5 ms·

Strange to see everyone sticking up for ICANN here. I'm of the opinion that their rules about WHOIS are harmful. Even if you think that the information should b

Strange to see everyone sticking up for ICANN here. I'm of the opinion that their rules about WHOIS are harmful. Even if you think that the information should be kept accurate and up to date, is the appropriate recourse for ICANN to really have the site taken down until its resolved? Maybe as a measure of last resort. I would personally wait until they try to renew the domain and make them update the info then. Another problem is that since WHOIS data is public it's not effectively possible to run a website anonymously. I'd be okay with sharing contact info with limited parties (ICANN, registrar) but forcing people to share this info with the public is nuts. It makes running a website as an individual much more personally risky.

woliveirajr 10y ago
And you can think about the other way round: and if a site is doing something wrong, like distributing software, spreading a copy of your book, sharing unconsented nudity, and the list goes on... should you be able to hide behind anonymity?
- Sir_Cmpwn 10y ago
  I would be consider allowing the records to be made available in court by judicial order (i.e. a subpoena). Still not public. Also, what the servers are doing isn't the domain's business. Traceroute the IP and bring it up with their ISP. Killing the domain isn't going to kill the availability of the content.
  - yosamino 10y ago
    ... Enter CloudFlare. You're now dealing with a scammer hiding behind Anon-DNS and a Server behind CloudFlare. The situation is now this: > what the servers are doing isn't the domain's business > what the servers are doing isn't CloudFlare's business The Anon-DNS provider doesn't feel responsible, CloudFlare doesn't feel responsible (while at the same time hosting the authoritative DNS). I can't even tell which jurisdiction these spammers operate from, so it's kind of impossible to do anything about it. God I hate receiving these stupid "We are just a reverse proxy, we are not responsible" emails from CloudFlare. They most these clowns will do is forward my contact info to the ISP running the criminals' backend servers, which might very well be these same criminals. Thanks for nothing CloudFlare.
    - fweespeech 10y ago
      I'm curious, have you ever been mailed a rotting dead rat in a plastic bag before? Some people have legitimate reasons to not want to be found and the police aren't going to do much with that kind of harassment either. Similarly, if there is legitimate evidence a "crime" was committed via the website they can seize the domain or the registrar can. "Anonymous DNS" information doesn't get you very far if there is a legitimate court case.
      - yosamino 10y ago
        > Some people have legitimate reasons to not want to be found That's definitely true! But let's say a crime has been or is being committed (and I am not sure why you're putting it in quotes) via a website who's contact information is available via WHOIS and which is served from a legitimate ISP. The usual route to take is to contact the registrar and the ISP with the info that this-and-that is happening. Usually, after a short period of time the registrar or ISP will agree (or not!) that whatever is going on is not acceptable on their network, and then take appropriate action. That even works for privacy oriented ISPs in Island, where they are under not legal obligation to do anything. This is what I've been doing for many years when I come across illegal content, spam, botnets, phishing, and so on. Sometimes networks do not cooperate and then usually it possible to block their net ranges as a means to make them realize hosting botnets isn't maybe so great. But with the combination of ButtFlare and certain Whois privacy hosters, this is not possible. ButtFlare is too large to just block, and ButtFlare just doesn't give any fucks. They aren't a beacon of light upholding freedom of speech on the internet, they are just too cheap to actually have anyone deal with these sort of reports seriously, so they, instead of reading what I report to them, report with the same canned response: > We are just a proxy. We are responsible for nothing. The absolute maximum they are willing to do, is forward my request to the upstream ISP, which for safety reasons is unacceptable. So you see, I do understand the legitimate need to not be found. I just think that if you run a service as your main business, then you are responsible for what your service is offering. Ebay somehow manages to not be a marketplace for anonymous heroin deals, I'm holding CloudFlare to the same standard.
        10y ago
  - walshemj 10y ago
    To play devils advocate many other publishers must publicly acknowledge who they are and who owns them - why should the internet be diferent. As do public companies.
