within the whois
> protocol and the practical result is that much of the data
> that has been published through whois in the past is now
> routinely redacted, which makes life difficult for law
> enforcement and is known to hamper legitimate investigations
> into crime.
> 
> 
> Joe

---

From: Joe Abley <[email-masked]>
Date: Mon, 22 Feb 2021 18:52:35 -0500

> of you or if more tweaking is in order.

My note was simply intended to clarify that RDAP is quite extensively deployed in domain registries (and provide colour as to why), since your note suggested that you thought otherwise. 

Quite possibly I misread, and no doubt my reply contained tangents.

I remain happy with advancement with or without the extra text.

Joe

---

From: John C Klensin <[email-masked]>
Date: Mon, 22 Feb 2021 21:11:40 -0500

Joe,

Thanks.  I think it may have been the tangents that confused
me... and perhaps your reaction to my poorly stated comment
about Whois, which was intended to convey my impression that
most of the end users (not law enforcement or other specialists,
including those who are interested in figuring out what names
might be available for sale) who think to look up a domain name
at all think in terms or either whois or some web page that
probably has "whois" in its name (again, regardless of what is
in its back end).  None of those issues is, at least IMO, a bar
to advancing the document but they, and their relatives,
probably justify the small amount of additional explanation that
is now in the text.

best,
   john

--On Monday, February 22, 2021 18:52 -0500 Joe Abley
<[email-masked]> wrote:

>> describing the justification for the advancement works for
>> both of you or if more tweaking is in order.
> 
> My note was simply intended to clarify that RDAP is quite
> extensively deployed in domain registries (and provide colour
> as to why), since your note suggested that you thought
> otherwise. 
>

---

From: S Moonesamy <[email-masked]>
Date: Tue, 23 Feb 2021 00:52:40 -0800

Hi John,
>there is no requirement for deployment everywhere.

Yes.

>of you or if more tweaking is in order.

There is a Last Call in progress.  The fact that we had this exchange 
means that the issue was not overlooked.  My preference is to go with 
the new text instead of finding better text which includes the 
requirement for deployment.

Regards,
S. Moonesamy