Re[2]: [ga] WHOIS policy primer

[Karl Auerbach <karl@CaveBear.com>]

On Wed, 28 Aug 2002, Allan Liska wrote:

> KA> Why should one who is on the net be required to have e-mail?
> 
> One who is on the Internet is not required to have e-mail.  One who
> has a domain name has  certain responsibilities, and must have an
> e-mail.  In fact, at a minimum, all domain owners are required to have
> a postmaster@ address.

At the risk of reaching my posting limit - you are simply asserting these
things.  There have *never* been "responsibilities" associated with having
a domain name beyond having a couple of servers geographically separated
(a requirement often ignorred.) There has *never* been a requirement that
there be a "postmaster" address - and that would be a strange requirement
indeed in these days of people who think of the net as a web-only
experience.

And why should there be an open public book of who-owns-what-domain name?  
If that machines legitimately bearing that domain name are not hurting you 
then why do you have any right to know who owns them?

If they are hurting you, then we have a legal system that will give you 
the tools (subpoenas and such) to pry out the information that you need.

If they are hurting you badly enough that immediate action is required - 
we are not a vigalante society and you ought to be acting through "the 
authorities".  Yes, they aren't very helpful yet - but perhaps that is 
because they are not usually asked to help.

> KA> You have not said why one must reveal one's identity and address and phone
> KA> number to the public for unregulated data mining.  What values are
> KA> promoted by such disclosures?
> 
> I didn't say they should reveal the address for public data mining.
> In fact many registrars are taking steps to prevent data mining of
> whois databases, I applaud those steps.  That does not mean that there
> should not be a valid contact information for all domains, one who can
> speak authoritatively for the organization.

Let's consider bagpipe owners - those wind bags can be more than merely
annoying if abused.  Should we as a society require that every person who
purchases (or builds) a bagpipe have to put his name, address, and phone
number onto a public ledger so that any cocamamie marketeer can bombard
the bagpipe player with spam?  Is the fact that you (or I) might
occassionally need to find out whose bag is anoying you at midnight be
reason to have such a public ledger?

As a general matter, public ledgers of names have been required only for 
real property (land) and dangerous instrumentalities (not even guns are 
always on publicly accessible ledgers).

Domain names are more like bagpipes than they are like guns and they 
equally ought to be off lists that can be accessed by anybody, anytime, 
for any reason, and without leaving a verifiable calling card.
 
> That is a misnomer, it is very easy to forge an IP Address, in fact,
> it is done all the time.  The problem with the TCP handshake, is that
> the receiving end always believes the sender is who he says he is.

Uh, you are mistaken.  Sure, it is easy to forge *source* addresses, but
if a forged address is used as a *destination*, the packet won't get back
to where it came from.  TCP handshakes will fail and connections will not
be formed.  There is nothing in TCP that "believes" or doesn't "believe" - 
the simple fact is that the return packet will never arrive if the 
destination address is forged.

> ..  DNS is all about being cooperative.

DNS is about partitioning up the name space so that different groups can
work without consulting one another.  IP addresses, on the other hand,
require allocation that is consistent with the topology and routing
protocols of the net.

> Why would I e-mail a NOC because an end user of an end user has a
> virus on one of their workstations?  That's ludicrous, and any good
> NOC engineer will laugh at you for that type of request.

For this you want to violate the privacy of everyone who has a domain on 
the net?

> Well, it is sort of like writing a check.  I may not want every
> cashier at Target to have my address, but if I want to write checks, I
> don't have any choice -- if I want privacy, I can pay cash.  If you
> want to maintain privacy on the Internet, don't register a domain
> name.

Given that the Internet is evolving into a utility function you are asking 
people to pay a very steep, and unnecessary price to obtain a utility.  
Why should a parent expose the name and address of a schoolchild just so 
that child can get his/her homework of the school's web page?

> Also, as I have stated in the past, I have no objection to using proxy
> information as DNS contacts, as long as the person on the other side
> of the e-mail is responsive to queries.

If those queries are called "subpoenas" and are issued only after a 
demonstration of adequate cause and adequate evidence before a 
disinterested magistrate, then fine.  Otherwise, you are opening the door 
to those who chose to sell us everything, to stalk our children, and to 
reduce individuals to mere numbers.

		--karl--


--
This message was passed to you via the ga@dnso.org list.
Send mail to majordomo@dnso.org to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html