ICANN Cracks Down on Invalid WHOIS Data

DotNM writes "Internet News reports that ICANN, the Internet Corporation for Assigned Names and Numbers, is beginning a crackdown on invalid data in the WHOIS database. In ICANN's annual report, they found that nearly 5000 of the 24148 complaints were due to inaccurate WHOIS information. Some of the domain names in question had the address information of known spammers in the database. Registrars, the companies you register your domains with, are under contractual obligations to ensure this information is correct and accurate. Do you believe this is a step in the right direction? Why?"

Comments

It's a rule, play by it.

[LostCluster]

Just because a rule has gone unenforced for years doesn't make it an invalid rule. I think the Internet would become a much better place if everybody with bad WHOIS information lost their domains until they corrected it.

Re:It's a rule, play by it.

[mAineAc]

This could definitely lead to some decent domain stealing and lawsuits. Imagine some of the companies that just forgot to update or something we can end up with all sorts of webpages leading to pr0n

Re:It's a rule, play by it.

[Troed]

... it would be a lot more useful if they cracked down on domain-owners not having valid postmaster@ and webmaster@-accounts.

Re:It's a rule, play by it.

[Frater 219]

Absolutely.

The purpose of WHOIS contact information is to allow users and operators of other Internet sites to get in touch with you if your site is causing a problem. The Internet is cooperative, recall -- it could not exist at all without the thousands of sites and networks agreeing to carry each other's traffic. This cooperation requires that operators be able to contact one another in case of a problem. The alternative is that if I see anything even remotely resembling an attack coming from your network, I block your entire network -- regardless of whether you yourself are responsible, or some idiot who signed up as your customer.

If you want cooperation from the rest of the network -- in the form of allowing your traffic rather than blocking it -- you have to be reachable in case of problems. You don't get to operate an Internet site and not be accountable for it, because your site's behavior impacts everyone else on the network.

Your obligation to be reachable to other Internet operators does not go away just because spammers can abuse it -- just as a business's obligation to file incorporation papers (including a physical address) with the state doesn't go away just because the Mafia can search incorporation papers for your business's address and come around to demand protection money. The problem there is the Mafia, not the incorporation papers.

If you are concerned about spammers taking your WHOIS contact information and spamming you, you have reason to be -- spammers will take email addresses from anywhere and abuse them. However, you should recognize that this is the fault of spammers, not WHOIS: put the spammers in jail for computer crime, and the problem goes away.

Re:It's a rule, play by it.

[secolactico]

... it would be a lot more useful if they cracked down on domain-owners not having valid postmaster@ and webmaster@-accounts.

Are they required? What if a domain does not have any MX records? What if it's not used for web purposes?

As someone who gets a copy of both webmaster@ and postmaster@ for about 500 domains let me tell you, all I ever get there is SPAM.

Re:It's a rule, play by it.

[MCZapf]

That's great except for the fact that my domain and the WHOIS information associated with it has nothing to do with "my network." Furthermore, who is going to use my physical address to inform me of problems with my site? I'm sure they'd sooner use email or the phone.

Re:It's a rule, play by it.

[LostCluster]

Get a restraining order, and then when she calls you in violation of said order you can have her arrested... no more problem.

Re:It's a rule, play by it.

[JPriest]

I have registered a total of 4 domains, after using valid information on the first one I refuse to make the same mistake again. My first domain expired in 2001 and I still get credit card offers from it. Like it or not, it is still a public database containing personal information. I can't really blame people for using incorrect information.

Re:It's a rule, play by it.

[nomadic]

I disagree. Let's say I have my own little domain for my homepage. I don't really want everyone on the planet able to access my personal phone number and address.

Re:It's a rule, play by it.

[Anonymous Coward]

postmaster@ is required (RFC822 6.3, C.6), webmaster@ is just a convention, for now.

RFC 2142, "Mailbox Names for Common Services, Roles and Functions" is a proposed standard and includes 'webmaster@', 'abuse@', 'noc@', etc.

Re:It's a rule, play by it.

[morelife]

if everybody with bad WHOIS information lost their domains until they corrected it.

Nah, that would be fruitless.

Most people have put incorrect info for email and street address in whois on purpose - to avoid being the recipient of spam and postal mail, so punishing them by taking a domain away won't help the spam problem at all.

Second, and much more importantly, the WHOIS information if often wrong, outdated or simply has fields missing. Especially in the .ORG domains, after the transition to PIR. And a lot is Network Solutions' fault I think, as they did not transfer updated data in a timely or correct fashion.

How about this: crack down on fucking ICANN, and get rid of the bureaucracy. It's useless, but you never notice it until you need it, like in September when Netsol put up Sitefinder... .02

Re:It's a rule, play by it.

[kryptobiotic]

(never data[sic] a sweedish[sic] chick) I think you mean never stop dating a swedish chick.

Re:It's a rule, play by it.

[Anonymous Coward]

Yeah restraining orders are so effective... NOT!

There's quite a few dead women who can testify to the fact that restraining orders are not worth the paper they are printed on. Oh wait, they're dead so they can't testify to anything.

Re:It's a rule, play by it.

[91degrees]

If you are concerned about spammers taking your WHOIS contact information and spamming you, you have reason to be -- spammers will take email addresses from anywhere and abuse them. However, you should recognize that this is the fault of spammers, not WHOIS:

Well, that's true, but surely it's prudent to take steps to reduce the effectiveness of spammers.

Re:It's a rule, play by it.

[91degrees]

Have you ever tried to get a restraining order? It's really not as easy as it sounds.

And why should someone have to go to this effort? Just because of the beurocratic necessity of having accurate WHOIS information?

Re:It's a rule, play by it.

[blutrot]

Another thing that should be mentioned is it is very easy to forge an email address. I am able to run my own SMTP server and send forged emails to whomever I want (I don't, so don't flame me for that).

Having the WHOIS access, as mentioned on the parent, allows spammers to grab our contact information and use their forged email systems to send out spam. I have heard of cases where an SMTP server will bounce a message back saying to resend in three hours. If the mail is resent in 3 hours, the mail is allowed back through. Similar systems exists that do similar mail authentication. However, I should not have to go through the trouble of going through all these security measures just to keep a person from sending me an email I do not want.

Back to the original context, I believe that WHOIS information should be kept accurate and private. This will allow me, as a user, to run a website on a controvertial topic if I chose to, allows me to be and feel safer from disgruntles readers, and allow authorities to crack down on websites with illegal content.

Re:It's a rule, play by it.

[Ironica]

Get a restraining order, and then when she calls you in violation of said order you can have her arrested... no more problem.

Um... restraining orders typically don't restrain someone from *calling* you. They restrain someone from coming onto your property or within a certain distance of you. In other words, the cops can't do a damn thing with a restraining order until it's too late. "Hi, this guy who I have a restraining order against is on my front lawn, and coming up to my door... and banging it down... and *gurp*"

Re:It's a rule, play by it.

[iminplaya]

...put the spammers in jail for computer crime, and the problem goes away.

Somebody is not learning the lessons of the "failed" drug war. We won't fix anything by locking people up for such petty crimes. Get off the jail thing. It's so middle ages. If you want to make a dent in spamming, just take away their property(including house and car, in fact the food out of the fridge and their clothes too) and empty their bank accounts. Then, if you want to arrest him, get him for vagrancy or public nudity:-)

Re:It's a rule, play by it.

[Fastolfe]

That's great except for the fact that my domain and the WHOIS information associated with it has nothing to do with "my network."

Why not? Your DNS domain should be the naming root for the hosts on the Internet under your control.

If you choose to instead use your DNS domain for your interweb site address, that doesn't exempt you from the rules. There's nothing out there that says you need your own second-level DNS domain for every service "your network" provides, and in fact, there's a mountain of technical literature saying exactly the opposite.

Your organization should get its own DNS domain for its hosts. Nobody is forcing you to make that domain a second-level dot-com.

Somehow the public needs to have a number handy in case a host or user on your DNS domain is causing problems. That doesn't necessarily have to be you, but it needs to be somebody. If you choose to register a DNS domain under a gTLD, then you choose to publish contact information like a responsible Internet entity.

There's nothing saying somebody else can't register on your behalf, and there's nothing saying you can't obtain a DNS domain under someone else's allocation. In both of these situations it would be perfectly acceptable for the person you obtained that resource from to continue to act as the technical contact. But if you go above a typical provider's head and get DNS or network resources directly from a registrar or coordinator and nobody else is stepping up to handle calls on your behalf, you need to deal with it yourself.

Re:It's a rule, play by it.

[Richard_at_work]

Actually, you can have a restraining order restricting the person from having any CONTACT with you, which includes email, phone, physical conversation. You are asking the court to restrain the other party from contacting you. I should know, Ive used one :)

Re:It's a rule, play by it.

[Fastolfe]

That's not going to cut it. What happens when a user or a host on your network is flooding my own with virus traffic or a DDoS? What am I going to do here, subpoena the registrar to get your contact information? That's not going to work. This is not the Interweb. Web sites are not the sole use of DNS domains, they are one service running on one DNS host under a DNS domain.

If you are going to request resources as high as you possibly can in the DNS or network block heirarchy, you must provide contact information so that you can answer to problems that your network is causing. You can't funnel this through the legal system.

You have a couple of alternatives:

1. Get a DNS domain three or more levels down the DNS hierarchy and provide that entity with your contact information. They can be the ones woken up in the middle of the night when your DDoS-infected PC starts causing problems for someone else.
2. Register your DNS domain through a proxy service. They end up being the contact similar to #1, but you get a shiny second-level domain under a gTLD!

Re:It's a rule, play by it.

[TekPolitik]

Just because a rule has gone unenforced for years doesn't make it an invalid rule.

Enforcing this rule for the ".us" domain name is to be required as part of the proposed US-Australia Free Trade Agrement - Chapter 17, Article 17.3

Re:It's a rule, play by it.

[cubicledrone]

If you want to make a dent in spamming, just take away their property(including house and car, in fact the food out of the fridge and their clothes too) and empty their bank accounts.

If you want to make a dent in spamming, just violate the first, fourth, fifth, sixth and eighth amendments. Simple!

Re:It's a rule, play by it.

[iminplaya]

Would putting them in jail be any less of a violation? My point is that jail is wrong. But evidently, revenge is sweet.

Re:It's a rule, play by it.

[Zeinfeld]

postmaster@ is required (RFC822 6.3, C.6), webmaster@ is just a convention, for now.

Not if you don't provide email service it isn't.

And in any case IETF RFCs are merely suggestions that people are making a 'request for comments' on. Oh dear you thought they were standards, you thought that the IETF had been merely asleep at the switch all these years when the sad truth is that there is no switch.

Re:It's a rule, play by it.

[S.Lemmon]

A postmaster address is required if you're running a mail server...

"[RFC822 6.3, C.6] requires the presence of a <POSTMASTER@domain> mailbox name on all hosts that have an SMTP server"

However, a domain name in and of itself is NOT required to support SMTP or any other specific service.

Re:It's a rule, play by it.

[tyldis]

First off: I'm a poor student and live in Norway. I have a few hobby domains, mostly so I can run my own email configuration.

I haven't recieved any snailmail spam, most likely because I'm not American, but one evening I got a [lovely] call from China. A female (yes, I was shocked myself, first time a girl calls me!) said something about representing some huge business.
Her english was bad so I couldn't really hear what she was saying, but I finally figured out that they had heard about 'my large and great company' and that I was known worldwide for my splendid leadership and nose for business.

I kinda freaked out, hung up and went for my tinfoil hat. I changed the contact info, but when my registrar complained that my address 'BOFH Avenue 666' was bouncing I had to change it back.

Bottom line, I would very much appreciate some kind of mechanism that would protect your privacy a little bit better. The problem is that the Internet is global and legislation is very different around the globe so the solution would have to be technical.

Re:It's a rule, play by it.

[FattMattP]

postmaster@ is required (RFC822 6.3, C.6), webmaster@ is just a convention, for now.

Only for domains accepting mail. It's not a requirement for having a domain.

Re:It's a rule, play by it.

[multipartmixed]

>> postmaster@ is required (RFC822 6.3, C.6)

> Oh dear you thought they were standards,

RFC 822 *is* a standard. It is also known as STD 11, "Standard for the format of ARPA Internet text messages".

--------- *snip* ---------
6.3. RESERVED ADDRESS

It often is necessary to send mail to a site, without know-
ing any of its valid addresses. For example, there may be mail
system dysfunctions, or a user may wish to find out a person's
correct address, at that site.

This standard specifies a single, reserved mailbox address
(local-part) which is to be valid at each site. Mail sent to
that address is to be routed to a person responsible for the
site's mail system or to a person with responsibility for general
site operation. The name of the reserved local-part address is:

Postmaster

so that "Postmaster@domain" is required to be valid.

Note: This reserved local-part must be matched without sensi-
tivity to alphabetic case, so that "POSTMASTER", "postmas-
ter", and even "poStmASteR" is to be accepted.

