Dear All, Please find the attendance of the call attached to this email and the MP3 recording below for the Next-Gen RDS PDP Working group call held on Tuesday, 23 August 2016 at 16:00 UTC. MP3: http://audio.icann.org/gnso/gnso-nextgen-rds-23aug16-en.mp3 The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: http://gnso.icann.org/en/group-activities/calendar<http://gnso.icann.org/en/group-activities/calendar#nov> ** Please let me know if your name has been left off the list ** Mailing list archives:http://mm.icann.org/pipermail/gnso-rds-pdp-wg/ Wiki page: https://community.icann.org/x/jg6sAw Thank you. Kind regards, Michelle DeSmyter ------------------------------- Adobe Connect chat transcript for Tuesday, 23 August 2016 Michelle DeSmyter:Dear All, Welcome to the Next-Gen RDS PDP Working Group call on Tuesday, 23 August 2017 2016 at 16:00 UTC. Michelle DeSmyter:If you wish to speak during the call, please either dial into the audio bridge and give the operator the password RDS, OR click on the telephone icon at the top of the AC room to activate your AC mics. Please remember to mute your phone and mics when not speaking. Michelle DeSmyter:Agenda page: https://community.icann.org/x/jg6sAw Chuck Gomes:Under agenda item 3 please move 20 after 19. Chuck Gomes:Thanks Chuck Gomes:Welcome to all. We will wait a coupld more minutes while people continue to join. Maxim Alzoba (FAITID):Hello All Ankur Raheja:Hello steve metalitz:Marika's notes from last week indicate that use case from Rod on domanis registered to miscreant would be deferred to this week. Has that been further deferred? Lisa Phifer:yes Steve - Rod is unable to join today steve metalitz:OK thanks Lisa Ayden Férdeline:hi all. Greg Shatan:Hopefully Rod's absence is not due to miscreants. Greg Aaron:Probably is! Greg Shatan:Scroll and magnification control please. Lisa Phifer:sync off go ahead Greg Shatan:It came and went... Stephanie Perrin:my apologies for being late Ayden Férdeline:It's redundant, feel free to remove "in defining this policy" if you like. Alex Deacon:Agree its redundant marksv:"is resolving the tension" Alan Greenberg:will be to resolve... Alex Deacon:agree it could be cleaned up... Maxim Alzoba (FAITID):+1 Michele, solve -> resolve and remove the second one Alan Greenberg:addressing the tension steve metalitz:+1 to "accommodates" Ayden Férdeline:"The core problem will be accomodating the tension among the varied and competing views..." Fabricio Vayra:I also like accomodating Beth Allegretti:+1 to "accomodate" marksv:"addressing" is also good ELAINE PRUIS:+ 1 addressing Michele Neylon:+1 to either address or accomodate Jeffrey Eckhaus: +1 addressing steve metalitz:The vrebs I had suggested considering were resolve/manage/accommodate/mitigate Michele Neylon:we are splitting hairs though :) Holly Raiche:Just a suggestion - happy with either Sara Bockey:"taking into consideration" steve metalitz:verbs andrew sullivan:"The core problem will be to get everyone resigned to the compromise with which nobody is satisfied" ;-) (No that's not a real suggestion.) marksv:hah Stephanie Perrin:+1 Alan Greg Shatan:I don't think accommodating implies resolving. Jeffrey Eckhaus:I agree with Alan - Ayden Férdeline:I do not think "accomodating" implies any sort of final resolution. Sounds more like a compromise to me. Jim Galvin (Afilias):Agree with Alan marksv:no problem from me Holly Raiche:Works for me andrew sullivan:@Ayden: if you think there will be a _final_ resolution, then I urge you to consider the last 30 years of Internet policy development. Ayden Férdeline:Andrew, I don't think that all. andrew sullivan:I strongly object to the stakeholders/claim to stuff. I think it's inconsistent with ICANN processes Ayden Férdeline:Yes, I maintain we must include "claim to" in the sentence. marksv:I think "claim to" feels perjorative Greg Shatan:Agree with Mark Lisa Phifer:rouglhly 12 opposed, two in favor of "claim to" Michele Neylon:as do I Ayden Férdeline:re: the count. Just a simple reminder that was not a referendum... :) marksv:ok to delete ELAINE PRUIS:remove is good Beth Allegretti:ok to delete Holly Raiche:Agree with Chuch and Andrew on this andrew sullivan:Not only will we not lose, I think