6 ms·

One month to adapt? They have had two years. Also, I fail to see how this is a problem, considering that quite a few domains nowadays seem to use WhoisGuard or

One month to adapt? They have had two years. Also, I fail to see how this is a problem, considering that quite a few domains nowadays seem to use WhoisGuard or a similar service anyway.

Crosseye_Jack 9y ago
>I fail to see how this is a problem... Some TLD's don't allow proxy registrations. whois privacy being a service extra (sometimes included for free sometimes a paid extra which can expire and expose your data if you miss the email) where other TLD's (.uk springs to mind) already have the ability to withheld the personal details of domain registrants (private individuals have the ability to held their data, company registrations have their data shown) at the registry level and not having to use a 3rd party company.
- martin-adams 9y ago
  Is there a difference between proxy registrations and not making the registrant information public?
  - Crosseye_Jack 9y ago
    Well your still seen as the owner of the domain in the register’s eyes and not a proxy company which may help if you need to transfer the domain away from your registar for any unexpected reason.
  - mschout 9y ago
    I am an engineer working for a registrar and we've been told by at least one TLD that there is no difference. We used to "mask" the registrant email regardless of whether or not the customer had opted-in for proxy registration, and we were told this was not allowed by the TLD operator.
return1 9y ago
> I fail to see how this is a problem, > seem to use WhoisGuard or a similar service anyway So it was always a problem, now it is also illegal
mtgx 9y ago
WhoisGuard is not usually free, except for the first year in some cases.
sgift 9y ago
> They have had two years. Even longer if you consider the time GDPR was worked on. The writing has been on the wall for a really long time, so asking for an interim arrangement is really barefaced.
- merinowool 9y ago
  Are you saying GDPR was ready then? How come if today it is not clear and has ambiguous interpretations or lack of?
  - icebraining 9y ago
    All complex laws have ambiguous interpretations.
    - merinowool 9y ago
      All bad laws. edit: I am not saying the idea behind GDPR is bad - it is amazing. But execution is really bad.
      - icebraining 9y ago
        I disagree; all complex laws. That's the main reason for the existence of supreme courts; to decide on a reading when courts below disagree ("circuit split", in the US).
        merinowool 9y ago
        Right. It shouldn't be okay to push bad (in the sense: incomplete, not researched enough etc.) laws because there is supreme court.
        icebraining 9y ago
        My claim is that you can't avoid it. It's like trying to write a large program with zero bugs without being able to test it. Citing Knuth, "beware of bugs in the above code; I have only proved it correct, not tried it." To put it another way: can you cite any complex bill that hasn't ever gone to the Supreme Court?
peoplewindow 9y ago
Hardly. ICANN is not an EU organisation. The idea that GDPR is a global law is a new thing. Also, The letter also has harsh words for ICANN's proposed interim solution, criticizing its vagueness Of all the people to criticize others for vagueness, EU data protection people are the very last who should be talking. GDPR is nothing but vagueness.
- detaro 9y ago
  It's not like WHOIS wasn't problematic before, e.g. even inside ICANN people have been pointing out conflicts with data protection laws for over a decade. And ICANN not being from regions with stricter regulation isn't actually that relevant, since ICANN doesn't directly run WHOIS. The registries and registrars do it, many of which are in the stricter jurisdictions. GDPR being globally applied certainly ups the overall pressure, and is the reason they want to change the overall wHOIS rules instead of making special rules for individual countries, but the key thing seems to be the fear that there actually might be painful fines now.
- _o_ 9y ago
  The problem is that you don't understand GDPR. Please watch first few minutes of this: https://youtu.be/-stjktAu-7k?t=399 https://youtu.be/-stjktAu-7k?t=399 (or even whole, it explains a lot of things)
spydum 9y ago
I would bet substantial number of companies have not even begun GDPR compliance until around Q3 2017. It would be interesting to see the prevelance of GDPR in quarterly earnings call transcripts over time..
- bunderbunder 9y ago
  Judging by the volume of sales people contacting me at work, I would bet a substantial number of companies have not even begun GDPR compliance until at least Q2 2018.
  - twunde 9y ago
    Yeah, but how many are just US-based without an office in the EU or a real presence in the EU? ICANN is an international organization with a regional office in the EU and an engagement center, with EU customers representing a big chunk of sales/revenue. There's really no excuse for ICANN, whereas if you're a SASS company based in the US, which may have 10% of revenue coming from the EU, it's more understandable.
    - merinowool 9y ago
      You still have to implement it in case you are visited by EU national (even if that is just a person visiting the site without intention to buy) - as you shouldn't log EU personal data without permission. Even if you filter out European IP addresses you have to consider that EU national can be visiting from the US for example and you still cannot log without permission.
merinowool 9y ago
How can you work on something that is not ready even now?
- jacquesm 9y ago
  It's been ready for ages, it just doesn't come into effect until May.
  - merinowool 9y ago
    It comes into effect incomplete. Companies still don't know what to do. There are tons of questions unanswered and nobody knows how to be compliant.
    - jacquesm 9y ago
      The only people that seem to have this problem are: (1) the ones that didn't bother to read the text of the law (which is surprisingly accessible) and (2) armchair lawyers that come up with all kinds of outrageous edge cases that nobody really cares about but that then get used to discard the law saying it's incomplete and that 'nobody knows how to be compliant'. For real businesses that are affected by the law the vast majority of the impact is crystal clear and if they've done their homework they'll be more-or-less compliant by May and will at least be able to prove they made a good effort to comply. I really should work up a to-do list that will get the average SaaS start-up to 90% compliance with the minimum amount of work.
      - dangrossman 9y ago
        Here's a to-do list to help people get started today: https://gdprchecklist.io/ https://gdprchecklist.io/
    - krageon 9y ago
      This is false. There are third parties specialised in getting you compliant if you're unsure what to to - you can send your (legal/technical) questions to them and they answer you. It still baffles me to this day that people just lie/spread misinformation on the internet (yes, there is a relevant XKCD for this) yet here we are.