Re:It's a rule, play by it.

[pipingguy]

The Internet is cooperative, recall -- it could not exist at all without the thousands of sites and networks agreeing to carry each other's traffic. This cooperation requires that operators be able to contact one another in case of a problem

I own a few domains (none hugely popular) and often receive (what I percieve to be) phony spam alert messages and "Message not delivered" emails. That crap is deleted under the assumption that such incoming is spam.

What if I got a *real* complaint/accusation of spamming? Would I ignorantly delete it? My WHOIS information is correct and up to date.

Re:It's a rule, play by it.

[PsiPsiStar]

Oh, come on. Everyone knows that amendments are just rough guidelines. We'll add a little footnote at the bottom of the bill of rights saying '-asterisk- unless you're a spammer.'

Re:It's a rule, play by it.

[midol]

[dave@localhost dave]$ whois dolphinsex.org

[Querying whois.publicinterestregistry.net]

[whois.publicinterestregistry.net]

NOTICE: Access to .ORG WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the PIR registry database. The data in this record is provided by Public Interest Registry for informational purposes only, and PIR does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator or any ICANN-Accredited Registrar, except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. PIR reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Domain ID:D36541327-LROR

Domain Name:DOLPHINSEX.ORG Created On:27-Sep-2000 15:31:53 UTC

Last Updated On:07-Oct-2003 23:45:59 UTC Expiration Date:27-Sep-2004 15:31:53 UTC Sponsoring Registrar:R11-LROR Status:CLIENT DELETE PROHIBITED Status:CLIENT TRANSFER PROHIBITED Status:CLIENT UPDATE PROHIBITED Registrant ID:tuWW69n3DP7d9mXd

Registrant Name:Pastor Shane

Registrant Organization:There was an old satyr named Mack

Registrant Street1:Whose prick had a left handed tack.

Registrant Street2:If the ladies he loves

Registrant Street3:Don't spin when he shoves,

Registrant City:Their cervixes frequently crack.

Registrant Postal Code:unknown

Registrant Country:YU

Registrant Phone:+381.3434543212

Registrant Email:shane@hick.org

Admin ID:tuVnWh6fO7ZqXon0

Admin Name:Pastor Shane

Admin Organization:DOLPHIN-MAN-WOMAN LOVE ASSOCIATION

Admin Street1:Seaweed!

Admin City:The Ocean

Admin Postal Code:unknown

Admin Country:BA

Admin Phone:+387.9119116969

Admin Email:shane@HICK.ORG

Tech ID:tuVnWh6fO7ZqXon0

Tech Name:Pastor Shane

Tech Organization:DOLPHIN-MAN-WOMAN LOVE ASSOCIATION

Tech Street1:Seaweed!

Tech City:The Ocean

Tech Postal Code:unknown

Tech Country:BA

Tech Phone:+387.9119116969

Tech Email:shane@HICK.ORG

Name Server:NS.HICK.ORG

Name Server:NS2.HICK.ORG

Re:It's a rule, play by it.

[Bagheera]

If you want to make a dent in spamming, just violate the first, fourth, fifth, sixth and eighth amendments. Simple!

1st Amendment: Spam is not protected free speech. Commercial speech, which the vast majority of spam is, isn't covered here. We are talking about people who are selling you herbal viagra and the like. Unless you somehow want to include SPAM in a religious context?

4th Amendment: While I certainly don't support pressing the fourth amendment, the government has already set numerous precedents with the (failed) War on Drugs when it comes to seizing property. Ask any boat owner who lost their boat because one of the crew snuck a joint on board, and they got pegged with the Coastie's Zero Tolerance policy. Personally, I find drug dealers less offensive than spammers. People GO TO drug dealers for their product. Spammers force themselves into your in-box and around your filters.

Note that the government can say it's OK to seize spammer's assets - like they did with drug dealers, and the seizure then becomes lawful in any case.

5th Amendment: How are you applying it here? The 4th amendment covers search and siezure. The 5th would only apply if we assumed no process.

6th Amendment: Doesn't appear to apply here. The original comment about seizing spammer's

8th Amendment: Define "excessive" in this context? Is it somehow OK for a spamemr to send out 5 million bulk emails to people who didn't want them, using machiens that were compromised, on someone elses network? Would, say, ten cents per spam for bail be adequate?

I seem to remember the precept that "Illegally acquired" assets are forfiet. Since spam is, in many cases (and we would assume that we are not going after "legit" marketers here) illegal under one law or another, it's a safe bet that the spammer's assets would count as "illegaly acquired."

The constitution is a great document, and it's already suffering a lot of abuse at the hands of the (past, present and future) administration. But siezing a spammer's assets doesn't count as abusing the spammer's constitutional rights. It counts as letting the punishment fit the crime, and serving justice in the public interest.

Re:It's a rule, play by it.

[Anonymous Coward]

I know that most registrars do not validate the information. So, my domains are registered with just n.b. as the name, address, phone number, etc. This protects me incase some overwrought person disagrees with my warez pages.

While the police don't care, what I am doing must be legal. I am not going to ever put real information in because this would just encourage a lot of meaningless lawsuits.

Meanwhile, you can come to www.cdrsoft.cc and pick up some free software. Stop the marketplace for Intellectual Propterty today.

Re:It's a rule, play by it.

[Anonymous Coward]

Yeah, threatened, very threatened. I hope you have bolted your door shut too, so Jehova's witnesses can't knock.

Re:It's a rule, play by it.

[Jah-Wren Ryel]

IETF RFCs are merely suggestions that people are making a 'request for comments' on.

Congratulations, you can parse an acronym.
But too bad for you, the whole is greater than the sum of the parts, or in otherwords, you are wrong.

From the document, What RFCs are: All so-called Internet standards are published as RFCs...

Re:It's a rule, play by it.

[Anonymous Coward]

Amen to that... I used to have a PO Box that I'd use for the domains I owned -- even as far back as 1995 the WHOIS records were being mined by spammers & bulk-advertisers... It got to the point where I got so much junkmail in it, that I would only stop by the Post Office once every month or so...for the sole purpose of emptying the completely packed box & dumping everything straight in the garbage. I'm not paying for a POB just so I can have a 'valid address'...use my home address instead? Hah.

For phone number information, I have always just used all zeros...the only numbers I have are my cell & my landline and I sure as Hell am not going to give every jerk and/or psychopath out there the ability to harass my family at all hours of the day...

There's no point for me to say anything about how any email address listed with a registrar & available via WHOIS is instantly turned into a worthless spam-collector, and stays that way forever - right? Every domain registrant already knows...

People have suggested to registrars for YEARS that folks should have the option to keep at least the contact email addy private from the public but not the registrar itself (anyone else ever miss important emails FROM the registrars because you ignore/rm/bitbucket anything sent to that account automatically? ;) Now the jerks are offering to let your info remain private, but charge you an additional amount (which is higher than the cost of renewing a domain for one year at one registrar I won't name...)

There's gotta be a decent middle-ground here -- one that doesn't cost everyone more and more money, but at the same time enables us to hunt down and maim every p.o.s. who decides to spam.

Re:It's a rule, play by it.

[cubicledrone]

Oh good. Well, I guess the Constitution doesn't apply then. We can rationalize the wholesale deprivation of another person their rights when it's someone who sends too much e-mail I guess.

So, go ahead and take everything they own. Hey, I guess it's a lot easier to ignore one of the founding documents of the country when it isn't even capitalized any more.

Re:It's a rule, play by it.

[Bagheera]

You seem not to have read me response to you. The constitution is a fine document, but you cited what, five amendments? Only one of which could possibly have applied (the 4th regarding unlawful search and siezure) without any reason for citing them.

ADVERTISING is NOT protected free speech. And the original post did not state (or even imply) seizing a spammer's assets just because they were -accused- of being a spammer. The assumption is that forfieture of assets is a viable penalty for someone convicted of spamming.

Check my posting history. You'll see I'm a pretty rabid supporter of the Constitution of the United States. But if you're going to let the spammers (or any other criminal for that matter) hide behind it, please make sure you know how it could apply.

You still haven't said how seizing the assets of a convicted spammer is unconstitutional - let alone how it violates _FIVE_ of the articles.

Re:It's a rule, play by it.

[DroopyStonx]

I have a right to privacy and anonymity.

Let me give you an example... say I have a slashdot account and put my domain as my homepage and/or make my email address public. I post something that someone doesn't agree with, and this person happens to have a chemical imbalance in their head.

They dig up info on me, they could prank my house, send shit to me, or just generally make a page with my name, address, and phone number saying "THIS GUY IS A DOUCHE!"

I'd rather avoid that. I'd also like to avoid masking my identity by being forced to use shit like yahoo or hotmail. If I use name@mydomain.com and my whois info is invalid, then.. that's all the protection I need.

Not all rules apply to everyone.

Re:It's a rule, play by it.

[LostCluster]

-You don't have to post on Slashdot.
-You don't have to have a website.
-You don't have to link to your website from your Slashdot profile or posts.

Re:It's a rule, play by it.

[DroopyStonx]

Your response was quite pointless. I am very well aware that I don't *have* to do any of those things, but the reality is, I want to do those things, and I will! I also don't have to provide my personal information to do so! Crazy, huh?

Allow me to restate the first line of my last post: I have a right to privacy and anonymity.

I'm sorry if you don't agree with that. My information *will* remain invalid and private. My registrar has no problems with allowing me to do so. It will remain that way, even if ICANN warns me unless a solution presents itself where I can hide my personal information from others.

Re:It's a rule, play by it.

[wo1verin3]

I was pretty close to that when she almost got me fired from my job at the time, she would constantly call even though I told her not to, and I didn't have a direct line.

I wholeheartedly agree.

[Silent Plummet]

Absolutely, this is a step in the right direction. A contractual agreement is a contractual agreement, and there is no "right to a domain name", last time I checked. Forcing content providers (i.e. spammers) to remain personally identifiable can only help.

More control but not for corporations

[October_30th]

Passports and visas for travelling, treaties for weapon sales and control mechanisms for legal drug sales.

It's already being done - under the control of treaties signed to by nation states.

Why can't we run the internet in the same way?

Re:More control but not for corporations

[Catbeller]

"Why can't we run the internet in the same way?"

Because "we" don't "run" the Internet. The Internet is a protocol, not a television network.

Lots of useless data in there

[Space cowboy]

I looked at using the whois db for my IP to city project, but rejected it because (a) it's forbidden [which was the most important reason, honest :-), and (b) the correlation between locations I did know and what was in the whois DB was pretty poor.

So I just depend on good folks like yourselves to fill in the data. I think that gets around the various patents that Quova etc. have got on populating a city/ip database as well :-)

Frankly I'd give it about 50% accuracy, and I'm approaching that without using it at all...

Simon

Re:Lots of useless data in there

[Anonymous Coward]

yeah but your db is shit full of bogus results (never trust the user especially in web application programming) not to say redundant

Re:Lots of useless data in there

[Space cowboy]

Actually the DB is a bit cleverer than just trusting the user, it takes a track history into account... Even when someone does put the wrong city in, simply to screw it up, as soon as 2 people with different IP's do it correctly, the correct city will appear. Since you can only upload info for your own IP address, and it works on a /24 block, it should recover from bad input data over time...

As for maxmind (and quova), I think you'll find you pay for anything other than the country data. Hostip gives you the city if it can...

Regardless, one of the points is to try and analyse just how much wrong data is entered, when you let the net as a whole put info into a system, so I'm happy anyway, and if it turns out to be a useful resource, so much the better :-)

It's always easier to knock something down rather than build it up, isn't it ? Let's just see how it evolves over time :-)

Simon

Re:Lots of useless data in there

[PieEye]

I'm curious - how do you take into account NATted corporations? i.e. People from literally all over the world, coming from a single IP address. From your previous posts, you're treating them as if they're from a single location. And if you answer that "it's the netblock, stupid", what if two people from a branch respond but the netblock owners don't?

I guess I really don't understand the relevance of your database.

Re:Lots of useless data in there

[Space cowboy]

Well, if there's no data to be had, there's nothing anyone can do. I do think that's a pretty statistically insignificant proportion of IP addresses though, even with AOL doing it...

Some NAT firewalls send extra headers (X-NAT-PROPOGATED-FOR') similar to proxies ('HTTP_FORWARDED_FOR' and similar), and I try to pick up on those where I can, but at the end of the day, any system has to have *something* to work with.

The fraction of IP addresses that oscillate or change city a lot is very small (1%). The vast majority of the located addresses that I have don't change at all.

As for relevance, well as I've mentioned before it's an experiment. If it turns out to be useful, excellent; if not, well I have some interesting data to play with :-) So far it looks promising, but it's very early days.

Simon.

