Hacker News Reader

Comment by lucb1e | Hacker News Reader

The article speaks about "the critical Whois service". Can anyone tell me what it's critical for? I can think of two reasons:

    - abuse contact info
    - registration date

(The latter is used in spam score calculations, I've heard.)

Neither of those are the registrant's private information. I don't understand why we're pushing to have private data in a public directory in the first place. (I never understood this, but being young, I first registered a domain around 2008, long after it was common to ring Joe from USAF up because their FTP was down.) The registrar has to store it for billing anyway, so if a domain is used for something illegal, the police can get at the info anyway...

View on HN

Exactly my thoughts, if Whois can die in the process, it won't be missed by anybody. It's been useless at its purpose since the early 2000's at least. There's no point in keeping it, GDPR or not... I can't even think of a non-spam application these days.

Sometimes I want to email the domain owner to see if they are interested in selling their domain. I don’t see this as spam personally because the emails are always bespoke and “hand written” making a specific case. What would you advise be done in this situation instead?

If the domain owner doesn't provide an email on the website reached through the respective domain itself it's probably a signal that they don't want to be approached.

So ideally, in case they don't provide an email, one would not do that.

I have purchased a number of websites from individuals who have had a private Whois or no means of contact listed on their website. It requires a significant amount of sleuthing but the point is these people all sold their sites anyway. You may not ever be actively looking to sell but it’s short sighted to not provide a means of contact for an asset that has value and can be sold.

You might find it short sighted, but that does not mean that people shouldn't have a choice.

I get offers for my domains, all unwanted.

If I at some point decide to sell one of those to one of them, all the cold approaches from the past don't suddenly get legitimized.

edit: as I'm writing this, I remember that this is quite similar to the selling of social media IDs. Some random crypto start up decided that they should try to bully me to sell them my three letter Twitter handle. Really annoying.

The same reasoning should then apply to everything you own: there should be an organization forcing you to put your email address or phone number on your car, on your house, ... Even if you have no plans to sell those assets, let people contact you if they want to buy them (or help you sell them).

My county assessor's office maintains a database of property owners in my area and their contact information. They have a convenient website where I can access this information at any time.

My state department of motor vehicles maintains a database of vehicles registered in the state and the contact information for their owners. While they do not have a convenient website for querying this data themselves, they make it available to third parties in bulk, and I can obtain individual records for those third parties convieniently using their websites.

Both these databases are mandated by my state legislature. So it seems the same reasoning does apply.

One difference is that the state also provides title to these assets, with all the legal protection that this does (or does not) imply.

Another difference is that this contact information does not, AFAIK, include recipient-paid [1] contact methods such as mobile phone (including text) and e-mail. Also, methods such as phone are generally considered far more intrusive that, for example, paper mail.

[1] nowadays this is mosty nominal, but we're not quite at zero

> If the domain owner doesn't provide an email on the website reached through the respective domain itself it's probably a signal that they don't want to be approached.

Not true. Many people don't realize the value of what they have. And/or they won't see a message because of spam etc (could argue that this happens with whois also but generally the more clues the better).

Note that with physical real estate it is often purchased by someone wanting a property that has no sale sign. Also (per my other comment) there are many people who don't know the value of what they have.

So it's not a signal at all in many cases (I have over 2 decades of first hand knowledge of this btw.)

Besides it all comes down to price. You may not want to sell your house but if someone comes to offer you 3x what you paid you might listen to them. You may 'not want to sell' for what the market price is. Selling prices for domains are all over the map.

If it's important enough, I guess the registrar could be used as relay.

But I do see your point. On the one hand, I'd suggest an optional "reach the owner" part of whois, where one could list a physical or digital address (doesn't even have to be email, I sometimes list social network presence on "about" pages as contact method for unimportant sites, to prevent spam). But on the other hand, we already have a place where you can optionally put your contact details: the very website we're talking about. And there you can apply any anti-spam measures you want, which you cannot do if it's in a public directory somewhere.

I think it's fine if people have to publish their contact info themselves.

> If it's important enough, I guess the registrar could be used as relay.

If the registrar is in the middle, they have a considerable interest in failing to deliver sales inquiries, because they will tend to lose out on them. Same with certain types of abuse inquiries. The registrar has a conflict of interest with most forms of legitimate inquiry on a domain. If the registrar allows unfiltered messages, or messages whose content is entirely unknown to the registrar, then you're back to square one, because the end address ultimately has to filter the spam.

