Ross Rader wrote:

I wasn't taking a position with my note. Not sure why you are making such an assumption.

Plainly, this is good old fashioned procedural advice from someone who has been there.

I'm simply saying that if you are worried about preventing criminals from registering tons of domains as the article describes, then the policy discussion will have to be broader than what Danny's prescription allows. If you are interested in more accurate whois, then Danny's prescription will be just fine. My assumption is that the public interest will be better served by dealing more broadly with the issue and is rooted in the observation that many times Visa has a hard time verifying whether or not it is a cardholder presenting data or if its a criminal posing as the cardholder.

You're mixing two distinct issues -- the accuracy of data and the legitimacy of its ownership. At least the credit card companies know whether it's an accurate card, by making sure than the name, number, expiry and CVV match. They can verify accuracy of the data, their problem is whether the presenter is the legitimate owner of the data. There are two parts to this -- accuracy and legitimate ownership. Both are necessary. But there's no point in establishing legitimacy if the data isn't accurate. So it's reasonable to tackle the accuracy issue first. Sure, someone could put the exact address of Wrigley Field as their WHOIS contact information and that would pass the accuracy test; but there are ways to ensure that the data entered belongs to its presenter. Even automated mailing lists can send verification emails for subscription requests, and don't validate the request until the mail is answered. Google uses a more elaborate method, that involves postal mail, to verify the legitimacy of businesses wanting to be located on Google Map requests. It's not enough to give a proper address; you actually have to be able to receive mail there. And I'm sure there are even more elaborate methods... but the fact exists that we're not doing ANY of this now. I believe that we have a really good idea of what needs to be done. If I'm wrong that's fine, but please make your case if otherwise. - Evan

Ross Rader wrote:

An exchange of two or three emails doesn't lead to "a really good idea of what needs to be done".

And At-Large has been at this for a very long time. I believe that it has already identified WHOIS accuracy as a necessary -- if not complete -- part of the solution. Danny's original question was on tactics, not strategy. If we stay in the theoretical forever we get nothing done -- which is what's been happening. Eventually we need to define specific fixes. - Evan

I support this. No one (among us in any case) is likely to advocate WHOIS inaccuracy, but putting efforts on addressing or at least identifying the real targets is crucially important. As I get deeper into the Post Expiration Domain Name Recovery issue, it is becoming apparent that earlier attempts to address the problem not only did not fix the problem, but may have in fact worsened it. I attribute this to some degree because they were trying to fix a symptom and not address the long-term needs. Alan At 14/09/2009 02:10 PM, Gareth Shearman wrote:

I certainly agree with Danny, Garth and Evan that the Whois issue needs to be addressed, but I also agree with Ross that we need to address the larger policy issues as well.

Gareth

On 14-Sep-09, at 9:10 AM, Evan Leibovitch wrote:

...

Ross Rader wrote:

...

An exchange of two or three emails doesn't lead to "a really good idea of what needs to be done".

And At-Large has been at this for a very long time.

I believe that it has already identified WHOIS accuracy as a necessary -- if not complete -- part of the solution. Danny's original question was on tactics, not strategy.

If we stay in the theoretical forever we get nothing done -- which is what's been happening. Eventually we need to define specific fixes.

- Evan

------ NA-Discuss mailing list NA-Discuss@atlarge-lists.icann.org

http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ica...

...

Visit the NARALO online at http://www.naralo.org ------

------ NA-Discuss mailing list NA-Discuss@atlarge-lists.icann.org http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ica...

Visit the NARALO online at http://www.naralo.org ------

At 14/09/2009 02:42 PM, Wendy Seltzer wrote:

Alan Greenberg wrote:

...

I support this. No one (among us in any case) is likely to advocate WHOIS inaccuracy,

You didn't really think I'd let that pass? I do not advocate WHOIS accuracy, as I believe it focuses on the wrong points in the chain of accountability. I support "inaccuracy" as one way among many of maintaining privacy or anonymity in domain registration.

I tend to think of that as obfuscation rather than inaccuracy. But with the same result I guess. Alan

I'm simply saying that if you are worried about preventing criminals from registering tons of domains as the article describes, then the policy discussion will have to be broader than what Danny's prescription allows.