Re:Lots of useless data in there

[Lord of Ironhand]

There is useful data as well, though:
a@wf#502/0:~$ whois microsoft.com | grep "Server Name"
Server Name: MICROSOFT.COM.ZZZ.IS.0WNED.AND.HAX0RED.BY.SUB7.NET
Server Name: MICROSOFT.COM.WILL.LIVE.FOREVER.BECOUSE.UNIXSUCKS. COM
Server Name: MICROSOFT.COM.WILL.CRASH.IN.6MN.ORG
Server Name: MICROSOFT.COM.WILL.BE.SLAPPED.IN.THE.FACE.BY.MY.BL UE.VEINED.SPANNER.NET
Server Name: MICROSOFT.COM.WILL.BE.BEATEN.WITH.MY.SPANNER.NET
Server Name: MICROSOFT.COM.WAREZ.AT.TOPLIST.GULLI.COM
Server Name: MICROSOFT.COM.WANADOODOO.COM
Server Name: MICROSOFT.COM.SUX.BUT.PYROFREAK.ORG.RULEZ.AND.DIOX YTECH.NET.DELETED.GANDI.NET
Server Name: MICROSOFT.COM.SMELLS.SIMPLECODES.COM
Server Name: MICROSOFT.COM.SHOULD.GIVE.UP.BECAUSE.LINUXISGOD.CO M
Server Name: MICROSOFT.COM.RUNS.ON.AN.8088.ORG
Server Name: MICROSOFT.COM.RAWKZ.MUH.WERLD.MENTALFLOSS.CA
Server Name: MICROSOFT.COM.OHMYGODITBURNS.COM
Server Name: MICROSOFT.COM.LOVES.JU1C3.COM
Server Name: MICROSOFT.COM.LIVES.AT.SHAUNEWING.COM
Server Name: MICROSOFT.COM.IS.NOT.SEXYCOOL.ORG
Server Name: MICROSOFT.COM.IS.NOT.AS.COOL.AS.SIMPLECODES.COM
Server Name: MICROSOFT.COM.IS.IN.BED.WITH.CURTYV.COM
Server Name: MICROSOFT.COM.IS.GOD.BECOUSE.UNIXSUCKS.COM
Server Name: MICROSOFT.COM.IS.A.STEAMING.HEAP.OF.FUCKING-BULLSH IT.NET
Server Name: MICROSOFT.COM.HAS.TEH.GAY.OMFGLOL.COM
Server Name: MICROSOFT.COM.HAS.ITS.OWN.CRACKLAB.COM
Server Name: MICROSOFT.COM.HAS.A.PRESENT.COMING.FROM.HUGHESMISS ILES.COM
Server Name: MICROSOFT.COM.FLINGS.POO.AT.MONKEYCORE.COM
Server Name: MICROSOFT.COM.FILLS.ME.WITH.BELLIGERENCE.NET
Server Name: MICROSOFT.COM.CAN.SUCK.MY.SERVEREXTREME.ORG
Server Name: MICROSOFT.COM.CAN.GO.FUCK.ITSELF.AT.SECZY.COM
Server Name: MICROSOFT.COM.CAN.BLOWME.ORG
Server Name: MICROSOFT.COM.ARE.GODDAMN.PIGFUCKERS.NET
Server Name: MICROSOFT.COM.AND.MINDSUCK.BOTH.SUCK.HUGE.ONES.AT. EXEGETE.NET
Server Name: MICROSOFT.COM.AINT.WORTH.SHIT.KLUGE.ORG

Re:Lots of useless data in there

[ciggieposeur]

I've actually done the analysis before:

1) Take the whois database from RIPE and APNIC. Divide the networks and subnetworks out into the smallest possible units.

2) Note that *most* small networks have adjacent routers with other small networks *in their own country*. Make a list of network and neighboring networks, using the administrator's address as the country field.

3) Sort the list by network coverage size, with Class A (8/24 CIDR) down to about 15/33 CIDR.

4) MANUALLY use the data from #2 to make a reasonable country assignment for each network in the list generated in #3.

Because of the nature of the list, you'll find that the first 1000 or so networks cover about 50% of ALL internet users. The next 1000 or so cover another 20%, the next 1000 or so another 13%, etc.

You can get about 80% coverage at 80%-ish accuracy in one full-time week of work. The code for #2 and #2 is fun, but #4 is boring as hell. Fortunately for us, there's no good source of data to tie IP down to city or state/province level. (Case in point: two adjacent IP addresses in "Houston" are physically in Nigeria and Equitorial Guinea.) I'd only use whois data to draw the big national borders.

At the time I did it (2000) it didn't look forbidden to me. Sweeping the database for commercial gain or mass mailings was forbidden though.

Re:Lots of useless data in there

[DeSigna]

Well, it explains why the netblock I'm on (which is used for all of TPG's Queensland POPs) decides my static IP is in a different city each time I look (and correct it again) :).

Re:Lots of useless data in there

[Space cowboy]

Maybe I'm being over-cautious, but the wording at ripe would seem to suggest that you can't re-use the information in the DB. To me, it seems to be for single-level access (ie: I can use it individually, but I can't re-distribute it) and hostip would be effectively re-distributing a portion of the ripe DB if it took bulk data from it.

I do use 'whois' to check on bulk uploads, (and I'll do traceroutes to random IP's in the uploaded netblock as well) before loading a block of N records into the DB, but I think that's acceptable.

Simon.

Good for spammers

[anti11es]

I don't know about the rest of you, but I have mostly correct information, only because I don't want to lose my domain over something like this. What I really hate about having all this information public is I get a lot of spam (both email and snail mail). Email isn't a problem with good filters, but there isn't much you can do to "filter" out the snail mail, you at least still have to throw it away. Spammers must love the whois database, and they'll love it even more when all the data is valid.

Re:Good for spammers

[robogun]

What I really hate about having all this information public is I get a lot of spam...

That's the thing, all right. I'll change my domain's address from AL Ralsky's residence when they crack down on WHOIS spamming.

Re:Good for spammers

[cscx]

I really haven't had a problem. I get snail mail "bill" from ICLS.NET every once in a while. Occasionally I get SPAM sent to sales@mydomain.com (my real address is a catchall).

Aside from that, no real problems. I do have my real info in there. I say if you want to be a part of the Internet, you NEED vaild contact info in there. I couldn't give two flying fucks about your "privacy" issues. If you're so paranoid you won't put your info into the WHOIS, then just DON'T BUY A DOMAIN NAME.

Alternatively, just get a PO Box if you're that worried.

Re:Good for spammers

[Anonymous Coward]

AMEN!

I'm one of those persons who uses STUFF@domain.com so that I can tell where spammers get my email address from. By far the majority of spam comes from the several hundred domains I have registed for my clients. I don't mind the e-mail I can filter that, and even the address information I don't feel too bad about (it costs them too much to snail mail spam me) but NO WAY am I going to provide a valid telephone number, they get a random voicemail box that gets checked once a month on a good month.

WE NEED BETTER RULES GOVERNING WHOIS DB!

Even most mailling lists have solid privacy policies yet the most important database on the entire internet has virtually none.

Re:Good for spammers

[merdark]

I couldn't give two flying fucks about your "privacy" issues. If you're so paranoid you won't put your info into the WHOIS, then just DON'T BUY A DOMAIN NAME.

Well, I don't give two flying fucks about your "valid WHOIS" issues. I have a private site. It's not for you, it's not for others, it's for me. It recieves MY mail, and provides services to select friends. That's all it does.

I should not need to give out all my contact information to the world just so I can locate my damn server on the internet easily.

Re:Good for spammers

[Metaldsa]

" What I really hate about having all this information public is I get a lot of spam (both email and snail mail)."

Just this morning I did the classic, rip up all the junk mail and use their prepaid envolopes to ship it back to them. It cost them stamps, time to open it, and to throw it away. And it was fast and fun for me!

Re:Good for spammers

[Anonymous Coward]

My whois contains the information for my registration service. They filter any contacts before they are sent to me. If somebody has a legitimate reason to contact me about my domain then they are able to but if they are just trying to spam me the service blocks them from reaching me.

Re:Good for spammers

[Anonymous Coward]

What I really hate about having all this information public is I get a lot of spam (both email and snail mail).

Pfft. For only 99 cents per year, you can hide it (and still be in compliance with ICANN). Are you too lazy, or too cheap? If you don't like ProtectFly, Netsol and GoDaddy offer the same service, albeit $5-$9/year instead of 99 cents.

Re:Good for spammers

[Rytsarsky]

I have a spamgourmet address for my domain's contact email. In about a year, I have only receeived two emails on that account. I think both were from my registrar, and were somewhat legit (although they probably got deleted). While I still get tons of spam, I haven't recieved much due to my whois record.

Re:Good for spammers

[cscx]

WRONG. If you have a "private site" all you are entitled to is giving out your IP address.

It's not for you, it's not for others, it's for me.

That's too bad because the DNS is a PUBLIC database. The Internet is PUBLIC. You don't make the rules; ICANN does. If you don't like it -- tell your friends to set up their own DNS servers with pointers to your IP.

I should not need to give out all my contact information to the world just so I can locate my damn server on the internet easily.

Again, that's your opinion, but you don't make the rules, bud. If you want to "locate your damn server on the Internet easily" then why don't you try writing your IP down and keeping it in your wallet. Otherwise, stop whining, and play by the rules.

Do you also think you shouldn't have to register your car, or get emissions testing, because you're better or your privacy is more important than anyone else?

Do you fill out your Tax Return as "John Doe, 123 Fake St., Anytown USA 12345?"

Re:Good for spammers

[Geordie Korper]

I have legit info in whois, but still all my e-mail spam comes to info, sales, and webmaster not the e-mail address in the registration. None of those are actually valid addresses on my domains either. The snailmail SPAM is not significant enough for me to care. Even if those were a major problem, as far as I am concerned using invalid information to purchase property whether virtual or physical is fraud and wanting not to be inconvenienced is not an excuse.

Certain things are public records and that is just the way it is. I receive offers to buy my house in the mail from people who have looked up the tax records too, but I don't think people are going to say that I can give the department of tax administration fake information. Besides it only has to be legitimate contact information it does not have to be the same information as your normal contact information. People create trusts and holding corporations for physical property all the time. Why should virtual property be any different?

Re:Good for spammers

[JPriest]

Your arguement is flawed becasue people can't just harvest the DMV's database for a list of addresses to spam.

Re:Good for spammers

[jlechem]

I had a friend who would piss all over the info they sent and then send it back in their own envelopes with a note explaining why the papers were off colored. I also think people should dump in baby powder and let them think whatever.

Re:Good for spammers

[cubicledrone]

You don't make the rules

Yeah, he does. We all do. We're the voters. ICANN isn't an autocracy. Congress has primary jurisdiction over the laws, and we vote for Congress.

People should be able to control where their personal information is published.

Up next, Internet Domains become "a privilege" just like a driver's license, and another tiny piece of the Constitution is repealed without a vote. Oh, hooray.

Re:Good for spammers

[Anonymous Coward]

You get the virtual address to your virtual property and the physical address to your physical property.

Re:Good for spammers

[Anonymous Coward]

the reason whois is there is to get rid of idiots that have no buisness owning a TLD. good by and good riddence to those that have no buisness having a tld. I hope this kills many, that way dns actaully starts behaving again.

Re:Good for spammers

[Anonymous Coward]

Bah! I have better info to register domains under ;)

The SCO Group
355 South 520 West
Suite 100
Lindon, Utah 84042 USA
(801) 765-4999 phone
(801) 765-1313 fax

Contact SCO online
http://www.thescogroup.com/company/feedbac k/index. html

Darl C McBride
1799 Vintage Oak Ln
Salt Lake City, UT 84121-6539

Darl's home phone #: (801) 424-2006
Darl's office phone #: (801) 932-5820

Email Darl: darl@sco.com

Re:Good for spammers

[tx_kanuck]

Since when were domain names a right anyway? Last time I read the constitution, I never read anything about domain names..... Unless you are reading one that I haven't read yet.

And you state that Congress makes the rules. You're right. But what if ICANN was to move to Canada. How much control would Congress have over ICANN then? I think it would have almost none at that point.

You have a point when you say that people should be able to control where their personal information is published. But if I say to you "if you want this, you have to give me permission to do this", then is that not Capitalism at work? You have to abide by the rules *I* set to use a service that *I* (or ICANN in this case) provide. They state you have to provide valid contact information. Provide it, or do not use their service.

Re:Good for spammers

[Solosoft]

haha ... Honestly I don't mind snail mail spam. Usually that spam has SOME kind of use.

Plus if a company is willing to spend some money on sending me somthing I will usually read it then put in 33 cents of pennys or whatever else is small and heavy and send the mail. This way the company has to pay extra for shipping. It also stops them from sending shit back since they don't like me. Why waste perfectly good urine when you could put small metallic objects in the envalope.

Now e-mail spam ... don't get me started >:(

Re:Good for spammers

[Animaether]

There's always dyndns if you want your server easily accessible, whilst not wanting your information too public.
I kno www.SomeNameHere.com looks cooler, but since it's really a private little thing, I'm not sure that should be an argument.