we gain something andrew sullivan:ditch it Alan Greenberg:delete Richard Padilla:HI all sorry for being late Susan Kawaguchi:Facebook as a registrant does marksv:registrants have an interest Susan Prosser:retain registrants andrew sullivan:If registrants don't have a legitimate (no idea about "vested") interest here, then nobody does Ayden Férdeline:no, actually, i think we should retain registrants. Holly Raiche:Agree with Chuck - registrants DO have an interest Maxim Alzoba (FAITID):I wonder if registrants are aware of RDS at all marksv:good point Susan Kawaguchi:@ Maxim I couldn't manage the FB portfolio without the registration data marksv:in the spirit of conciseness, i am ok to delete the verbiage Susan Kawaguchi:All registrants should use the registration data to confirm their own information Ayden Férdeline:@Maxim largely they are not. ICANN has conducted research on this before that suggests less than 5% of registrants are aware of WHOIS. andrew sullivan:Even if registrants _don't_ know about RDS, they have an interest. (This is the same problem I had with the "claim to" language) Maxim Alzoba (FAITID):@Ayden, but adding very few registrants does not help .. so we might remove it Ayden Férdeline:I wasn't suggesting to add that text to the document. Alan Greenberg:We are going down a rathole of everyone wanting their key-words in this. Susan Kawaguchi:@ Ayden if you are talking about internet users that are not registrants I would agree with your assertion but I can't imagine anyone that runs a business on a domain name or is in the business of selling domain names does not use registration data frequently marksv:good point, i agree with the distinction between privacy and anonymity Nathalie Coupet:+1 Michele Ayden Férdeline:@Susan hi, yes, that is what i was suggesting. i agree that for *some* commercial registrants would be the case. Greg Shatan:Ayden, do you have a link or cite for that research? Vaibhav Aggarwal:that's right @michele Fabricio Vayra:Agree with Michelle. What he's saying is that there's no parity. Susan Kawaguchi:I would bet the registrants of oer 300 million domain names registered use registration data so it is not insignificant Greg Shatan:Seems like we have picked one edge case and called it for effect or because of a particular interest in the anonymous subgroup. Holly Raiche:Agree with Chuck on this issue - there are some who really do want to go beyond privacy Greg Shatan:Let's use "dealing with" again. Fabricio Vayra:+1 Stephanie. Respecting is good. Vaibhav Aggarwal:yes Stephanie Perrin:Let the record show Fab and Steph agree!!!! Jim Galvin (Afilias):I agree with Michele we should remove the sentence. Fabricio Vayra:+1 Alex Holly Raiche:Do not agree with the removal Ayden Férdeline:No. Strongly disagree with @Alex. We should retain the final sentences. steve metalitz: +1 to Alex and Michele on removing last 2 sentences, why would we single out one viewpoint "for example"? Vaibhav Aggarwal:There shud be two parts of this statement Susan Kawaguchi:+1 Andrew Fabricio Vayra:+1 Alan Jim Galvin (Afilias):+1 Andrew - keep registrants Holly Raiche:Totally agree with Andrew Vaibhav Aggarwal:1from backend and one for front end we shud be able to separate in treatment Michele Neylon:+1 Alan Ayden Férdeline:@Alan The sentence says "some" desire anonymity or pseudonymity ... not everyone. Susan Kawaguchi:+1 Alan ELAINE PRUIS:+1 Tjabbe Bos (European Commission):+1 Alan Stephanie Perrin:We have to remove accurate and complete then if we remove these lines Jeffrey Eckhaus:Agree with Alan again +1 Alex Deacon:+1 Alan Beth Allegretti:+1 Alan Jim Galvin (Afilias):+l Alan - remove the two sentences Ayden Férdeline:+1 Stephanie Fabricio Vayra:+1 Alan Ayden Férdeline:If we remove the final two sentences, we need to edit the first sentence. Geoffrey Noakes (Symantec):+1 Alan Stephanie Perrin:This is respectfully an good example of the problem. marksv:"a list of examples is available in document abcd.pdf" Stephanie Perrin:remove complete if you remove ut marksv:hooray Volker Greimann:SSL needS: there are no other means of authentification than whois? As anyone can put anything into whois, how is that a secure method? Rod Rasmussen:Internet > Web - just a friendly reminder. :-) Vaibhav Aggarwal:+1 JEFF Maxim Alzoba (FAITID):We saw situations when persons changed their names legally to be full copy of company names Alex Deacon:@volker - whois is one of many data sources used - depending on the cert kind/type/product marksv:SSL (actually, TLS 1.1 or higher) is neccessary but not sufficient David Cake:yes, authentication for CAs can be done directly via DNS not using Whois for basic certs. eg ACME used by lets encrypt Vaibhav Aggarwal:the systems are already widely getting upgraded to TLS 1.2 Vaibhav Aggarwal:perfect point JEFF about the domains Vaibhav Aggarwal:but a larger part of the world has only access to Whois for information Vaibhav Aggarwal:and nothing else marksv:@Vaibhav, agree that we should all skip over TLS 1.1 to TLS 1.2. I don't recall if PCI certs are requiring 1.2 yet; I know they are disallowing 1.0 Vaibhav Aggarwal:the transition has begun @markssv Vaibhav Aggarwal:we just did in one of my ecom businesses marksv::) Susan Kawaguchi:echo Vaibhav Aggarwal:for e.g there is a large part of CAs available for $1 or more and there is no other authentication done marksv:echo echo echo Greg Shatan:David was echoing.... Vaibhav Aggarwal:echo andrew sullivan:I don't see how it is relevant to this case that some CAs don't use the RDS this way Alex Deacon:@Andrew +1 andrew sullivan:Just because some people don't do this doesn't mean that it's not a useful thing to offer Fabricio Vayra:+1 Andrew Ayden Férdeline:why do you need to use WHOIS, what if the registrant just added a TXT entry to their DNS? Vaibhav Aggarwal:@this application shud have thumbs up :-) Vaibhav Aggarwal::-( Michele Neylon:somebody has an echo Sara Bockey:David needs to mute when not speaking andrew sullivan:@Ayden: there are different ways to do things, but records in the DNS are not the same thing as validating who is supposed to be allowed to do something. Michele Neylon:please turn off your speakers or whatever andrew sullivan:There are lots of people who are sceptical of the value of EV and OV and so on certs Michele Neylon:Ayden - there are different types of certs with different levels of validation andrew sullivan:but if you think they're useful, evidence in the DNS isn't enough Vaibhav Aggarwal:onus of enactment is at the tier level Michele Neylon:DNS records mean nothning Michele Neylon:nothing Michele Neylon:I could register facebooksucksdonkeytoes.somthing now Michele Neylon:add a DNS record Michele Neylon:done Vaibhav Aggarwal:1st, the registrar, 2nd Registry and 3rd ICANN Michele Neylon:doesn't mean we are FB or have any right to use the domain Chuck Gomes:It is not in scope for this WG to change DNS. Susan Kawaguchi:@michele most CAs then reach out to me to validate the domain name Vaibhav Aggarwal:considering that the registrar will be providing faulty information most of the time Ayden Férdeline:@Michele I wasn't suggesting it was or should be the only form of verification Michele Neylon:Susan - yes, though that's only cos you're big enought for them to care Susan Kawaguchi:true and lots of bad stuff going on with certs in the past Vaibhav Aggarwal:+1 Chuck Michele Neylon:there's been some very odd things in the past .. Alex Deacon:LetsEncrypt-style certs provide strong encryption with very weak (or perhaps no) authenticaiton. Fabricio Vayra:+1 Greg Vaibhav Aggarwal:Q keeps coming back to the validation of the information provided by the registrant andrew sullivan:@Alex: the ACME use case is basically sceptical of EV and so on, at least for those use cases David Cake:not weak authentication, weak credentialling Ayden Férdeline:@Greg - That is not what happening. People are simply asking questions to understand how a task could be performed if access to the RDS was not available. Vaibhav Aggarwal:let's not take examples of 100$ CAs andrew sullivan:I think anyone involved with letsencrypt would say that, if you need an EV cert, their way is probably not the way to do it David Cake:verifies that you own the domain Stephanie Perrin:Hold on, are we not here to try to figure out the better way? Benny Samuelsen / Nordreg AB:I cant see how access to whois info in RDS change anything from how it is today? There are