One month to adapt? They have had two years. Also, I fail to see how this is a problem, considering that quite a few domains nowadays seem to use WhoisGuard or a similar service anyway.

Crosseye_Jack 9y ago

>I fail to see how this is a problem... Some TLD's don't allow proxy registrations. whois privacy being a service extra (sometimes included for free sometimes a paid extra which can expire and expose your data if you miss the email) where other TLD's (.uk springs to mind) already have the ability to withheld the personal details of domain registrants (private individuals have the ability to held their data, company registrations have their data shown) at the registry level and not having to use a 3rd party company.

martin-adams 9y ago
Is there a difference between proxy registrations and not making the registrant information public?
- Crosseye_Jack 9y ago
  Well your still seen as the owner of the domain in the register’s eyes and not a proxy company which may help if you need to transfer the domain away from your registar for any unexpected reason.
- mschout 9y ago
  I am an engineer working for a registrar and we've been told by at least one TLD that there is no difference. We used to "mask" the registrant email regardless of whether or not the customer had opted-in for proxy registration, and we were told this was not allowed by the TLD operator.

return1 9y ago

> I fail to see how this is a problem, > seem to use WhoisGuard or a similar service anyway So it was always a problem, now it is also illegal

mtgx 9y ago

WhoisGuard is not usually free, except for the first year in some cases.

sgift 9y ago

> They have had two years. Even longer if you consider the time GDPR was worked on. The writing has been on the wall for a really long time, so asking for an interim arrangement is really barefaced.