Re:Good for spammers

[merdark]

Sure, of course, I use that for many computers. And I do have correct information in the whois thing for my TLD.

I just didn't like the parent posters attitude of "I don't give a flying fuck about your privacy". Privacy is a *really* important issue in today's world and it deserves a lot more than ignorant comments as the parent made.

So in other words, I was messing with him. In reality, they do have the privacy option for extra $$ I guess, although I did not know about it until I read about it in a comment.

At any rate, TLD are increasingly being pushed for personal sites (the .name) so this whois privacy buisness really should be addressed. Especailly when registars like verisign use this information to nearly scam you into switching to them.

Re:Good for spammers

[Anonymous Coward]

don't forget to include a nice roofing tile/slate (they know about the brick)

Re:Good for spammers

[danila]

The Constitution explicitly states that the rights are not limited to those already listed.

Re:Good for spammers

[JuggleGeek]

If you've really put his info into your WhoIs, then he can easily take control of your domain.

Re:Good for spammers

[Anonymous Coward]

yet.

Re:Good for spammers

[Anonymous Coward]

As I said in a previous post, the UK (Nominet) system is much better in this respect in that it allows private individuals to "opt out" of displaying their info in the public WHOIS. See here:
http://yro.slashdot.org/comments.pl?sid=102 794&cid =8759235

Re:Good for spammers

[Anonymous Coward]

You know I agree with you in point, but remember language relects intelligence. As for the loser who sank is argument with his style of english, well need I say more. Just a thought...

Re:Good for spammers

[Anonymous Coward]

wow, you are quite the fucking idiot.

Change of the rules

[Leffe]

I strongly think that there should be a correct address avaible for each and every domain name out there. But! I don't think letting it out to the public is a very good idea. I can think of numerous incidents where evil people obtained the addresses of targets from their domain names. It would not be good to hide this information from the police as they can surely obtain some valuable information from a registry like this :)

So, change the rules to only let the magic people that operate the internet and the law see it.

Re:Change of the rules

[Fastolfe]

I don't think this is very practical. How do you define who the "good guys" are? How do you keep the information away from the "bad guys"?

Every Joe in the country does not need his own second-level DNS domain. For those that believe they have a solid reason to have their DNS domain parented that far up the DNS hierarchy, they need to be aware that public registration is a requirement for that.

I don't really see a problem with that, especially for domains like ".com", which are meant to be commercial.

Now, for the new TLDs like ".name", I might see a case where DNS registration might not need to be accompanied with a publicly-visible registration, but for the rest, why not? It helps everyone identify who's responsible for a domain so that problem and abuse reports get handled in an efficient manner.

If we pull domain contact information from the public, someone still needs to be an effective first line for abuse and problem reports. If someone has a misconfiguration or malicious user that's impacting my network, I'd better damn well have a number I can call to get that issue resolved. If I can't get that in the WHOIS database, I'd better be able to call someone who can obtain it on my behalf.

I guess for me, it boils down to having responsible contact information available for every netblock and DNS domain that's registered. This doesn't necessarily need to be the end user (and in the case of third-level DNS domains or a customer's small netblock, it isn't even today), but if users are going to register assets high enough in the "tree" (second-level DNS domains and large IP netblocks), they need to accept the responsibility of keeping valid contact information available to the public, because nobody else is going to do it for them. You're free to sub-delegate those resources (third and fourth-level DNS domains or smaller blocks of IP addresses, for example), making you the contact for those end users, or if you choose to require their contact information be publicly available, they would be. It's just gotta be someone. The gTLD registrars I don't think are staffed to be that someone.

My two cents.

Re:Change of the rules

[WormholeFiend]

why would it be anymore dangerous to list someone's address than, say, in a phonebook of any given city?

evil people will always find a way to find a target.

Re:Change of the rules

[Anonymous Coward]

DUH!

After removing your head from your ass you would realize that this means that me@mydomain.com can be translated to a REAL name and address. Also, if I have a site called ilovebashingseals.com this could mean that a PETA lynchmob shows up on my doorstep.

There are certainly some major privacy issues here.

Re:Change of the rules

[cubicledrone]

Every Joe in the country does not need his own second-level DNS domain.

Well, they want one, and there's no reason they shouldn't have one. They paid to build the fucking thing, they pay every month to access it, and they bought the fucking domain too. When someone puts good money on the table, they can have it their way. Yes, this is Burger King.

For those that believe they have a solid reason to have their DNS domain parented that far up the DNS hierarchy, they need to be aware that public registration is a requirement for that.

Not unless the voters say it is.

Re:Change of the rules

[tx_kanuck]

Just because you paid money for something does not mean you can have it your way. If you want to pay for my service, I decide the rules. If I decide to be flexible, then that is up to me, but you play by my rules. By your logic, then spammers have every right to spam since they also paid to "build the fucking thing, pay every month to access it, and they bought the fucking domain too". Unless you support spammers, I think you'll call bullshit on that with me. You don't support spammers do you?

Listen, ICANN set up the rules. Play by them, advocate for them to change, do what ever you want. But if you break them, realize that you risk losing your domain. My contact email on my domain goes to an email address that I never give out to anyone. I check it, but it never gets used by me. So what if I get spammed on that email. Use a PO Box if you want. Contact your phone company and see if they can set up a phone number that just goes to a mailbox. If you have a few friends that have domains, get them to pitch in few bucks a year to join in with you on that. It's a great way to people to leave you messages and not have a phone ringing all the time. It also works great if you are a contractor/road warrior and don't want to carry a cell phone/beeper. People leave you voice mail, and you just check it at your leisure.

And by the way, who are the voters? Americans? The world? Exactly who are you talking about?

Re:Change of the rules

[Animaether]

I don't think this is very practical. How do you define who the "good guys" are?

With the exception of law enforcement (feel free to think otherwise, but I figure law enforcement - if necessary - can get this from the people directly), why not just let the domain owner decide for themselves ?
Get the domain owner a notification in some form that user X wanted extended whois info for reason Y, and ask them if they want to grant user X that info.

Re:Change of the rules

[smagruder]

Play by them, advocate for them to change, do what ever you want.

Since ICANN destroyed any semblance of democracy amongst Internet stakeholders, I fail to see your point.

But if you break them, realize that you risk losing your domain.

Draconian.

Contact your phone company and see if they can set up a phone number that just goes to a mailbox.

I will if you pay for it. Seriously, I don't want extraneous phone calls, so my phone # on my domains is going to stay fake (that is, 555-5555). All the other data is real--I have good email filtering and I use a PO Box. And that's no matter what your opinion on "ICANN Law" is, buster!

Re:Change of the rules

[kwoff]

I don't know why that comment was marked insightful, as hardcoding the snailmail address to the IP address just seems like bad practice. If I buy several domains, and I have a hosting provider who feels like hosting some in the Arctic and Antarctica during the summer, why should the addresses have to be kept in sync when the machines are moved back to Vanuatu during the winter?

Re:Change of the rules

[cpghost]

So change the rules to only let [...] the law see it.

Which law? US law? Canadian law? French law?... or perhaps add-you-favorite-rogue-state-of-the-day-here law?

We're talking about gTLDs. According to the UDRP, many laws per domain can apply: the registrant's country, the admin contact country, the litigator's country, the DNS provider's country, the service hoster's contry, and even third-party's country. That's a lot of laws to consider, esp. when the contact informations are hidden!

Maintaining accurate public contact information in the WHOIS database seems like a reasonable way to go.

First, ICANN should crack down

[Anonymous Coward]

On the people abusing the WHOIS data for spamming. If I didn't get so much damn spam (not just email, but regular mail!), I wouldn't be so included to falsify my data just enough to avoid it. If they call me on it, whoops, typo! Sorry!

Ironic

[shirai]

I remember I got this email from NetworkSolutions promising to hide your contact information so I looked it up in my email archive. It costs an extra 5 bucks and promises to protect you from spammers and telemarketers.

Something about this is ironic.

Someone needs to speak to NetSol about the ICANN report. :)

-----
Protect Your Privacy
from Spammers and Telemarketers

When you register a domain name, your address, e-mail, and phone number are published in the public WHOIS database. ICANN requires this personal information to be available for anybody to view on the web. With
Private Registration you can deter spammers, telemarketers, identity thieves, harassers, stalkers and others who access this database.

Private Registration provides you with alternate contact information for your domain name registrations. The contact information you want to keep private is kept out of the public WHOIS database.

For a limited time you can add Private Registration to each of your existing domain name registrations for the introductory price of just $5 a year. Terms and conditions are included in our Service Agreement.

To add Private Registration
1) Log into your Network Solutions Account
2) From the Account Details page, click on one of your domain names
3) In Domain Details, click "Make this a private registration"
4) Check the domain name registration(s) you want to make private and
click continue

Introductory Offer Only $5 a year

Re:Ironic

[Leffe]

I'd assume that they would put their own address in there instead. It sounds legal to me.

Re:Ironic

[TwistedSquare]

godaddy offer such a service as part of registering with them (for a little extra). They put their details in and forward all mail on to you. Great solution really :) This way you are contactable but your address remains private

Re:Ironic

[zipoff]

From Network Solutions site -

With a Network Solutions Private Registration, you receive alternate contact information displayed in your WHOIS listing, without giving up your standing as the registrant of the domain name, unlike "proxy" services. This enables you to view and make changes to your account contact information, as well as all of your settings associated with your domain name registration from your Network Solutions Account Manager - no separate account manager Web site to login to. Also, you're not restricted from transferring your domain name registration to another registrant or registrar.

It sounds like they are registering your domain with contact information that points to them, but that you are allowed to control the domain from their site.

They most likely are using a valid address that refers to an internal database for them to contact you if the need comes about.

Re:Ironic

[Shakrai]

Someone needs to speak to NetSol about the ICANN report. :)

Because we all know how much respect Verisign and Network Solutions have for ICANN and the Internet Community as a whole.

And yes I know that Network Solutions is no longer part of Verisign but it's the same meantaility at both places. NetSol who held a domain of mine hostage for 45 days and refused to transfer it unless I renewed it with them first!

Re:Ironic

[LetterJ]

This is what I'm going to do for all of my new domains. Why? I don't want to provide innacurate information, but I'm sick of getting a predictable pile of junk mail a month or so after I register for every single domain that I register. All of the mail includes the new domain as the "company" on the envelope. It doesn't matter which registrar I use, the mail is always the same.

Re:Ironic

[Anonymous Coward]

Yes, but Godaddy is expensive. Netsol charges $5/year, whereas Godaddy charges $9/year. I'd personally rather pay 99 cents per year, but that's just me...

I have over a dozen domains, and paying an extra $9/each adds up.

Re:Ironic

[Anonymous Coward]

Dotster makes it easy for me to use a random-looking email address @privacypost.com, which forwards to me but changes periodically. And it's free. I have to use my real physical address, but that's not really a spam problem. If you have your domain registered at your residence and you're concerned about privacy, get a PO box.

Re:Ironic

[Neophytus]

Its probably legit. Through godaddy I use domains by proxy, which rather handily replaces my legitimate details with their legitimate details and a fowarding email address.

Re:Ironic

[Anonymous Coward]

Net Work Solutions (NetSol?): 19.99/Yr Godaddy, 6.95/yr ProtectFly, 9.99/yr Where are you getting ".99 cents","$9", and "$5"??

Re:Ironic

[gnu-generation-one]

Royal Mail allow you to anonymize your address (for #50 per year), but that doesn't make it a valid solution for #5 domain names.

Just because you don't like what's published on my website, doesn't allow you to attack my parents' house, based on the WHOIS registry.

In Europe it's supposed to be illegal to publish this information worldwide, but I wrote to the Date Commissioner, and he doesn't seem to care...

Re:Ironic

[Anonymous Coward]

Where can I get details of Royal Mail's anonymous service?

You aren't talking about a PO Box address are you? That is not anonymous - they are required to reveal the true address to anyone who asks.

Re:Ironic

[Lost Race]

He's talking about the extra charge for anonymity. That's right, Godaddy charges $7 for the domain then another $9 to keep your info private.

Or..

[FrostedWheat]

They should remove the details from public view completly. Why must the owners address and telephone number be published to the world anyway?

Re:Or..

[Anonymous Coward]

so that when jackass spammers send you alot of spam, you can go, lookup who the person they are advertising for is, and call them and complain about their horrible advertising practices.

Re:Or..

[Anonymous Coward]

Why must the owners address and telephone number be published to the world anyway?

accountability, you know that word that people seem to of forgotten, your car registation in most EU countries is publicly available (in bookshops no less) so why should a domain be any different.

if you fake details then you deserve to lose it (just like a car)

Re:Or..

[Anonymous Coward]

They could instead complain to the registrar, who can then yank the domain name. Make it painful for registrars, and they won't want spammers.