no magic about the RDS solving fake registrations Alex Deacon:for the record I'm a fan of LetsEncrypt - more encryption is always better. Vaibhav Aggarwal:talk discuss about 10-1-2-3-4-6$ CAs Greg Shatan:A better way is one thing. But telling users to go away and find a way to deal with this in a fashion that doesn't involve RDS. Stephanie Perrin:+1 Michele Vaibhav Aggarwal:So would Michele u suggest a phase wise phase out of the who is ? marksv:lol Ayden Férdeline:+1 Michele Vaibhav Aggarwal:or u r saying that this shud always exist @ Michele David Cake:yes, letsencrypt solves only for domain validation. EV is a valid different case - but should go beyond RDS anyway. Jim Galvin (Afilias):this is an example use case Jim Galvin (Afilias):doesn't mean it will continue in the future, it just exists today Jim Galvin (Afilias):seems reasonably well described to me Ayden Férdeline:+1 Jim Jim Galvin (Afilias):shouldn't we move on to the next one? Vaibhav Aggarwal:@Michele Under $1 Michele Neylon:well that's not a sustainable biz model :) Vaibhav Aggarwal:but it'll always exist and u may agree to that marksv:Glad I don't live within binocular range of Michele David Cake:I agree Jim. Michele Neylon:lol Vaibhav Aggarwal:I agree with you but that is a way to up sell more expensive ones marksv:hahaha Vaibhav Aggarwal:ha ha ha gd one +1 Volker Greimann:Solution to this use case: Abolish FOA and rely entirely on EPP code. marksv:Need to drop - thanks everyone Vaibhav Aggarwal:ciao mark Vaibhav Aggarwal:This is definitely @Chuck & @Jim Geoffrey Noakes (Symantec):If anyone wants to connect offline about the use case for CA's use of WHOIS/RDS, I may be reached at geoffrey_noakes@symantec.com<mailto:geoffrey_noakes@symantec.com> Stephanie Perrin:Suddenly my microphone has become muted Stephanie Perrin:Is there a difference when there is a proxy registration? Stephanie Perrin:Can somone in tech please see if they have put me on permanent mute? I did not touch anything Benny Samuelsen / Nordreg AB:With the new IRTP-C getting in force in january yes that will create problems but not a RDS problem. Lisa Phifer:Michele, re: transfer case, is EPP code the same as "auth code" Vaibhav Aggarwal:the app is just not working boss can Adobe be given feedback? Scott Hollenbeck (Verisign):@Lisa - yes Scott Hollenbeck (Verisign):aka authInfo Lisa Phifer:re: authcode, I ask because there have been suggestions that it be published in the RDS and it sounds from the case like it should not be Scott Hollenbeck (Verisign):SHOULD NOTE BE! andrew sullivan:Most certainly should never be Benny Samuelsen / Nordreg AB:that is a no go Susan Kawaguchi:+1 Scott Maxim Alzoba (FAITID):code is a secret ... not to be shared Jim Galvin (Afilias):Practical problems exist, like registrars who do not make the auth_info available to registrants, but that is outside the scope of this discussion in my opinion. Chuck Gomes:Note that registrars have requirements in their agreements with ICANN that require them to respond within certain time frames. Benny Samuelsen / Nordreg AB:That is a compliance issues and should be handled like that Holly Raiche:Tks Michele Greg Aaron:I am sending a note up to the list regarding the transfer and deletion use cases. The use cases do not mention a lot of relevant material from Consensus Policies, and so the use cases seeem incomplete or miss a lot of scope. My note will reference the material. Lisa Phifer:Day 1 - THursday - will be F2F meeting day steve metalitz:Thursday Nov. 3 Holly Raiche:Time zones much better for APAC region Stephanie Perrin:I am still trying to decide, may be remote Greg Aaron:we need remote participation andrew sullivan:I am supposed to be in H, but can't be sure Maxim Alzoba (FAITID):remote participation is a good idea Greg Aaron:And count on a few people not geting visas in time! Rod Rasmussen:To be clear - I will be there but may be in other rooms during some of our deliberations. Ayden Férdeline:thanks all Nathalie Coupet:Thank you Alex Deacon:Thanks! Vlad Dinculescu:thanks all. VaibhavAggarwal:Thanks team Patrick Lenihan:Thanks to Each and All! andrew sullivan:bye VaibhavAggarwal:Have a gr8 time ahead Maxim Alzoba (FAITID):bye all Susan Prosser:thanks all