merinowool 9y ago
Are you saying GDPR was ready then? How come if today it is not clear and has ambiguous interpretations or lack of?
- icebraining 9y ago
  All complex laws have ambiguous interpretations.
  - merinowool 9y ago
    All bad laws. edit: I am not saying the idea behind GDPR is bad - it is amazing. But execution is really bad.
    - icebraining 9y ago
      I disagree; all complex laws. That's the main reason for the existence of supreme courts; to decide on a reading when courts below disagree ("circuit split", in the US).
      - merinowool 9y ago
        Right. It shouldn't be okay to push bad (in the sense: incomplete, not researched enough etc.) laws because there is supreme court.
        icebraining 9y ago
        My claim is that you can't avoid it. It's like trying to write a large program with zero bugs without being able to test it. Citing Knuth, "beware of bugs in the above code; I have only proved it correct, not tried it." To put it another way: can you cite any complex bill that hasn't ever gone to the Supreme Court?

peoplewindow 9y ago

Hardly. ICANN is not an EU organisation. The idea that GDPR is a global law is a new thing. Also, The letter also has harsh words for ICANN's proposed interim solution, criticizing its vagueness Of all the people to criticize others for vagueness, EU data protection people are the very last who should be talking. GDPR is nothing but vagueness.

detaro 9y ago
It's not like WHOIS wasn't problematic before, e.g. even inside ICANN people have been pointing out conflicts with data protection laws for over a decade. And ICANN not being from regions with stricter regulation isn't actually that relevant, since ICANN doesn't directly run WHOIS. The registries and registrars do it, many of which are in the stricter jurisdictions. GDPR being globally applied certainly ups the overall pressure, and is the reason they want to change the overall wHOIS rules instead of making special rules for individual countries, but the key thing seems to be the fear that there actually might be painful fines now.
_o_ 9y ago
The problem is that you don't understand GDPR. Please watch first few minutes of this: https://youtu.be/-stjktAu-7k?t=399 https://youtu.be/-stjktAu-7k?t=399 (or even whole, it explains a lot of things)

spydum 9y ago

I would bet substantial number of companies have not even begun GDPR compliance until around Q3 2017. It would be interesting to see the prevelance of GDPR in quarterly earnings call transcripts over time..

bunderbunder 9y ago
Judging by the volume of sales people contacting me at work, I would bet a substantial number of companies have not even begun GDPR compliance until at least Q2 2018.
- twunde 9y ago
  Yeah, but how many are just US-based without an office in the EU or a real presence in the EU? ICANN is an international organization with a regional office in the EU and an engagement center, with EU customers representing a big chunk of sales/revenue. There's really no excuse for ICANN, whereas if you're a SASS company based in the US, which may have 10% of revenue coming from the EU, it's more understandable.
  - merinowool 9y ago
    You still have to implement it in case you are visited by EU national (even if that is just a person visiting the site without intention to buy) - as you shouldn't log EU personal data without permission. Even if you filter out European IP addresses you have to consider that EU national can be visiting from the US for example and you still cannot log without permission.

merinowool 9y ago

How can you work on something that is not ready even now?

jacquesm 9y ago
It's been ready for ages, it just doesn't come into effect until May.
- merinowool 9y ago
  It comes into effect incomplete. Companies still don't know what to do. There are tons of questions unanswered and nobody knows how to be compliant.
  - jacquesm 9y ago
    The only people that seem to have this problem are: (1) the ones that didn't bother to read the text of the law (which is surprisingly accessible) and (2) armchair lawyers that come up with all kinds of outrageous edge cases that nobody really cares about but that then get used to discard the law saying it's incomplete and that 'nobody knows how to be compliant'. For real businesses that are affected by the law the vast majority of the impact is crystal clear and if they've done their homework they'll be more-or-less compliant by May and will at least be able to prove they made a good effort to comply. I really should work up a to-do list that will get the average SaaS start-up to 90% compliance with the minimum amount of work.
    - dangrossman 9y ago
      Here's a to-do list to help people get started today: https://gdprchecklist.io/ https://gdprchecklist.io/
  - krageon 9y ago
    This is false. There are third parties specialised in getting you compliant if you're unsure what to to - you can send your (legal/technical) questions to them and they answer you. It still baffles me to this day that people just lie/spread misinformation on the internet (yes, there is a relevant XKCD for this) yet here we are.