Trivially solved by a postalesque method.

Simply write delivery into the contract, and require fees paid to the registrar from any party sending mail through the service (i.e. stamps).

Critically, if one were going to do this, allow the domain owner to black hole all communication via this path if they're not interested.

Write to {info,admin,webmaster}@...

I would say most domain owners don't have any of that setup. So any emails sent to any address at that domain will fail to send.

Intellectual property attorneys have fought the most to keep whois data public and accurate.

Those who buy and sell domains are another group who are annoyed that it is no longer public. They can easily solve the sell-side issue but when they want to buy a domain, if the owner is not specifically trying to sell it then it becomes more difficult to get ahold of them to make an offer.

This is exactly true. (And it makes sense given who you are. I remember your name from the formation of ICANN btw.)

However I will add something else.

If it becomes hard for people/companies/startups who want to buy domains (.com as you know is all that typically counts) (or for brokers etc) then there will be a shift away from .com because of that frustration. Right now people start perhaps with another TLD but once they get successful they try to get .com almost always. And that supports the market price of .com

So sure the big time people (who charge 'high' prices) will make it possible to be reached. However there is another tier that either forgets to put up contact info (or it's out of date on a web page that gets spam) or does not even know they have something of value. Those owners, if they can't be reached, will miss out. And the buyers would be more likely to then go for another TLD. Hence .com in general could loose value. [1] Not overnight but will happen.

[1] I both own domains (since 90's) and help people buy domains. This is actually my big concern with 'help people buy domains'.

I'd be perfectly fine with IP attorneys having to go through law enforcement to get the law enforced.

As for buying and selling a domain, I've commented on that in an earlier sibling thread:

> If it's important enough, I guess the registrar could be used as relay.

>But I do see your point. On the one hand, I'd suggest an optional "reach the owner" part of whois, where one could list a physical or digital address (doesn't even have to be email, I sometimes list social network presence on "about" pages as contact method for unimportant sites, to prevent spam). But on the other hand, we already have a place where you can optionally put your contact details: the very website we're talking about. And there you can apply any anti-spam measures you want, which you cannot do if it's in a public directory somewhere.

> I think it's fine if people have to publish their contact info themselves.

At https://news.ycombinator.com/item?id=17483637

Apparently enough phishers/spammers are actually dumb enough to not use whoisguard

https://www.recordedfuture.com/whois-gdpr-icann/

The reason that security researchers have had success with using WHOIS data is twofold. The first is that many attackers, even sophisticated attackers, have had poor OPSEC (operational security) when it comes to registering domains. A surprisingly large number of attackers simply didn’t bother to take steps to hide their identity or create unique, fake aliases when registering domains. Spammers were notoriously bad at hiding their identity, making it easy to identify newly registered domains as belonging to a known spammer and immediately adding it to block lists and real-time blackhole lists (RBLs).

Secondly, even attackers who realized their mistake and changed the WHOIS information of their domains after the fact, or added privacy services to the domain, were out of luck because certain companies, such as DomainTools, keep track of historical WHOIS data, and researchers could easily see the original WHOIS information.

It's absolutely critical for network engineers.

Think figuring out who a given prefix belongs to, what routes are advertised by an AS, what BGP communities does an AS honor, how to contact an organization's NOC ...

(yes, whois is for more than just domain names)

I didn't know that this was part of WHOIS, I thought separate services such as BGP looking glasses provided this. And other organizations (IANA and RIRs iirc) hand out AS numbers and prefixes. But even if it were part of WHOIS, then this is non-personal information which should be fine to list in a public directory.

These decisions don't touch upon the listing of corporate information. Unless a private person operates an AS, this is not an issue for the things you mentioned.

Presumably that doesn't entail saying "you must provide your true mailing address, name, and phone number or we yank your domain". A working email address should be all that is required, at most.

I still call and expect calls as a domain admin, you shouldn't have to go to the police to get something resolved.

There are a bunch of people in this thread claiming that "WHOIS ... won't be missed" or "nobody uses WHOIS properly these days", and it just gives me the impression that a) they operate delinquent, abusive domains for which they receive calls or b) they think that because they haven't used WHOIS productively, they never will. You'll miss opiates when you're in pain.

For what kinds of issues do you call the number listed in the whois? I've never thought of doing that so genuinely curious.

Reply on news.ycombinator.com