Hacker News Reader

Comment by Sir_Cmpwn | Hacker News Reader

Strange to see everyone sticking up for ICANN here. I'm of the opinion that their rules about WHOIS are harmful. Even if you think that the information should be kept accurate and up to date, is the appropriate recourse for ICANN to really have the site taken down until its resolved? Maybe as a measure of last resort. I would personally wait until they try to renew the domain and make them update the info then.

Another problem is that since WHOIS data is public it's not effectively possible to run a website anonymously. I'd be okay with sharing contact info with limited parties (ICANN, registrar) but forcing people to share this info with the public is nuts. It makes running a website as an individual much more personally risky.

View on HN

As far as I can tell from the article, this issue came up due to a change in the contact information. The changed involved an error that resulted in placeholder contact information being replaced by outdated personal contact information. This error was due to the registrant or registrar.

That left ICANN in a tricky situation. The registrar was pushing them this modified contact information, so they needed verification. Waiting until the next time the domain name is renewed is not a good option because that can be years down the road. That is especially true if this happened immediately after renewal. (The article was not clear whether the auto-renewal of the privacy service occurred during domain name renewal.) This opens up an opportunity to abuse the system.

Of course refusing to changed the DNS records until the updated contact information was verified is an option. It is probably a process error on ICANN's part, a process that is probably more a result of changes to policies than malice. Still, changing the policy does not change things all that much. In that case the registrar would have to take action because the privacy service was not renewed. They would probably end up doing the same thing as ICANN. If they didn't, the system would be ripe for abuse yet again.

The issue is that ICANN shouldn't have to verify that information.

As a customer I only want to interact with my registrar. Why do I even have to talk to ICANN? My registrar can then interact with ICANN if necessary.

To your second point, isn't that exactly what services like Whois Privacy offer? Certainly not fully anonymous but your actual contact info is limited to the registrar and the privacy service (not even ICANN).

So they artificially create a precarious situation and then charge you money for it (or at least, allow registrars to do so). If they just didn't disclose the information publicly without your consent, the whole privacy-as-a-product wouldn't be necessary. But then people would be less rich, I guess.

The issue with that is that from Icann's POV, the privacy service is the owner of the domain. It's not an ideal solution

Aye, and it works well. But I don't think it should have to, and I think ICANN should behave more tactfully when it fails.

Absolutely true re: ICANN's process. I skipped your first point because at first glance your solution didn't seem helpful, but then I couldn't really think of the value/purpose of the current solution, hah.

What makes this complex is that there is ICANN the company and the ICANN community and registrars that offer anonymising service that are not supported by the community.

(Note there is plenty to complain about how ICANN or the community functions.)

For a lot of reasons, it is nice to know who owns a domain and privacy is just an annoying detail. So it is long standing practice that WHOIS information has to be accurate. In theory, the ICANN community can change this. In practice I doubt you would get consensus on that.

That's rules you have to deal with and ICANN (the company) is tasked with enforcing those rules.

Knowing that ICANN enforces these rules, it doesn't make sense for a registry to make random changes to the WHOIS of a domain. If there should be any blame, if a registrar is violating community principles as a service, then be way more careful.

Or as a domain holder, if you want to violate community principles don't complain if that backfires.

And you can think about the other way round: and if a site is doing something wrong, like distributing software, spreading a copy of your book, sharing unconsented nudity, and the list goes on... should you be able to hide behind anonymity?

I would be consider allowing the records to be made available in court by judicial order (i.e. a subpoena). Still not public.

Also, what the servers are doing isn't the domain's business. Traceroute the IP and bring it up with their ISP. Killing the domain isn't going to kill the availability of the content.

... Enter CloudFlare. You're now dealing with a scammer hiding behind Anon-DNS and a Server behind CloudFlare.

The situation is now this:

> what the servers are doing isn't the domain's business

> what the servers are doing isn't CloudFlare's business

The Anon-DNS provider doesn't feel responsible, CloudFlare doesn't feel responsible (while at the same time hosting the authoritative DNS). I can't even tell which jurisdiction these spammers operate from, so it's kind of impossible to do anything about it.

God I hate receiving these stupid "We are just a reverse proxy, we are not responsible" emails from CloudFlare. They most these clowns will do is forward my contact info to the ISP running the criminals' backend servers, which might very well be these same criminals.

Thanks for nothing CloudFlare.

I'm curious, have you ever been mailed a rotting dead rat in a plastic bag before?

Some people have legitimate reasons to not want to be found and the police aren't going to do much with that kind of harassment either.

Similarly, if there is legitimate evidence a "crime" was committed via the website they can seize the domain or the registrar can. "Anonymous DNS" information doesn't get you very far if there is a legitimate court case.

> Some people have legitimate reasons to not want to be found

That's definitely true!

But let's say a crime has been or is being committed (and I am not sure why you're putting it in quotes) via a website who's contact information is available via WHOIS and which is served from a legitimate ISP.

The usual route to take is to contact the registrar and the ISP with the info that this-and-that is happening. Usually, after a short period of time the registrar or ISP will agree (or not!) that whatever is going on is not acceptable on their network, and then take appropriate action. That even works for privacy oriented ISPs in Island, where they are under not legal obligation to do anything.

This is what I've been doing for many years when I come across illegal content, spam, botnets, phishing, and so on.

Sometimes networks do not cooperate and then usually it possible to block their net ranges as a means to make them realize hosting botnets isn't maybe so great.

But with the combination of ButtFlare and certain Whois privacy hosters, this is not possible. ButtFlare is too large to just block, and ButtFlare just doesn't give any fucks. They aren't a beacon of light upholding freedom of speech on the internet, they are just too cheap to actually have anyone deal with these sort of reports seriously, so they, instead of reading what I report to them, report with the same canned response:

> We are just a proxy. We are responsible for nothing.

The absolute maximum they are willing to do, is forward my request to the upstream ISP, which for safety reasons is unacceptable.

So you see, I do understand the legitimate need to not be found.

I just think that if you run a service as your main business, then you are responsible for what your service is offering.

Ebay somehow manages to not be a marketplace for anonymous heroin deals, I'm holding CloudFlare to the same standard.

> ButtFlare

+1 for that alone. I've fond memories of the Cloud2Butt extension.

note to self: this extension changes the text in textareas ...

To play devils advocate many other publishers must publicly acknowledge who they are and who owns them - why should the internet be diferent.

As do public companies.

If a site is doing something that's illegal in one jurisdiction and protected in another, then what?

(e.g. sharing Falun Gong material, or for a more controversial example Wikileaks)

That is a loaded question, but still the answer is "of course".

If ICANN can seize a domain for a clerical error, they can seize one for a crime. If measured by the American standard of innocence first, then a 3rd party would make & prove their claim and the 3rd party would have the domain seized or defend themselves.

Also, I could beat the current system with a gmail account and a vanilla visa gift card.

What about this loaded question, which is also as absurd:

Shouldn't piracy claims and "alleged" victims of revenge-porn post and a continually update their contact info publicly online. Should you be able to hide behind anonymity(1).

1. There is a difference between anonymity, and non-public.

People sharing illegal things are likely to sign up with bogus information.

The authorities have access to that information anyway.

There's nothing wrong with distributing software or spreading a copy of my book.

Reply on news.ycombinator.com