Re:Or..

[DarkEdgeX]

Agreed-- the only people who need this info are the registrar, and then only if your domain name is expiring and they're trying to determine if you want to renew it or not.

Re:Or..

[DarkEdgeX]

Expanding on my prior comment a bit; the registrar should be forced to validate the info you enter (e.g. - send a snail mail letter to the address and require that a tag or some such be sent back to verify that it was received). If the issue is one of legality (a website engaging in copyright infringement, piracy or whatever) then there's nothing stopping a lawyer from sending a subpeona to the registrar demanding the contact information.

Re:Or..

[zakezuke]

Why must the owners address and telephone number be published to the world anyway?

Same reason an e-mail address need be published... to get a hold of the owner in the event of a problem. When for example a site's dns servers go down, this can cause just a little bit of havic. As many people have their contact information on addresses hosted on the dns server, you can see where this can become a problem.

Re:Or..

[spazoid12]

blah blah

If a site in maintained by someone that cares about his site (ie. nytimes.com, amazon.com, etc) then they have stuff in place to know, themselves, that their sites are down.

If a site operator doesn't know that his/her site is down, then it's almost a certainty that they don't care.

So, get a hold of the owner in the event of a problem? That's just plain silly.

Re:Or..

[Anonymous Coward]

I think it is more an issue of to report abuse, rather than downtime...

There are proxy services you can use to keep your information private. They will then notify you if someone has an issue.

Re:Or..

[zakezuke]

....have stuff in place to know, themselves, that their sites are down ....If a site operator doesn't know that his/her site is down, then it's almost a certainty that they don't care.

Not always... Co-location?

Re:Or..

[wshs]

And what happens when someone wants to contact you regarding spam, DDoS, and other abuse, or a problem with your mail server, etc? If there's a problem with your mail server, contacting you via email is pretty much out of the question. Also, wouldn't the cost for the registrars handling subpeonas be passed on to the clients?

Re:Or..

[spazoid12]

The other guy's comment about abuse reporting... that's a great point.

Your point about co-location... doesn't add anything to the argument. Good one for /dev/null, thx.

We can do it. We have the technology.

[LostCluster]

The US Postal Service, along with most of its counterpart postal authorties around the world, sells a master database of all "deliverable" addresses to vendors so that they can create services that will easily detect incorrect addresses such as streets that don't exist in the given town, or a number that doesn't exist on a real street. In short, if you have this software, you can reliably predict if the postal serivce would bounce a piece of mail as an invalid address and know why.

It'd be interesting to see what would result if WHOIS is washed against such a list...

Re:We can do it. We have the technology.

[TwistedSquare]

Interesting idea, although people who have just moved into a new house will often find themselves not listed on such a database for a good while. Also addresses can be tricky to match - do you say "The Willows, The Road, Sometown" is invalid despite the fact that the local postie knows that "The Willows" is in fact "21, The Road". I just have a vision of ICANN striking off all those that didn't match closely enough... ;-)

Re:We can do it. We have the technology.

[LostCluster]

Actually, the database is kept up-to-date in realtime as the post office is told to start delivery to the address, and contains all of the acceptable substitutions for communities known by multiple names.

It's a pretty sophisticated tool aimed at junk mailers who don't want to get any return-to-sender pieces, and used by anybody who presorts their mail in order to get lower postal rates since the post office already gets the groups in ready-to-split packages.

Re:We can do it. We have the technology.

[Anonymous Coward]

"along with most of its counterpart postal authorties around the world"

No, this is illegal in most parts of the world, selling mailing lists is only legal in Europe if you get a license (not as easy as you may think), abide by certain restriction and opt out clauses, selling "complete lists" like a list of all deliverable addresses or list of all people that went banckrupt in year XX actually requires another license (and one that is almost impossible to get since it's based on "needs" and not business cases) and a formal notification to the people on the list along with a host of other limitations.

I used to recieve lists of all the people with NIN's in one European country but it became harder and harder to get hold of due to restrictions

Just because things one way in the USA or other parts of the third world, don't assume the rest of the world follows.

And BTW, I hold out 15 com/net/info domains, full and correct contact info is given out on all of them, why am I not getting any spam ?

As I see it you have to have correct info on your domain registration for the same basic reasons that your car and house have a correct reg. info

however, ICANN should have sticter ruels on how this info is passed out

Re:We can do it. We have the technology.

[TwistedSquare]

That may well be true for the US... but is it necessarily the case elsewhere in the world?

Re:We can do it. We have the technology.

[SuperBanana]

The US Postal Service, along with most of its counterpart postal authorties around the world, sells a master database of all "deliverable" addresses to vendors so that they can create services that will easily detect incorrect addresses such as streets that don't exist in the given town, or a number that doesn't exist on a real street. In short, if you have this software, you can reliably predict if the postal serivce would bounce a piece of mail as an invalid address and know why.

Most people, in fact all breathing people around the world, realize that almost any town bigger than 50 people has a "Main Street". In short, if you put "25 Main Street" and then the name of any city or town in the entire US, you can reliably predict that it will pass the deliverable address database checks with flying colors.

Re:We can do it. We have the technology.

[Prior Restraint]

You're assuming people fill out an NCOA card before they move. I didn't do this last time, and junk mail is only just starting to show up again (I moved in September).

Re:We can do it. We have the technology.

[Anonymous Coward]

That list does not always work. I recently moved into a new house and it took over four months for the Post Office to stop sending stuff back as a non deliverable address. This was after many phone calls and letters to them asking them to correct it. I would get some mail, but most of it just disappeared. Your utility companies and credit card companies just love it when your bills keep going back to them saying that you gave them a bad address.

Re:We can do it. We have the technology.

[LostCluster]

Nope. NCOA just reroutes mail associated with your name sent to your old address to your new one. The database of deliverable address doesn't have names, just the street numbers and city/town associations that the mailman stops at. If your new address isn't in this database, the mailman doesn't stop there, so you don't get any mail at all.

Re:We can do it. We have the technology.

[Prior Restraint]

Mea culpa. Obviously, I was thinking of a different database (btw, NCOA database is also for sale).

Fake addresses necessary

[fastgood]

The spam kings don't mind having to leave valid contact info,
but obviously draw the line on accurate email addresses that
would leave them open to receiving UCE.

Yes I do.

[clifgriffin]

As someone who filled in his WHOIS information correctly (and has suffered the ills of having this information public) I think people should be accurate.

Why? I don't know. Seems to me if you are a big enough boy to purchase a domain name registration, you are a big enough boy not to forge your details. No other industry allows you to do that.

If you are planning on infuriating people and don't want to be stalked, just use the privacy feature. It's like 10 bucks. (I'm assuming this is an ICANN authorized system)

Clif

Re:Yes I do.

[Anonymous Coward]

Why? I don't know.
Because you're a fucking moron.

Hmm.. so this is your address?

Griffin, Clifton clifgriffin@jsventures.com
Blogzine
503 Piedmont St.
Reidsville, North Carolina 27320
United States
3364327174 Fax --

Not far from where I live. I'm coming over to kick your ass.

Just kidding, of course.

Re:Yes I do.

[Anonymous Coward]

Well here's a damn good reason. A lot of people will customize their cars/trucks. Then they want to share their work on the internet. They should be able to post a fake address so they don't have to worry so much about the whois being a map for thieves.

Re:Yes I do.

[Shakrai]

Well here's a damn good reason. A lot of people will customize their cars/trucks. Then they want to share their work on the internet. They should be able to post a fake address so they don't have to worry so much about the whois being a map for thieves.

Because all the car thieves that I know are such avid users of the whois database for looking up domain information. Why I remember that part in Gone in Sixty Seconds where Nicolas Cage used the Network Solutions whois page to lookup the address for the Shelby Mustang he needs to steal. If only the owner had been allowed to falsify his whois contact information his car would have been safe.

Ever hear of a P.O. Box? They'll protect you just as well without lying or risking the loss of your domain name (or other property).

Re:Yes I do.

[clifgriffin]

How talented you are. That's the price of buying a domain...and yes, if I wanted it private I could have that luxury for about 10 bucks a year.

Don't want your information public?

[Guspaz]

Don't fake your info, just get a private registration:

https://registrar.godaddy.com/dbp.asp?isc=&se=%2B& from%5Fapp=&prog%5Fid=GoDaddy&authGuid=

It only costs 2-3$ a year more than a normal domain, and the domain is registered in the registrar's name so your info isn't public.

Re:Don't want your information public?

[Anonymous Coward]

Ooh, you browse at +1. AC's need-not reply. You arrogant, no-good, 500,000+ user-id newb. Of course, you won't see this anyway.

Re:Don't want your information public?

[hrieke]

Yes, but if the FBI or a lawyer shows up with a subpoena, how hard will go-daddy fight to crush it?
My guess is not very hard.

On a side note, if this is designed to tie in with the can-spam act, then why haven't people started to sue the owners of web sites linked in spam? Or those who contact you back after submitting 'tracking data'?

Re:Don't want your information public?

[Anonymous Coward]

False. You can still go to GoDaddys site and lookup who owns a particular site.

I have done this on several occasions when doing a WHOIS and saw the GoDaddy info. All the info is there, just not out in the open like most other places.

Re:Don't want your information public?

[skidde]

The point isn't really to prevent anyone from ever being linked to their domain. I got it because I didn't like the idea of people having my address/phone number just by running a search. If you get the private registration, you don't actually have any personal information revealed to the world, and you still get an e-mail address that you can use to let people contact you directly. I just don't think that RandomInternetUser needs to have my address or be able to call me.

Re:Don't want your information public?

[Denium]

There's a dangerous precedent with making people pay for privacy. Andrew Shapiro's The Control Revolution has many chapters about privacy and our mistaken approaches to it (including P3P).

It boils down to this: is privacy a right or a privilege?

Re:Don't want your information public?

[Anonymous Coward]

Gotta love insulting people in public behind their backs.

I agree. Perhaps I should have modded you up so the guy could see what a moron he is.

Re:Don't want your information public?

[still_sick]

You're missing the point.

A person shouldn't buy this "anonymous registration" service expecting that nobody will ever be able to track them down. There is nothing that you can do to keep the FBI (or whatever Law Enforcement Agency) from tracking you down.

Anyone who expects to be able to run a site with illegal content expecting complete anonymoty is a damn fool, and failed to read rules when buying the service. They state quite clearly that if you break the law while hiding behind them, they will fully co-operate with the Police and turn you over.

The reason a person would buy this is to keep every other random asshole out there from being able to do a quick WHOIS and grab their email / postal address / phone number.

Re:Don't want your information public?

[Anonymous Coward]

I i've owned about 15 or 16 domains in the past few years, and I've only _ONCE_ been called from my whois information (all valid, and all public).

Have more trust in your fellow peers, however, have less in marketing companies; I've definatly received 10x the spam (both electronic and snail) because of public whois registration.

The moral of this story? Um... don't trust spammers?

Re:Don't want your information public?

[Anonymous Coward]

D'oh! And i forgot to say that the one call was legitimate, not a prank.

Re:Don't want your information public?

[Cyno01]

You already have to pay for privacy. It costs an extra couple of bucks a month to keep your phone number unlisted, this is the same kind of deal.

Re:Don't want your information public?

[Anonymous Coward]

What is ironic about that is it saves ink and therefore should cost *less* to not be listed than to be listed and people who want to be listed should *pay* to be listed since ink costs money.

Re:Don't want your information public?

[polyiguana]

Not if they have the domains by proxy service purchased.

Re:Don't want your information public?

[Guspaz]

I'm a moron? Sure, right.

The sig is a (mostly effective) attempt to get some asshole to stop "stalking" me by posting garbage insult/goatse replies to every single comment I post. It has pretty much worked too; he both doesn't reply anymore since he obviously knows I won't see it, and even if he DOES post his crap, I won't even know it's there.

And you know what? If my sig insults people like you who can't even be bothered to get an account, tough. You shouldn't be reading/posting comments anyhow.

crap!

[ErichTheWebGuy]

guess I better change my information to something other than j03 c00l l33t

It's not that hard to confirm a physical address.

[LostCluster]

It would not be too hard for domain registrars to be required to send a postcard to a physical address with a passphrase that would need to be supplied back in order to verify the physical address just as much as verification e-mails are being sent to confirm e-mail addresses.

This would be what most domain registrars are doing for e-mail addresses, which explain why e-mail is so accurate yet physical addresses are wrong. However, domain registrars would drag their feet on this because 1. It costs money, and 2. It'd block most sales to fraudsters.

No, I don't believe it is...

[garcia]

So what, they have a "valid address" in their WHOIS info. Doesn't mean that it is their current address, or their main address, or the one that they care about.

How about MY privacy as a domain owner? Do I really need s-mail spam, e-mail spam, etc just because spammers lie about their address?

Re:No, I don't believe it is...