- jwilk 10y ago
  There's nothing wrong with distributing software or spreading a copy of my book.
- na85 10y ago
  People sharing illegal things are likely to sign up with bogus information.
- return0 10y ago
  The authorities have access to that information anyway.
- pjc50 10y ago
  If a site is doing something that's illegal in one jurisdiction and protected in another, then what? (e.g. sharing Falun Gong material, or for a more controversial example Wikileaks)
- vonklaus 10y ago
  That is a loaded question, but still the answer is "of course". If ICANN can seize a domain for a clerical error, they can seize one for a crime. If measured by the American standard of innocence first, then a 3rd party would make & prove their claim and the 3rd party would have the domain seized or defend themselves. Also, I could beat the current system with a gmail account and a vanilla visa gift card. What about this loaded question, which is also as absurd: Shouldn't piracy claims and "alleged" victims of revenge-porn post and a continually update their contact info publicly online. Should you be able to hide behind anonymity(1). 1. There is a difference between anonymity, and non-public.
cdubzzz 10y ago
To your second point, isn't that exactly what services like Whois Privacy offer? Certainly not fully anonymous but your actual contact info is limited to the registrar and the privacy service (not even ICANN).
- Sir_Cmpwn 10y ago
  Aye, and it works well. But I don't think it should have to, and I think ICANN should behave more tactfully when it fails.
  - cdubzzz 10y ago
    Absolutely true re: ICANN's process. I skipped your first point because at first glance your solution didn't seem helpful, but then I couldn't really think of the value/purpose of the current solution, hah.
- Macha 10y ago
  The issue with that is that from Icann's POV, the privacy service is the owner of the domain. It's not an ideal solution
- dkersten 10y ago
  So they artificially create a precarious situation and then charge you money for it (or at least, allow registrars to do so). If they just didn't disclose the information publicly without your consent, the whole privacy-as-a-product wouldn't be necessary. But then people would be less rich, I guess.
II2II 10y ago
As far as I can tell from the article, this issue came up due to a change in the contact information. The changed involved an error that resulted in placeholder contact information being replaced by outdated personal contact information. This error was due to the registrant or registrar. That left ICANN in a tricky situation. The registrar was pushing them this modified contact information, so they needed verification. Waiting until the next time the domain name is renewed is not a good option because that can be years down the road. That is especially true if this happened immediately after renewal. (The article was not clear whether the auto-renewal of the privacy service occurred during domain name renewal.) This opens up an opportunity to abuse the system. Of course refusing to changed the DNS records until the updated contact information was verified is an option. It is probably a process error on ICANN's part, a process that is probably more a result of changes to policies than malice. Still, changing the policy does not change things all that much. In that case the registrar would have to take action because the privacy service was not renewed. They would probably end up doing the same thing as ICANN. If they didn't, the system would be ripe for abuse yet again.
- zimbatm 10y ago
  The issue is that ICANN shouldn't have to verify that information. As a customer I only want to interact with my registrar. Why do I even have to talk to ICANN? My registrar can then interact with ICANN if necessary.
phicoh 10y ago
What makes this complex is that there is ICANN the company and the ICANN community and registrars that offer anonymising service that are not supported by the community. (Note there is plenty to complain about how ICANN or the community functions.) For a lot of reasons, it is nice to know who owns a domain and privacy is just an annoying detail. So it is long standing practice that WHOIS information has to be accurate. In theory, the ICANN community can change this. In practice I doubt you would get consensus on that. That's rules you have to deal with and ICANN (the company) is tasked with enforcing those rules. Knowing that ICANN enforces these rules, it doesn't make sense for a registry to make random changes to the WHOIS of a domain. If there should be any blame, if a registrar is violating community principles as a service, then be way more careful. Or as a domain holder, if you want to violate community principles don't complain if that backfires.

