Subject: [domainrep] When BoFs collide

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 1 Aug 2011 23:12:39 -0700

In addition to the REPUTE BoF in Quebec City (thanks to those of you who showed up; the room was overflowing), reputation popped up in a couple of other interesting areas.  One of these was in the WEIRDS BoF, where the idea of starting work to replace WHOIS was considered.

Specifically, security service providers (e.g., anti-spam companies and the like) benefit from gathering some operational data about a domain or a network delegation from WHOIS.  Information like which nameservers are in use, to whom they are registered (for correlation, not for identification), registration dates, etc. are all very useful in determining how likely or not a particular source is to be abusive.  These are valuable data points for reputation when evaluating either kind of registry object.

But not only was that fairly obvious point made, but also there are rumoured to exist some registries, domain and network alike, that are (to put it politely) somewhere below the desired standards of behaviour in terms of making usable data available via WHOIS, if they provide any at all (or even provide it truthfully).  So not only is the reputation of the registry object of interest, but so too is the reputation of the registry itself.

Something to consider as this work develops.  It's clear from the BoF discussion that we probably want to limit our initial charter scope to be the email domain space, but I believe we should continue with a framework that's easily extensible into these other areas that several people have identified as being potentially very interesting.

-MSK