[LostCluster]

You've never had a right to privacy as a domain owner. If that bothers you, don't use DNS and just publish your web server's IP number.

Re:HEY FUCKING FAG, THE WORLD IS BIGGER THAN THE U

[Anonymous Coward]

Perhaps you missed "along with most of its counterpart postal authorties around the world"?

I second that motion

[broothal]

Yes I believe this is a step in the right direction. As a matter of fact, I believe it's about fscking time they cleaned up their act. I don't know what percentage of those with fake info are spammers, but I do know, that 99% of the spammers has fake whois information. This makes it pretty hard to track them down, and hit them where it hurts - on their pouch. Spammers couldn't care less about losing an account or two - there's only one thing that can hurt them - that's going after them and their money. Fake whois information was an effective shield against that.

Re:I second that motion

[Monkelectric]

Who modded this crap up? Read the FUCKING article. Real people are *hiding their private information* by putting up fake information -- The snail mail addresses of known spammers.

Re:I second that motion

[Anonymous Coward]

Tracing spammers by domain name is useless, and always will be. You dont want to contact the spammers, you want to contact their ISP.

The *IP* whois information is much more accuate, and tells you what ISP owns the network.

This policy sucks.

[Anonymous Coward]

Spammers are a problem, but this is a terrible way to deal with it.

What if I want to be able to host a website realtively anonymously, so that people don't know that I am running the website?

For example, what if I were gay, and wanted to host a website about gays, but I didn't want my employers to be able to do a search and find out that I am gay so they can discriminate against me?

Also, spammers and other marketers harvest the info from the registration datatbase. Back when the Internet was all educational facilitities, requiring people to register who they are made sense. Now it does not.

Hopefully this policy will not affect services that act as proxies to register names under their name rather than the name of te acual server owner.

Re:This policy sucks.

[Cipster]

Also what if I hosted a website that said unpopular things about the Government or the Church of Scientology etc. Do I really want to be able to be harassed/tracked down?

Re:This policy sucks.

[acceleriter]

If you piss either of them off, they'll have no trouble getting your contact information out of your ISP, legally or otherwise. Unless, of course, you're saying you've paid for your hosting or connectivity with money orders mailed from strange cities and taken the other myriad tedious precautions that would be necessary to preserve true anonymity.

Re:This policy sucks.

[Lehk228]

Unpopular? I thought it was in fashon to trash both.... silly me and i thought I was out of tyle for only trashing the $cientologists

I love my hosting dudes

[Nicholas Evans]

The guys I bought hosting from also registerred the domain for me, and put in their info for the whois. This way I don't get any lamers using it to spam me.

Re:I love my hosting dudes

[gl4ss]

yeah you love them now, but who really owns that domain, you or them?

.

Re:I love my hosting dudes

[elemental23]

Exactly the problem a friend of mine had. He wanted a web site for his tattoo studio and, against my recommendations, let the guy who designed the site register the domain. I looked at the whois info later and realized the web guy registered it to himself, and with a ton of bogus info to boot. My friend's name wasn't anywhere on it. Needless to say, the site and DNS entries for the domain eventually up and disappeared leaving my friend and his business screwed.

Nobody cares about mining data from WHOIS

[Anonymous Coward]

You know that huge, 5+ paragraph bit of text you get with any WHOIS query that's really damn annoying?

An employer who shall remain nameless used the WHOIS database to get sales leads. When they got blocked for too many queries per day, they simply set up more systems- they were blocked by specific IP, not range.

The most amusing part was the nonchalant reaction when said employer called Verisign and asked if they could pay for more access, the answer was no, but when Verisign was told "we'll be accessing the data anyway", the answer was "okay". You'd think it would be more along the lines of "you do that, and you'll be violating our terms of use and we'll sue the crap out of you".

Do you really think Verisign gives a crap about the privacy of info in the whois database?

Not sure if it's a good idea

[Mustang Matt]

But if you really want to make sure you don't get snail mail use your address line 2 with a phrase that will make the mail get destroyed such as: "THIS MAIL MAY CONTAIN A BIOLOGICAL VIRUS"

Not sure what the legal ramifications/consequences of doing so might be, so do it at your own risk.

ramblings...

[koody]

I can see why the autorities would want (need?) to have information about who owns a domain, the whois database as it currently exists is a simple and fast way for spammers to get email addresses.

Some whois databases already put the e-mail address in an image so that spiders cant harvest them, most do not. This means that a first timer will quickly find his/her e-mail address useless becuase of the sheer amount of spam the address gets.

Then there is the question of privacy and personal safety. Let's say I believe that some cult exists only for the sole purpous of ripping people off, and I put up a web site warning other people and telling them of my personal experiences. The cult memebers that feel outraged by my blasphemy might look up who I am by the database, and I would be risking life and limb by putting opinions on the web.

Now someone is bound to ask "Hey, what about kiddy pr0n". Well, that's why I think the autorities should have access to that information, just as they have some other rights not bestowed upon us regular joes.

The next argument will then prolly be
Those who would sacrifice a little freedom for temporal safety deserve neither to be safe or free.
- Benjamin Franklin

I think this is hypocrisy and not even quite realistic. It's easy to quote famous people from behind a keyboard, but I just wonder how many of the slashdot crowd would actually put the money where their mouth is. After all, living together is but a series of compromises. No one can live their lives as they whish. Chance and other people will prevent this.
And as someone said

No man is an island,
Entire of itself.
Each is a piece of the continent,
A part of the main.

But I digress...

Re:ramblings...

[Nutt]

The key word in Ben Franklin's quote was temporal. If we could give up a little freedom for permanent safety I doubt he would disagree. However, giving up freedoms that, in the long run, won't make us any safer is just foolish.

I don't think that this scenario can be aptly described by Ben's quote. This is a decision that may increase people's freedom to not be harassed by spammers. Granted, there will need to be policies to keep personal information intact. Perhaps they should make all information that can place a person at physical risk (address, phone number, etc) only accessable to police and other law enforcement and provide non-risky methods of contact via email or instant messaging. They could even run as an intermediary where people write to the registrar and the registrar forwards the information to the domain holder thereby insuring that no personal information is passed around. Heck, now that I write that, I think it's a great idea.

Re:ramblings...

[0racle]

You have to provide this valid information when you register a business, and take out insurance, apply for credit, the list goes on, and to varying levels its all public to those who want to look. Owning a domain is no different, and is closer to owning a business then it is credit information. The only way to really be anonymous is to have no part in the world around you.

Re:ramblings...

[Fastolfe]

This isn't about making ownership and contact information available to "the authorities". It's about being a good Internet entity and making yourself reachable when problems on your network arise. These could be connectivity problems, configuration problems (maybe your mail server is rejecting all mail) or abuse problems, where a DDoS drone on your network is causing problems elsewhere.

The rest of us hurt when your DNS domain information is bad. It's not about turning the domain owner in for kiddie porn found on his Interweb site, it's about being responsible. If you want to register a second-level .com, you need to provide contact information like every other .com. That doesn't have to be you, but it has to be someone that can take ownership of the problem (and call you privately if necessary).

Re:ramblings...

[Anonymous Coward]

??? The main use of the whois database by spammers is *not* to get new email target addresses: it's just not that many email addresses.

The main use is to register fake or throwaway domains for their spamming services, so they can give a "reply-to" address or a valid hostname that throws all mail in the bitbucket except the email address, and they usually use a fake phone and address in order to prevent an upset spam victim or defrauded spam victim from tracing them back to their lair.

This is a *HUGE* problem, and is one of the things that makes spam tracking so hard. ICANN finally living up to their most basic responsibilities as a public registry is a welcome start.

Re:ramblings...

[smagruder]

You have to provide this valid information when you register a business, and take out insurance, apply for credit, the list goes on, and to varying levels its all public to those who want to look. Owning a domain is no different, and is closer to owning a business then it is credit information.

Ease of harvesting said information is the issue. Harvesting data from Whois is about as easy as it can get.

Re:ramblings...

[tormentae agent]

The key word in Ben Franklin's quote was temporal.

I think in the days of good ol' Ben, temporal was more of a religious-philosophical term, as in sense number two to four in the first entry here.

I think it's good

[Himring]

I recently received a letter indicating that the email address I had listed in the whois for my domain was invalid and that if I didn't update it I could lose my domain. I promptly did so. I both did not want to lose my domain, and was glad to see they are keeping that information accurate.

For intents and purposes, we're dealing with addressing, and just like each physical address the post office deals with needs to be as accurate as possible for mail to be delivered effeciently, so do the cyber addresses that exist need to be in order for things to work correctly and effeciently.

I work at a corporation where a former engineer setup several hundred remote domains with all servers having the exact same host name. This meant for years we could only utilize the network on an IP level (e.g., all scripts and so forth not being able to use hosts names, but instead using the differing IP addresses of each server). Now, I know there are ways around this, but logistically, we had to wait to "fix it right" and have now done so, but the point is, fore-thought into proper addressing, accurate information, etc., when dealing with networking -- or the postal system -- is essential. Keeping things up-to-date is also essential.

We bitch about mail being slow, but how many of us haved moved and then taken the time to inform each addressy of that move especially when the postal system lets us know to do so by still delivering the mail to us with the little yellow "inform sender of address change" sticker?

I'm glad to see the enforcement of accurate information take place....

Re:I think it's good

[wo1verin3]

>> I work at a corporation where a former
>> engineer setup several hundred remote domains
>> with all servers having the exact same host
>> name.

I think you've got other problems if he got away with that.

Re:I think it's good

[Himring]

Before my time, and you did note that part where I said, "former engineer...."

The problem with the Private Registration Service.

[Anonymous Coward]

I signed up for the private registration service on a existing domain but shortly after realized that the data is readily available from historic data certain whois websites have.

Wrong.

[morelife]

The registrar should be required to verify, not only at purchase time, but on a regular basis, the billing address for the domain registrant. The whois information should not be required to be public - since it contains addresess, phone numbers and email addresses. Yes, you could get this information somehow if you looked - but this information should not be made public in the context of a simple directory listing.

Above all it's stupid. Anyone putting correct information in there is not breaking the law anyway.

Excellent move! Make domain owners responsible.

[bigberk]

I think this is an excellent move. As an anti-spam activist, I frequently report blatantly invalid WHOIS contact info to both the registrar and to ICANN -- and never hear back from anyone. It's amazing when you see spammers' domains with fake cities (in the wrong country), blatantly invalid email addresses, etc.

I can understand that some people have reservations about posting their private information in public databases, but options such as PO Boxes are available (I use a PO Box myself). Also think of it in context: if someone knows your name and wants to find your address, they can easily do so anyway. You can also give a cell phone number instead of a home phone, of course.

Re:Excellent move! Make domain owners responsible.

[metlin]

Something funny -

A few days ago, a bunch of us CS grad students at GTech received spam in their ACM addresses telling them that for a small price, a diploma in Internet Programming could be theirs from some random University in Taiwan, located in Mexico :)

Ahh, the irony.

Dynamic DNS

[cybermace5]

Semi-anonymity is still available for those who want to use dynamic DNS services.

I wonder if ICANN cares about this at all, or if their problem is with false WHOIS information, rather than people avoiding having any WHOIS information whatsoever.

ICANN't

[TheUnFounded]

believe their gonna force me post my personal information on a global public database. I have very good reasons for NOT posting it.

1) I don't have a correct email address listed, so I don't get spam.
2) I don't have a correct snail mail address listed, so I don't get junk mail
3) I don't have a correct phone number listed, so I don't get telemarketers.

Seems to me like this will be a huge benefit to any company who's ever solicited me in a way I hate. Score: Businesses, 1; Users, 0

Re:ICANN't

[rainwalker]

How is this "+4 Insightful"? If you don't want to publish your contact information according to the rules dealing with high level domains, then don't register your own domain name! It's not like having a .com or .net domain is a right or something. If you can't agree to the rules, then don't register domains.

Re:ICANN't

[Fastolfe]

What happens when a host or a user on your network starts spewing forth harmful data (say, a DDoS attack)?

If it takes me a week to wind my way through the legal system because you chose to make it difficult for me to contact you, you can bet that I'm holding you partially responsible for the damages that extra week caused.

WHOIS contact information isn't about documenting your name and address for Big Brother, it's about being a responsible Internet organization. No one is twisting your arm and saying you have to have an Interweb presence with a .com DNS domain, but if you feel that it's necessary to have a presence that high in the DNS tree, someone needs to be reachable in the event you have a problem. The only one higher in the DNS hierarchy is the "com" domain, and I doubt ICANN or a gTLD registrar is going to take my calls about one of your users.

If nothing else, at least use the contact information of an agent (lawyer) or a proxy service (like Domains By Proxy), so that at least we have some path to get ahold of you if we need to.

Re:ICANN't

[Jah-Wren Ryel]

If you can't agree to the rules, then don't register domains.

The problem with that attitude is that the rules were written back when the net was a vastly different place. You know those stories about little towns out in the boonies where nobody locks their doors? That is what the net was like when the rules were written.

