Hacker News Reader

Comment by ggm | Hacker News Reader

I work in a registry which has whois obligations over number resources and I find this very troubling. I'm not going to say there is no right to privacy here, but I suspect states inside the EU will be seeking high privileged rights to information not in whois, come what may. So, this disempowers people seeking redress from harm as outsiders but doesnt stop state actors or lawyers or police.

Apart from my dayjob I have whois objects in DNS registries so i know there is the other side of the coin. I see the bad stuff from choosing not to hide my ID.

View on HN

I'm fine with governments being the only ones who can view domain registration details. Heck, I'd be fine with nobody having access, forget the whole whois system: if the government needs to find who runs freemovies.example.net, they can ask (or subpoena) whoever was paid to register it (i.e. the registrar).

As far as I understand, the WHOIS system was made in the 80s when it was useful to be able to look and ring someone up. Literally everything was in beta on the arpanet, and direct communication makes debugging a lot easier. But it's 2018, and I do not want 4chan to be able to look up my home address in that system. That creates more mayhem than it's worth by far.

Thinking about what use I ever had from the whois system, I guess it's only abuse email addresses for IP addresses. And I hear that people make use of the registration date of domains to calculate spam scores. Neither of those require the registrant's private information to be in there.

Problem is, some domain and number holders have no incorperated body: they hold the resource as a private individual. Hard to formulate consistent data law around WHOIS when its both people, and corporate entities.

I was in the WHOIS as was from SRI-NIC. I kept GM85 in my current nic-hdl for resources as a memory of the days gone by: they even published a paper copy of the listing.. the phone book of the internet, how .. quaint.

Yes, the protocol is designed for days gone by. but the GDPR laws apply to RDAP, even though it has HTTPS and could in principle use Oauth or similar to constrain whats shown to open access.

I don't understand the problem. You say the problem is that both individuals and companies register domains, but why should the info of either be visible in a public database?

So that people who are seeking redress can find who holds the resource. That's what whois is mostly about: redress. I'm not trying to defend that against peoples rights to privacy I'm observing there's a significant community of interest in "who did that" if you don't believe that's necessary then you win with GDPR. If you do, then the masking means you cannot know, but lawyers and judges and police and governments can.

> some domain and number holders have no incorperated body: they hold the resource as a private individual

whois has been useful to me in the past for finding out whether a DNS name is held by the foundation/company/trust/whatever or if it's held by a private individual who set up the foundation/trust/whatever. When a whois lookup shows a certain private individual listed as owner, admin, and tech contact for some DNS name, then I can know the foundation is a sham created to make it look like the open source product is community controlled, when in fact it's really just one narcissist pulling the strings.

I say keep the whois service as is.

> I'm fine with governments being the only ones who can view domain registration details.

Which governments, where, and at what time? North Korea has a NIC, so does Eritrea. Should the dictator of Eritrea have more privileged access to your WHOIS information than somebody who could actually give you a productive tip? (i.e. "Hey, your mailserver keeps trying to relay this message, which is not destined for where it's being routed", or "a host under your domain is ICMP flooding my IoT gateway, maybe you have an unwanted access on your hands"). I've used WHOIS productively in the last year, and WHOIS proxies work to get your address off the registry, I just don't think that the actual owner of the domain (you, domains by proxy, etc.) should be permitted to register a domain without somebody being directly responsible for its behaviour in some way which is a step before a civil suit (which seems to be the only way your system would work). You need an address for your corporation as well, it's mostly the same idea.

There is no reason that domain providers will be incapable of providing a contact point and you were always able to put a separate email inbox on WHOIS.

But there is no need for a full postal address of real email addresses that people might use for personal contacts or a real name. That just leads to more abuse.

Same for phone numbers.

> There is no reason that domain providers will be incapable of providing a contact point and you were always able to put a separate email inbox on WHOIS.

The registrars have an interest in not delivering requests for sale or even abuse reports, because it's likely that they will result in the domain either being decommissioned or moved to another registrar.

I have no problem with the former but they do have incentive for the later as not delivering the abuse reports will lead to the domain being decommissioned because it's on every spam and blacklist ever.

WHOIS Privacy Services have been doing exactly this for a long time and they are usually paid by the domain registrar.

I think that problem is more imagined since there doesn't seem to be this problem in the real world.

> WHOIS Privacy Services have been doing exactly this for a long time and they are usually paid by the domain registrar.

Yes, but crucially they are not the domain registrar, and that's because this was already a problem.

And then what is the problem with continuing this but reinforcing this business structure? Because shitty registrars could now be more shitty?

Honest and good registrars don't have a problem with WHOIS services, you claim they would since the emails they forward could lead to lost sales.

The WHOIS service is just as incentivized to filter out certain mails since they are paid by the registrar and thus get profit of sold domains.

Reply on news.ycombinator.com