Subject: Re: whois and zone enumeration

From: [email-masked]
Date: Mon, 2 Aug 2004 23:26:25 +0000

On Tue, Aug 03, 2004 at 01:03:05AM +0200, Miek Gieben wrote:
> Hello,
> 
> I've a simple question. If a TLD would shutdown their whois service,
> would zone enumeration then still be a problem?
> 
> (ignoring the fact that you might not want to do this)
> 
> grtz,
> --Miek

	once, many years ago, I ran a TLD and -expressly- did
	not run a whois server/service for it.  
	
	if that was still the case, I might still be "grumpy" about 
	zone enumeration simply because the IETF, in an attempt
	to be "helpful" specified several roll accounts that are
	expected to be available at each delegation point. put the
	two together and a "double opt-in" list of freshly harvested
	email addresses which I can send my scam'o'the-day.

	so... zone enumeration + IETF BCP'd roll accounts highlights 
	one of the abusive techniques.  No whois needed. 

--bill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked] (Geoffrey Sisson)
Date: Tue, 3 Aug 2004 00:47:17 +0100 (BST)

> would zone enumeration then still be a problem?

Yes.  Elaboration of delegation-only zones is a problem in and of
itself.  Lists of owner names may be (and, in Nominet's case, have
been) employed in combination with RFC 2142 local-parts to create
mailing lists that are subsequently used/sold on for for the purpose of
UCE.

Regards

Geoff

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Tue, 3 Aug 2004 21:12:42 +0200

Miek,

> would zone enumeration then still be a problem?

As I said in 
http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg00472.html
fixing (or shutting down ;-) whois will remove whois from the examples, 
but won't dispatch the traversal problem for us.

Best,
Marcos