Since then, the net has changed, the rules haven't. What's worse though is that that back in the good old days, it wasn't terribly difficult to change the rules - common sense prevailed and guys like John Postel were running the show.

Today, the red tape and the beaurcracy is so out of control that the only hope of getting the rules changed to be in sync with the current environment is to bribe the beaurcracy. Something far beyond the reach of the regular domain name owner.

Re:ICANN't

[smagruder]

If you can't agree to the rules, then don't register domains.

My right to privacy supercedes the so-called rules of an anti-democratic organization. And my right to privacy doesn't stop when I register domains. And I'm not paying for the "privilege of privacy" either. My privacy is my privacy, Period!

Re:ICANN't

[smagruder]

If it takes me a week to wind my way through the legal system because you chose to make it difficult for me to contact you, you can bet that I'm holding you partially responsible for the damages that extra week caused.

Where's the IANAL? This is pure assertion without basis.

Re:ICANN't

[Anonymous Coward]

"What happens when a host or a user on your network starts spewing forth harmful data (say, a DDoS attack)?"

Now you're talking about the .net domain (internet service providers) -- how is this relevant to .org and .com (websites)?

Re:ICANN't

[Fastolfe]

Is this a troll? The Internet is not the web. Web sites are network hosts like any other.

Your move first, ICANN: clean up abuse of the data

[Denium]

On the one domain where I have a valid physical office address, I receive snail mail crap from domain registraion places asking me to renew with them. The forms they send are as deceptive as ever.

I called the Dipshit Registry of America after they sent mail to my WHOIS address. They told me that they don't do that (even though the name, "Network Administrator" matched exactly) and that it must have been one of their "marketing partners." They advised me to write to president@droa.com. So I did, copied to ICANN, and received no response.

I wonder how many complaints ICANN gets about registries abusing this data? I'm not budging until they do something about it.

define "invalid"

[zaren]

I have phone numbers in my whois that don't go to my home phone - they go to The Telemarketer's Nightmare because I sas sick of credit card and health insurance salesmen calling me trying to sell me stuff because they scraped my home number from my whois info. While not *my* number, they ARE valid phone numbers. Everything else in my whois info is legit, so I can be contacted by email or snail mail.

Sucks

[Anonymous Coward]

My domains use my old po box address.. i cancelled the box but never changed the info with my registrar.. i have a good reason though, i live with my mother and she has a stalker and i am NOT putting my home address.

Proxy Registration Services

[Jonathan Quince]

For those who fear stalkers, etc., there are services like Domains by Proxy (related to the registrar Go Daddy). These services will register the domain on your behalf; they require valid contact info from you, and they put their own contact info in the WHOIS database. This is technically in line with the ICANN rules because the proxy registrant is the real registrant of the domain. (Although they have a contractual obligation of doing it on your behalf.)

If you break the terms of service -- for example, if you use the domain for spam support or to commit illegal activities -- the proxy registrant will expose your real identity. Otherwise, your privacy is pretty well protected with these services.

I've used those types of services (including Domains by Proxy) to register domains on behalf of minor children who shouldn't have their contact info exposed online, and for other purposes requiring some level of privacy. For my own domains, I'm not afraid to use my valid PO box address and phone number.

(Note: I am not affiliated with these services in any way, except as a customer.)

Re:Proxy Registration Services

[Anonymous Coward]

Domains by proxy charges $9/year for the service, expensive if you have a lot of domains. ProtectFLY offers the same service for only 99 cents extra.

I own a dozen domains, and I'd rather pay $12/year than $108 every year.

Hrm...

[yoshi_mon]

You've never had a right to privacy as a domain owner. If that bothers you, don't use DNS and just publish your web server's IP number.

And then that begs the question is it legal/ethical to require that information to be public?

I know of no law that requires that information to be correct and I can see several ethical issues that would preclude this not being a privacy right issue.

My experience

[macdaddy]

There was an unused domain I wanted to purchase a year or so ago. They guy paid in 10 years in advance for the domain. All of the WHOIS information was bogus. The address pointed to a a chip manufacturer, I forget which though. The domain have no DNS records. It was just a dead domain. Basically there was no way to track down the owner of this unused domain to make an offer to buy the domain. The registrar wouldn't help. They wouldn't even contact their own customer to ask that they fix their WHOIS information. Maybe I should have made a complaint to ICANN and gotten the domain revoked. To this day the domain still hasn't been used and still has no valid WHOIS or DNS records. What a waste.

Then don't register the "I-M-GAY.COM" domain name

[C10H14N2]

Seriously, there are plenty of free website services where you don't have to register a public domain name. If you are just using URL-forwarding, most of the contact info will point to your ISP anyway--because they are the ones running the servers. The primary point of Whois is to identify the people running the physical servers. Yeah, the internet has gotten more complex and the Whois database doesn't make as much sense as it did even ten years ago, but that's hardly a reason to say "screw it, let's just let everything go all to hell."

With that in mind, if you're running ANY kind of commercial site, your information SHOULD be public and accurate just like a business license (which generates more snail-mail-spam and telemarketers than Whois), articles of incorporation or trademark registration. There's a rather substantial public interest in maintaining a public record of such proven identities.

Domain Collectors' Field Day

[Jonathan Quince]

if everybody with bad WHOIS information lost their domains

Anybody who collects domains -- in particular, who trolls the expired/deleted domain lists looking for little gems -- would be delighted.

As someone who enjoys collecting cool domains, I am drooling at the thought. I'm sure a lot of domain squatters and people who run those pseudo "search engines" where there once were websites are, too.

Thats risky.

[sheetsda]

Do you suppose they'll let you take the domain if you want to switch hosting services? They registered it, it has their info on it, and (I'm guessing) they paid for it (out of money you gave them of course).

Re:Thats risky.

[Anonymous Coward]

As a hosting provider that does this, I recognize that doing good business is more important. If you were a concerned client, I would give you a written agreement that you own the domain, not me.

I had a weird problem with this in town. I have a client who ran a politically-incorrect site that I hosted for them. They put in bogus information and when the NS listings traced back to me, the mayor's henchmen came after me and publicly chided me for being the owner of it. Bottom line, it is a very grey area now to say the registrant is really the owner.

A WHOIS horror story

[madopal]

I've had my domain since about 1997. At some point during the 'Net boom, some idiot company harvested a BUNCH of WHOIS info. At the time I had the correct information in there (INCLUDING phone number).

Well...I got on every telemarketing phone call list imaginable...AS A BUSINESS. You think it's hard stopping residential telemarketing? Wait until you start getting phone calls at your house asking you to buy Pitney Bowes postage equipment, insurance for your employees, etc, etc.

It was a NIGHTMARE. All I could do was ask the individuals to a) place me on their do not call list, and b) ask where they bought my information from (information that, not a SINGLE COMPANY was able to provide).

So, since then, I've used a P.O. Box for mail, and I FLAT REFUSE to give a phone number.

I'll start providing valid information when I know that it isn't going to be harvested by any slimy company out there.

Um no

[Seven001]

I own a few domains and I never put the right phone number in. I also have an email address strictly set aside for domains only - which catches TONS of spam, and I tend to catch a little bit of snail mail spam as well - usually from the same company that tries to trick people into switching to them and paying $25+ a year. I hate the way that whois info is public though, and you have to pay (usually more than the price of the domain where I register domains) to make it private. It should be automatically private, at no cost. Someone above mentioned something about the reason that is there is for complaints and such - well I just happen to have an idea that could fix that problem easily. Make any complaints or inquiries go through the registrar. Kind of like a registrar private messaging system. It might seem like a lot, but I think it is little to ask to help stop the whois info harvesting and millions of spam emails that get sent as a result of it. ICANN already has a ton of requirements that registrars have to meet, why not one more.

Slashdot? Or Schoolbookdot?

[rice_burners_suck]

Do you believe this is a step in the right direction? Why?

This sounds like a question from some 5th grade social studies book... Brings back nightmares from those days. Please don't write like this again.

Need a phone number?

[Denium]

I use eFax's free service for my domain phone number. Although their support blows it works well when I need a legitimate number.

Agree and disagree

[Anonymous Coward]

I agree that it should contain correct information when registered.
I however think that any other information than a valid email, should be optional if people want that in public.

Email in WHOIS

[transient]

It's important to have a valid email address in WHOIS that goes to a real person. As someone mentioned above, the Internet is cooperative and it's hard to cooperate when you can't communicate. But it's also important to keep spammers from finding your email address.

Here's a suggestion. I've only been doing this for about a week but it's been effective so far. In WHOIS, list your email address as dns-admin@yourdomain.blah. Configure your mail server to accept email to this address but then send a bounce with "5.1.1 User has moved; please try dnsadmin@yourdomain.blah" message (note the lack of hyphen). Configure dnsadmin@yourdomain.blah to go to your real mailbox.

This works because no spammer ever uses their real email address, so they'll think their message was accepted and they'll never see the bounce. Meanwhile, a real human being who actually needs to communicate with you will get the bounce with your real address.

As for physical contact information, the best I've come up with so far is a PO box. But that costs money.

Re:Email in WHOIS

[Anonymous Coward]

This would be a major pain for people whose e-mail addresses are being used in forged Mail from: fields.

Re:Email in WHOIS

[arkane1234]

This would be a major pain for people whose e-mail addresses are being used in forged Mail from: fields.

No more of a pain than getting a "We're sorry, this users mailbox has reached it's quota. Your message is undeliverable."

Broken registrar systems

[RonVNX]

My registrar is GoDaddy. Every time they "improve" their stupid web interface, it gets harder and harder to enter correct information into their system.

Needless to say, attempts to get them to remove the boneheaded logic errors is an exercise in frustration, but that's probably just an extension of their horrific customer service.

Yes, I'm looking for a new registrar... how'd you guess?

Re:Broken registrar systems

[Denium]

I've had a lot of problems with GoDaddy's braindead interface. Every now and then I get hit with some stupid database inconsistency. The latest was when I was updating nameservers: it somehow duplicated one of my nameserver entries so that whenever I tried to remove the dupe or change *any* entry it would fail complaining about a duplicate. A smarter system would have looked at the data it was about to enter and wouldn't have allowed the duplicate in the first place.

I do enjoy their mail forwarding, though, so I'll keep my primary domain with them. It's nice to have in case I lose hosting or something stupid happens.

I've taken the domains that don't matter so much to EV1's cheap registration. It's barebones and just like every other idiot TUCOWS resellers' interface but that's all I need.

Spammers and other questions...

[John Seminal]

Why would a spammer need to register a website to send out their spam? How is this going to help eliminate spam? The reason I want a valid WHOIS database is so I can find contact information if there is a problem.

Second question. Why not have some small fee in order to access the WHOIS database. Make it a dollar charge, that has to be charged to a credit card with correct contact information (for example, they fax you the data). If someone abuses the database, then they get cut off.

Third question, and the most important. How the hell can we make a better system where the 98% of us who do not abuse resources do not get screwed by a few bad apples who will do anything for a buck. Do we make it a charge, so there can not be an easy profit? Do we have a system where a few trusted people are allowed to forward requests, and block those they know are from the bad apples? How do we identify the bad apples?

This all pisses me off. I hate it how one person can force the rest of us to NEED locks for doors. It would be better if they did not exsist.

Re:Spammers and other questions...

[Nutt]

I don't like your second question. I use whois all the time to determine if a website (usually commercial) is legit. If the address registered turns out to be invalid I know to steer clear from the website.

Personally, I feel the internet should stay away from charging. The moment you begin to charge for one service it's only a matter of time before other services get charged for as well.

Re:Spammers and other questions...

[wytcld]

Why would a spammer need to register a website to send out their spam?

Very good question. Most spams track back to cable IPs, others to dial-in - in these cases it's clear who the provider is, while the return address is usually totally false anyhow. Just set the laws up so the ISP gets shut down cold if they're beyond a certain threshold of verified complaints.

The exception is domains which are spammed for - spams that contain a url to go to. Here the registration record should mean something. But again it's even more certain to track who the provider is. Again, just shut them down cold - total confiscation of assets - if they don't within on day of any documented complaint shut down the offending site. The only problem here is the fake spam I'll send out from the Republican National Committee referring folks to their site ... but is this really a problem?

Re:Spammers and other questions...

[boltoflightning]

I actually believe just the opposite! hehe
I believe that life would not exist were
it not for duality. You must have two,
and from two you can create countless
variety. So Life without Death, or
Good without Evil, what is it? Well
It would certainly be something different.

Re:Spammers and other questions...

[Anonymous Coward]

Spammers register throwaway addresses because one of the most basic and most effective, rules for email spam detection is to verify the hostname as being valid. Invalid hostname means the mail is not accepted: Roughly a third of more than 10,000 email messages a day at one site I run have invalid hostnames, and no one has *ever* complained about real email being blocked for this reason.

