4 ms·

What a completely worthless process.

by jayess 11y ago

WaxProlix 11y ago
The post sure does a lot to paint it that way; makes you wonder what, if anything, is the counterargument?
- colinbartlett 11y ago
  I would really like to understand their side of it, or at least better understand the bureaucratic negotiation nightmare which birthed this policy. I have to guess than ICANN is filled with some very smart people. So their must be some reasoning here.
- jszymborski 11y ago
  There may be a counterargument for the reason for such a process, but the implementation is just dangerous.
- eli 11y ago
  I think it's easy to make an argument for having accurate whois data. But even if you believe in that goal, this is not a great way to achieve it.
  - coldpie 11y ago
    The only thing having accurate whois data did for me was get me junk snailmail. I don't have accurate whois data anymore.
- trombone8 11y ago
  To me, one issue seems to be that ICANN dares to demand of the registrar that they must verify the contact information that is REQUIRED to be present in a registration... that's not really a sane stance to have when you sell a subscription to what is basically an identity, so lets put that aside. One other complains is that this verification procedure is really weak: "just send a mail with a link to the address provided" Imagine if ICANN changed their rules so that a more substantial verification process of the MANDATORY fields was required? Like if they didn't make it optional to verify the telephone number, what would easyDNS do then? From their post, I presume they would go insane, declare Holy war on the ICANN, and then start assaulting ICANN officers with the sharp edges of their ibook 12" They also complain that its a huge phishing opportunity because they must send mails with a link for people to click, but according to the ICANN spec they link to the actual requirement is[1]: """ [...] sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar """ So the mails looking very phish-y is entirely their their own choice, the spec does not mandate that the title is "Look at these funny pictures, friend" or anything. Finally, they complain this will lead to a lot of big sites going down because they are forced to suspend domains if people don't take certain action within a certain time (although they don't clearly argue that the time is too short or something like that). But big sites already go down because the dns owner has been negligent with their interactions with their registrar, like failing to pay their fees for instance. So this is not a new type of problem really, you actually already have good reason to read the mail from your registrar, who knew? (Not Sony online: http://www.pcworld.com/article/2454820/sony-gaming-websites-down-over-unpaid-bills.html http://www.pcworld.com/article/2454820/sony-gaming-websites-...) [1]: https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#whois-accuracy https://www.icann.org/resources/pages/approved-with-specs-20...
  - talideon 11y ago
    I don't blame ICANN for this: this demand came from the law-enforcement agencies. I know that internally, ICANN would've been happy sticking with the existing WDRP process.
    - larrys 11y ago
      Actually has value for law enforcement despite what some commenters seem to be saying here. For example if the contact info is not valid then it would be a quick and easy process to take the site offline for a cooperative registrar.
      - talideon 11y ago
        Law enforcement were still the ones who demanded it. ICANN and the registrars didn't particularly want this. In fact, what the LEAs were originally demanding was full verification and validation of all contact details supplied to the registrar. I know this, because I work for a registrar and was privy to the 2013 RAA negotiations.
        larrys 11y ago
        I also work for a registrar. Keep in mind that the policy is also an opportunity for registrars to charge for taking a domain back off of hold the same way that they can charge for bringing a domain out of redemption over and above what the cost is for doing so.
        talideon 11y ago
        Yup, they can, but monetising that kind of thing would be pretty scummy. After all, section five of the spec states that all we need to do is put it on client hold and prevent outgoing transfers, though we can potentially terminate it by putting it in redemption. Unlike redemption, which is pretty costly, there's no real need to charge people to unsuspend the domain. No doubt, some assholes out there will try it, but I know we won't.

What a completely worthless process.

by jayess 11y ago

What a completely worthless process.

WaxProlix 11y ago

The post sure does a lot to paint it that way; makes you wonder what, if anything, is the counterargument?

colinbartlett 11y ago
I would really like to understand their side of it, or at least better understand the bureaucratic negotiation nightmare which birthed this policy. I have to guess than ICANN is filled with some very smart people. So their must be some reasoning here.
jszymborski 11y ago
There may be a counterargument for the reason for such a process, but the implementation is just dangerous.
eli 11y ago
I think it's easy to make an argument for having accurate whois data. But even if you believe in that goal, this is not a great way to achieve it.
- coldpie 11y ago
  The only thing having accurate whois data did for me was get me junk snailmail. I don't have accurate whois data anymore.
trombone8 11y ago
To me, one issue seems to be that ICANN dares to demand of the registrar that they must verify the contact information that is REQUIRED to be present in a registration... that's not really a sane stance to have when you sell a subscription to what is basically an identity, so lets put that aside. One other complains is that this verification procedure is really weak: "just send a mail with a link to the address provided" Imagine if ICANN changed their rules so that a more substantial verification process of the MANDATORY fields was required? Like if they didn't make it optional to verify the telephone number, what would easyDNS do then? From their post, I presume they would go insane, declare Holy war on the ICANN, and then start assaulting ICANN officers with the sharp edges of their ibook 12" They also complain that its a huge phishing opportunity because they must send mails with a link for people to click, but according to the ICANN spec they link to the actual requirement is[1]: """ [...] sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar """ So the mails looking very phish-y is entirely their their own choice, the spec does not mandate that the title is "Look at these funny pictures, friend" or anything. Finally, they complain this will lead to a lot of big sites going down because they are forced to suspend domains if people don't take certain action within a certain time (although they don't clearly argue that the time is too short or something like that). But big sites already go down because the dns owner has been negligent with their interactions with their registrar, like failing to pay their fees for instance. So this is not a new type of problem really, you actually already have good reason to read the mail from your registrar, who knew? (Not Sony online: http://www.pcworld.com/article/2454820/sony-gaming-websites-down-over-unpaid-bills.html http://www.pcworld.com/article/2454820/sony-gaming-websites-...) [1]: https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#whois-accuracy https://www.icann.org/resources/pages/approved-with-specs-20...
- talideon 11y ago
  I don't blame ICANN for this: this demand came from the law-enforcement agencies. I know that internally, ICANN would've been happy sticking with the existing WDRP process.
  - larrys 11y ago
    Actually has value for law enforcement despite what some commenters seem to be saying here. For example if the contact info is not valid then it would be a quick and easy process to take the site offline for a cooperative registrar.
    - talideon 11y ago
      Law enforcement were still the ones who demanded it. ICANN and the registrars didn't particularly want this. In fact, what the LEAs were originally demanding was full verification and validation of all contact details supplied to the registrar. I know this, because I work for a registrar and was privy to the 2013 RAA negotiations.
      - larrys 11y ago
        I also work for a registrar. Keep in mind that the policy is also an opportunity for registrars to charge for taking a domain back off of hold the same way that they can charge for bringing a domain out of redemption over and above what the cost is for doing so.
        talideon 11y ago
        Yup, they can, but monetising that kind of thing would be pretty scummy. After all, section five of the spec states that all we need to do is put it on client hold and prevent outgoing transfers, though we can potentially terminate it by putting it in redemption. Unlike redemption, which is pretty costly, there's no real need to charge people to unsuspend the domain. No doubt, some assholes out there will try it, but I know we won't.