woliveirajr 10y ago

And you can think about the other way round: and if a site is doing something wrong, like distributing software, spreading a copy of your book, sharing unconsented nudity, and the list goes on... should you be able to hide behind anonymity?

Sir_Cmpwn 10y ago
I would be consider allowing the records to be made available in court by judicial order (i.e. a subpoena). Still not public. Also, what the servers are doing isn't the domain's business. Traceroute the IP and bring it up with their ISP. Killing the domain isn't going to kill the availability of the content.
- yosamino 10y ago
  ... Enter CloudFlare. You're now dealing with a scammer hiding behind Anon-DNS and a Server behind CloudFlare. The situation is now this: > what the servers are doing isn't the domain's business > what the servers are doing isn't CloudFlare's business The Anon-DNS provider doesn't feel responsible, CloudFlare doesn't feel responsible (while at the same time hosting the authoritative DNS). I can't even tell which jurisdiction these spammers operate from, so it's kind of impossible to do anything about it. God I hate receiving these stupid "We are just a reverse proxy, we are not responsible" emails from CloudFlare. They most these clowns will do is forward my contact info to the ISP running the criminals' backend servers, which might very well be these same criminals. Thanks for nothing CloudFlare.
  - fweespeech 10y ago
    I'm curious, have you ever been mailed a rotting dead rat in a plastic bag before? Some people have legitimate reasons to not want to be found and the police aren't going to do much with that kind of harassment either. Similarly, if there is legitimate evidence a "crime" was committed via the website they can seize the domain or the registrar can. "Anonymous DNS" information doesn't get you very far if there is a legitimate court case.
    - yosamino 10y ago
      > Some people have legitimate reasons to not want to be found That's definitely true! But let's say a crime has been or is being committed (and I am not sure why you're putting it in quotes) via a website who's contact information is available via WHOIS and which is served from a legitimate ISP. The usual route to take is to contact the registrar and the ISP with the info that this-and-that is happening. Usually, after a short period of time the registrar or ISP will agree (or not!) that whatever is going on is not acceptable on their network, and then take appropriate action. That even works for privacy oriented ISPs in Island, where they are under not legal obligation to do anything. This is what I've been doing for many years when I come across illegal content, spam, botnets, phishing, and so on. Sometimes networks do not cooperate and then usually it possible to block their net ranges as a means to make them realize hosting botnets isn't maybe so great. But with the combination of ButtFlare and certain Whois privacy hosters, this is not possible. ButtFlare is too large to just block, and ButtFlare just doesn't give any fucks. They aren't a beacon of light upholding freedom of speech on the internet, they are just too cheap to actually have anyone deal with these sort of reports seriously, so they, instead of reading what I report to them, report with the same canned response: > We are just a proxy. We are responsible for nothing. The absolute maximum they are willing to do, is forward my request to the upstream ISP, which for safety reasons is unacceptable. So you see, I do understand the legitimate need to not be found. I just think that if you run a service as your main business, then you are responsible for what your service is offering. Ebay somehow manages to not be a marketplace for anonymous heroin deals, I'm holding CloudFlare to the same standard.
      - 10y ago
- walshemj 10y ago
  To play devils advocate many other publishers must publicly acknowledge who they are and who owns them - why should the internet be diferent. As do public companies.
jwilk 10y ago
There's nothing wrong with distributing software or spreading a copy of my book.
na85 10y ago
People sharing illegal things are likely to sign up with bogus information.
return0 10y ago
The authorities have access to that information anyway.
pjc50 10y ago
If a site is doing something that's illegal in one jurisdiction and protected in another, then what? (e.g. sharing Falun Gong material, or for a more controversial example Wikileaks)
vonklaus 10y ago
That is a loaded question, but still the answer is "of course". If ICANN can seize a domain for a clerical error, they can seize one for a crime. If measured by the American standard of innocence first, then a 3rd party would make & prove their claim and the 3rd party would have the domain seized or defend themselves. Also, I could beat the current system with a gmail account and a vanilla visa gift card. What about this loaded question, which is also as absurd: Shouldn't piracy claims and "alleged" victims of revenge-porn post and a continually update their contact info publicly online. Should you be able to hide behind anonymity(1). 1. There is a difference between anonymity, and non-public.

cdubzzz 10y ago

To your second point, isn't that exactly what services like Whois Privacy offer? Certainly not fully anonymous but your actual contact info is limited to the registrar and the privacy service (not even ICANN).

Sir_Cmpwn 10y ago
Aye, and it works well. But I don't think it should have to, and I think ICANN should behave more tactfully when it fails.
- cdubzzz 10y ago
  Absolutely true re: ICANN's process. I skipped your first point because at first glance your solution didn't seem helpful, but then I couldn't really think of the value/purpose of the current solution, hah.
Macha 10y ago
The issue with that is that from Icann's POV, the privacy service is the owner of the domain. It's not an ideal solution
dkersten 10y ago
So they artificially create a precarious situation and then charge you money for it (or at least, allow registrars to do so). If they just didn't disclose the information publicly without your consent, the whole privacy-as-a-product wouldn't be necessary. But then people would be less rich, I guess.

II2II 10y ago

As far as I can tell from the article, this issue came up due to a change in the contact information. The changed involved an error that resulted in placeholder contact information being replaced by outdated personal contact information. This error was due to the registrant or registrar. That left ICANN in a tricky situation. The registrar was pushing them this modified contact information, so they needed verification. Waiting until the next time the domain name is renewed is not a good option because that can be years down the road. That is especially true if this happened immediately after renewal. (The article was not clear whether the auto-renewal of the privacy service occurred during domain name renewal.) This opens up an opportunity to abuse the system. Of course refusing to changed the DNS records until the updated contact information was verified is an option. It is probably a process error on ICANN's part, a process that is probably more a result of changes to policies than malice. Still, changing the policy does not change things all that much. In that case the registrar would have to take action because the privacy service was not renewed. They would probably end up doing the same thing as ICANN. If they didn't, the system would be ripe for abuse yet again.

zimbatm 10y ago
The issue is that ICANN shouldn't have to verify that information. As a customer I only want to interact with my registrar. Why do I even have to talk to ICANN? My registrar can then interact with ICANN if necessary.

phicoh 10y ago

What makes this complex is that there is ICANN the company and the ICANN community and registrars that offer anonymising service that are not supported by the community. (Note there is plenty to complain about how ICANN or the community functions.) For a lot of reasons, it is nice to know who owns a domain and privacy is just an annoying detail. So it is long standing practice that WHOIS information has to be accurate. In theory, the ICANN community can change this. In practice I doubt you would get consensus on that. That's rules you have to deal with and ICANN (the company) is tasked with enforcing those rules. Knowing that ICANN enforces these rules, it doesn't make sense for a registry to make random changes to the WHOIS of a domain. If there should be any blame, if a registrar is violating community principles as a service, then be way more careful. Or as a domain holder, if you want to violate community principles don't complain if that backfires.