Personally, I think that the registrar should send a verification code to the paper mailing address provided by the registrant, and not activate the domain until the registrant receives the code and shows (probably by web or email response) that he or she has received it. I realize this would make the registration process considerably slower and somewhat more expensive, but I see no public interest reason why that's a bad thing. R's, John

...

Personally, I think that the registrar should send a verification code to the paper mailing address provided by the registrant, and not activate the domain until the registrant receives the code and shows (probably by web or email response) that he or she has received it.

I realize this would make the registration process considerably slower and somewhat more expensive, but I see no public interest reason why that's a bad thing.

I would guess that this would only need to be done for new Registrar:Registrant relationships. Once such a trust relationship is established (perhaps periodically renewable) additional registrations would not need to go through the process, thereby significantly reducing the potential impact.

So long as you were sure that it was the same person and not just someone borrowing the same contact details, I'd agree.

However, it is unclear if this could be effectively implemented in parts of the world with inadequate paper-mail capabilities.

Are there really places with Internet connectivity where you can't get a letter with one sheet of paper delivered? I realize that parcels get pilfered, but letters? R's, John

At 14/09/2009 08:05 PM, John R. Levine wrote:

...

...

Personally, I think that the registrar should send a verification code to the paper mailing address provided by the registrant, and not activate the domain until the registrant receives the code and shows (probably by web or email response) that he or she has received it.

I realize this would make the registration process considerably slower and somewhat more expensive, but I see no public interest reason why that's a bad thing.

...

I would guess that this would only need to be done for new Registrar:Registrant relationships. Once such a trust relationship is established (perhaps periodically renewable) additional registrations would not need to go through the process, thereby significantly reducing the potential impact.

So long as you were sure that it was the same person and not just someone borrowing the same contact details, I'd agree.

My assumption in writing the above was that some sort of ongoing credential (perhaps call it a "password") could be used.

...

However, it is unclear if this could be effectively implemented in parts of the world with inadequate paper-mail capabilities.

Are there really places with Internet connectivity where you can't get a letter with one sheet of paper delivered? I realize that parcels get pilfered, but letters?

Getting the 1 sheet delivered in a predictable time is a bit harder. But just assuring delivery is a problem also. Hey, at my old university, one of the attractive parts of networks and e-mail was that it by-passed slow, internal paper mail. The same is true in many parts of the world today. But let's not get hung up on the mechanism of increasing the credibility of the identity. Paper will work in some parts of the world, and I am sure there are other mechanisms that would work elsewhere. Alan

R's, John

I would not support any proposal that imposes delay on the ability of an individual to register a domain name. One of the strengths of the Internet is the speed with which users can publish and speak. You see this especially around newsworthy events, where minutes after something important or interesting has happened, people are registering domain names and using the traffic that flows in to say something. A postal verification process would add an incremental accuracy gain while burdening the ability to speak and react in real time to world events -- and the "bad guys" would subvert it anyway. -- Bret

I would not support any proposal that imposes delay on the ability of an individual to register a domain name. One of the strengths of the Internet is the speed with which users can publish and speak.

I really wish we could get beyond the myth that a second-level vanity domain name is some sort of magic ticket to publishing. R's, John

At 15/09/2009 09:55 PM, Bret Fausett wrote:

...

I really wish we could get beyond the myth that a second-level vanity domain name is some sort of magic ticket to publishing.

:-) and I wish you could accept the reality than the use of domain names as addresses for content are substantially more accessible and descriptive than a subpage on GeoCities.

Ripped from recent news is this example: http:// www.NoMoreJoeWilson.com, registered a few hours after Representative Wilson yelled "You Lie" from the floor of Congress. The ability to descriptively address your content is a great tool to increase readership.

-- Bret

But to put this in perspective, someone who registered http://www.NoMoreJoeWilson.com a few hours after Representative Wilson yelled "You Lie" from the floor of Congress probably already has other domain names and an established relationship with a registrar/reseller. And this is in fact the case. It is registered to "canesyrup.com" which is in turn a domain dating back to 1999 (held by the same reseller). So according to the processes we are describing, http://www.NoMoreJoeWilson.com still could have been registered instantaneously... Alan

John R. Levine wrote:

...

:-) and I wish you could accept the reality than the use of domain names as addresses for content are substantially more accessible and descriptive than a subpage on GeoCities.

Ripped from recent news is this example: http://www.NoMoreJoeWilson.com,

Yes, that would be the myth, that a freshly purchased 2LD is somehow required to put up a useful web site. Surely we don't have to explain to you why that's not true.

It's not *necessarily* true, but it can be. Take this particular case, which strangely enough appears to be a good example.

Just out of curiosity, did you find that web site by typing NoMoreJoeWilson into your browser, or did you find it some other way?

I did Google searches for "Joe Wilson" and "no more Joe Wilson". The above-mentioned website doesn't show up, not in the first page of hits or the first 10 pages -- drowned out by news reports of Mr. Wilson's saying "no more apologies". I held my nose and tried the same searches at Bing -- same result. So I suspect that most people who got to www.NoMoreJoeWilson.com got there by typing it in. And having a catchy name like that would have been easier to remember -- and type in -- than http://www.commiepinkoblogger.com/nomorejoewilson.html Now, having said that, I still mostly agree with John. The speed/ease with which one can get one's own web identity is not a free-speech issue. *Most* sites can be found in the browser bar. But nomorejoewilson.com is a viable counter-example in which a catchy site name can compensate for lousy SEO. I personally believe in an approval process for registrants -- having been registered, with accurate and legitimate contact info, you can then buy as much as you want as fast as you can get it. Those wanting anonymity for second level names can request it, but that facility would be restricted to individuals and certain classes of agencies, handled in much the same way that phone companies handle unlisted phone numbers and blocked caller-ID. You'd still have to have valid contact info -- accessible to the legal system -- but your registrar would be entitled to block it from public access. Of course, this approach has been raised many times before, it's handly original. But it still seems to me to be something worth advocating. - Evan

So if I live in the middle of nothing (where I can not receive paper mail) I will not be able to register any domains? That effectively will exclude some people of doing legitimate business through the Internet. -ed On Mon, Sep 14, 2009 at 7:46 PM, John R. Levine <johnl@iecc.com> wrote:

I'm simply saying that if you are worried about preventing criminals from

...

registering tons of domains as the article describes, then the policy discussion will have to be broader than what Danny's prescription allows.

Personally, I think that the registrar should send a verification code to the paper mailing address provided by the registrant, and not activate the domain until the registrant receives the code and shows (probably by web or email response) that he or she has received it.

I realize this would make the registration process considerably slower and somewhat more expensive, but I see no public interest reason why that's a bad thing.

R's, John

------ NA-Discuss mailing list NA-Discuss@atlarge-lists.icann.org

http://atlarge-lists.icann.org/mailman/listinfo/na-discuss_atlarge-lists.ica...

Visit the NARALO online at http://www.naralo.org ------

-- NOTICE: The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. If you have received this communication by error, please notify us immediately by e-mail, and delete the original message.

So if I live in the middle of nothing (where I can not receive paper mail) I will not be able to register any domains? That effectively will exclude some people of doing legitimate business through the Internet.

Could you identify some places where people live that have ISPs but no postal mail? R's, John

These situations are exceptions, rather than the rule. I would venture a guess that these folks are not businesses for the most part. I feel it is wrong that the minority position is the criteria for the majority. Exceptions can be made for those in the exceptional conditions. We are looking at this with no hard data, which makes it difficult to come to an intelligent decision. The best we can really do is decide on a philosophical position (or a policy), then look for problems with it. ===== During this conversation, no mention has been made that whois data accuracy is the rule (contract rule) and to advocate changing the rule is one thing and advocating breaking the rule is quite another. --bob On Wed, 16 Sep 2009, Eduardo Diaz wrote:

Date: Wed, 16 Sep 2009 09:32:44 -0400 From: Eduardo Diaz <eduardodiazrivera@gmail.com> To: John R. Levine <johnl@iecc.com> Cc: NA Discuss <na-discuss@atlarge-lists.icann.org> Subject: Re: [NA-Discuss] Domain-name abuse proliferates

Let me see... I have a friend that lives in the middle of a mountain here in Puerto Rico, he does not get postal mail but uses a satellite link to connect to the Internet. I am pretty sure this is the case in other places (like I witness in Peru).

-ed

On Tue, Sep 15, 2009 at 7:29 PM, John R. Levine <johnl@iecc.com> wrote:

...

So if I live in the middle of nothing (where I can not receive paper mail)

...

I will not be able to register any domains? That effectively will exclude some people of doing legitimate business through the Internet.

Could you identify some places where people live that have ISPs but no postal mail?

R's, John