To fix the problem, being able to track the abuse back to a real person and a real address is extremely helpful. It lets you know where to direct the complaints, the lawyers, or the baseball bats.

Unfortunately, we can now expect the spammers to hide behind a small set of throwaway "private domain clearing houses", basically a shell game to hide their real business address.

Re:Spammers and other questions...

[Skapare]

I access WHOIS data about 50 to 100 times a day most days while dealing with spam issues. I sure as hell won't be paying a dollar a hit to access it. It's problematic with a small few domains with bogus info, but your idea will make it totally unusable for me.

Correcting the spam problem does not involve hiding email addresses from spammers. If they don't get it from WHOIS, they'll most of them, eventually, from somewhere else, anyway. The real solution to the spam problem is to split the internet into two parts, one where all the spam is, and one where none is, and only let the non-spammers to come over to the good side.

Oh wait, I already hear the echos of whines that splitting the internet into the spam and clean parts will result in net fragmenting. Well, duh!

Re:Spammers and other questions...

[0biJon]

"Second question. Why not have some small fee in order to access the WHOIS database."

It already exists.
Privacy.ca is a service that allows domain holders to protect their confidential contact information from prying eyes. It does this by only giving out your domain contact information to registered and verified users who have proven a need for it. Each time Privacy.ca releases any information, you are informed of whom it was released to and why. This puts you in control of who has your personal information.

Screw ICANN

[Anonymous Coward]

There is no reason why this information needs to be publicly available. The correct information could be stored privately with ICANN and available through the proper channels (For example: a warrant).

The one time I used all of my correct information I ended up getting a) prank phone calls, b) calls from people who disagreed with some of the sites messages (think free choice vs. life, not PORN :P).

The people who are lazy to call end up mailing you. Sure you can setup an account that just collects all of the email and then dumps it, but what about that 1 legitimate email every year or so?

I was constantly emailed by other domain firm to con me out of more money through false renewal claims (Your domain is about to expire: NetSol).

If ICANN were really serious about your information being correct it would have done something years ago. These half ass attemtps to enforce a questionable policy don't convince me that they really care.

I've tried being nice and having all of my information public. Now I'm happy to live on 123 Freedom Lane, Chimichanga New Mexico. :)

Not quite...

[Dimensio]

You don't just turn off the domain instantly. Attempt to contact the domain holder (they have to have *some* kind of valid contact known to the registrar). If calls/emails/letters are not answered, lock the domain. Tell the holder that if data isn't updated within a certain period of time, the domain registration is forfeit.

In the case of spammers' domains, take a few extra steps. First, lock the domain right away. Second, instead of attempting to inform the spammer that their domain is locked until the WHOIS data is updated, send an assasin to where they live to have them killed.

Re:Not quite...

[Anonymous Coward]

I would ask for volunteers, but the response would be sooo overwhelming that I would be labelled a s+p+a+m+m+e+r!

Forget the spammers... it's the stalkers!

[Anonymous Coward]

How many personal domains are out there? And how many freaks are there online who'd wet themselves over the chance to stalk people whose website the dislike or whose website turns them on or whatever the hell it is that they get off on?

My websites all point to my former address. I moved because some freak was harassing me and I was worried he was going to show up on my doorstep some day. I didn't update the listing and won't for at least another year, unless I get a PO box, and I'm sure as hell not going to spend the money on that when I'm getting zero benefit on it.

My registrar has my real contact info. That's all that matters. If someone has a complaint about one of my sites that can't be resolved by emailing me, they can write to my hosting provider or my registrar.

Re:Forget the spammers... it's the stalkers!

[Fastolfe]

Why do you feel it's necessary to register a DNS domain under a gTLD? That's your decision, and with that decision comes an obligation to provide contact information for activity that occurs under that DNS domain. Just because you're on the Interweb and not the Internet like the rest of us doesn't exempt you from the rules.

Your registrar isn't going to accept calls in the middle of the night because your PC is infected with a virus or DDoS agent and is saturating my network with traffic. That's not their job. Either publish contact information or get your DNS domain and/or network addresses from a provider that will publish their own information on your behalf.

Re:Forget the spammers... it's the stalkers!

[Anonymous Coward]

Your registrar isn't going to accept calls in the middle of the night because your PC is infected with a virus or DDoS agent and is saturating my network with traffic.

How is this related to having a domain name? Certainly most infected zombies do not have their own domain under a gTLD. You'd track these boxes down by their IP addresses, not their domain names.

Re:Forget the spammers... it's the stalkers!

[Avihson]

I never even considered stalkers, I chose anonymity for convenience.
My registrar emails me too frequently with "special offers" and I get site related junkmail even though my whois data does not point to my address. I can only surmise that the registrar is making a few bucks on the side selling data.

If there was a valid reason for the FBI or the IP-Police to kick down my door, they can do a dig on me, go to the switch up the road, and pull the line. When I pop out of the door to look at the wires, they can rush me with all their SWAT gear.

For everyone else - It's the internet, use it to contact me, or lookup the netblock owner, they get a check from me every month. If the law enforcement officers can't do that, they should be kicked back to parking meter duty.

I have an unlisted phone number for a reason, I'm sure not going to post it in the whois database!

Re:Forget the spammers... it's the stalkers!

[Anonymous Coward]

Your registrar isn't going to accept calls in the middle of the night because your PC is infected with a virus or DDoS agent and is saturating my network with traffic.

This is the most ignorant argument I have ever heard of in respect to requiring valid whois information for domains under gTLDs. There are plenty of "PC"s that are infected on the internet that do not have a domain names pointing to them. For hosts that are DOSing other hosts it is always possible to do an ARIN lookup on the network address and find a valid contact for the IP netblock, namely the ISP. Then contact them to address the problem. Comparing ARIN netblock whois information with gTLD whois info is completly asinine.

Re:Forget the spammers... it's the stalkers!

[Fastolfe]

I would probably try both avenues. The DNS domain is probably going to represent organizational lines better, so I would attempt that first. If that failed, I would hunt through netblock allocations.

Both DNS domains and netblocks are normally made available through the same WHOIS services, though, and I think ICANN has the same contact policies for netblocks that it does for DNS domains.

Re:Forget the spammers... it's the stalkers!

[Fastolfe]

I disagree, but you're focusing upon an example while ignoring the greater argument. DNS contact information has uses beyond Big Brother and spammers. What about e-mail service problems? What about a problem with a user identified by e-mail or DNS hostname and not IP address? Maybe the only connection I have with a problem is through the DNS hostname.

Re:Forget the spammers... it's the stalkers!

[Anonymous Coward]

A-FUCKING-MEN! My domain points at my old address for exactly this reason. My registrar can contact me via e-mail if they need to. That goes for everyone else too. When you start getting stalkers calling your house at 3 in the morning saying they're going to kill you (and you have reason to suspect they have the resources to get a passport and a plane ticket to do so), you don't fuck around. That's also why I keep a loaded gun on the premesis over my fiance's objections. And don't give me that shit about contacting the cops. The local police were too clueless, even though I did the investigation for them (providing chat logs, recordings on the answering machine, whatnot), and the feds didn't give a damn (went as far as to say that it wasn't illegal to make death threats over the phone). Phone couldn't (wouldn't) block the calls so I had to change the number. Bullshit if you ask me. Thank you, for opening my eyes to the world.

Re:Forget the spammers... it's the stalkers!

[Anonymous Coward]

I recently used the network solutions "private listing" feature. For $5/year they put their address/phone number and a constantly changing email address in the WHOIS DB. They answer calls, forward certified mail, and forward email to my private contact info. I maintain full control of the registration.

Re:Forget the spammers... it's the stalkers!

[Anonymous Coward]

This is why I like the Nominet (.uk) implementation of allowing private individuals to "opt out" of publically displaying their details. You can still get in touch through Nominet (though obviously not as quickly) but it affords an extra level of privacy & protection. Read more here (search for "Consumer opt out provision" to avoid having to scroll through):

http://www.nic.uk/ReferenceDocuments/TermsAndCon di tions/TermsAndConditions.html
(trim out the Slashcode-introduced space)

Re:Forget the spammers... it's the stalkers!

[howhardcanitbetocrea]

I'm sure as hell not going to spend the money on that when I'm getting zero benefit on it
Survival is hardly zero benefit.

Re:Forget the spammers... it's the stalkers!

[silas_moeckel]

I think the point was domains were supposed to be for businesses and orginizations ie places that have headquarters. The only real thing I could see was allowing one contact to be minimal name and email but requiring one valid and complete technical contact. But if you didn;t like the rules when you signed up you should have not aquired a domain. It would be nice if every incomplete entry was purged for noncompliance.

Re:Forget the spammers... it's the stalkers!

[Avihson]

Sorry if I offended your sense of propriety, but I run my business my way. My domain is for my business, not a vanity domain.
Just as you chose to obfuscate your contact information here on slashdot, I chose to obfuscate my contact information with ICANN. And I'll bet we both do it for the same reason.
What would say if Slashdot killed your account because you did not have a correct email address?

I happen to have my whole "corporate headquarters" in a building on the other side of my driveway. I run a lucrative consulting firm and we use a PO BOX as the legal address. I don't want or need solicitors, sales-wonks, or proselytizers of any stripe wasting my staff's time or worse, bothering me after business hours. Since my local zoning laws do not require me to post a large neon sign to attract mosquitoes, I fail to see how ICANN can force me to attract bloodsuckers of another sort.

If It comes to that, I'll just register my dog, Eugene, as the tech contact.

Re:Forget the spammers... it's the stalkers!

[silas_moeckel]

I think your missing the point to agreed in your contract to get the domain name to provide this information. I do beleive a PO box is acceptable for an address. I didn't enter into a binding contract with slashdot they can cancle my account at any time for any reason. Nobody said you had to give out your email address there is nothing wring with tech@mydoamin.com as long as somebody reads the email every now and then least was passes the spam filters it's called a role account. ICANN can because your agreed to it as a provision of the contract to get your domain registered. Realy this has little to do with ICANN as it was required before them if anything they have relaxed the rules since 92 when I got my first domain.

Re:Forget the spammers... it's the stalkers!

[HTH NE1]

I signed up for that as well. I also made sure I enabled it before putting my current contact information on my domain, which was partially out of date for over half a year.

I've been getting an increasing amount of spam at my contact address for my domain ever since two companies contracted with a data mining company to recover the e-mail address for my accounts with them, when that address was not required by nor provided to them.

A PO box?

[Dimensio]

Yes, it would require the expense of maintaining a PO box, but you won't be able to track someone down any further than the city in which they live (unless they choose to host their PO box in another city).

Re:A PO box?

[cmdrbuzz]

In the UK, if you want the forwarding address or contact address for a PO box,
You just ASK the post office.

So it doesn't protect against much, it just helps to categorize your mail.

Voice Telephone NOT Universal

[Anonymous Coward]

For my own domains, I'm not afraid to use my valid PO box address and phone number.

Some people simply do not have voice telphone numbers. It's unbelievably arrogant for those stinking turds at ICAAN to demand that one have a voice telephone number to be graciously allowed to have a domain at all. May the strutting filth at ICAAN eat shit and die horribly.

Yes. So that abuses of the system are dealt with.

[sonamchauhan]

> Registrars, the companies you register your domains with,
> are under contractual obligations to ensure this information
> is correct and accurate.
>
> Do you believe this is a step in the right direction? Why?

Yes. So that abuses of the system are dealt with.

pointless

[br00tus]

This is a very old game, punishing end users for something certain ISPs are screwing up. I definitely would like to see problems like spam fixed, but this is just punishing good users for something spammers and the like are doing, and the spammers are going to find a way around this anyway. OK, requiring a valid e-mail address that responds to ICANN e-mails or whatever I *might* accept, but I find a jackbooted attempt to get real names and addresses (of course, ONLY in the United States) by pseudo-governmental authority quite weak. I'm sure there are plenty of boot-licking, groveling, authority-worshiping little computer dorks on Slashdot who love the idea of lawyers and the ogrish, incompetent government now that much more successful in exerting their authority.

It's the wrong way to go

[Catbeller]

1. The internet was not designed to be a telephone system or a post office. Anonymity and openness are what made it what it is today. Want a secure communications system? Build one. IP was not designed for businesses and their needs. Closed systems existed before busineses stampeded on to the internet. If they want registered users and trusted boxes, then they should build an alternative network that does not connect to the internet itself. Leave what is, alone.

2. Spoofing whois is essential for people who wish to use the internet to get messages across that powerful people want suppressed. Or at the very least, powerful people will retaliate.

For instance:

mediawhoresonline.com -- the people behind the Horse (out to pasture at the moment) were afraid of retaliation in their personal and private lives. They have some justification for this, for Bush and his people have grown famous for their ruthless vengeance against anyone who crosses them - Valerie Plame, Wilson, Richard Clark, the owners of that restaurant in Texas tht called the cops on the Bush Girls (business shut down for "code violations"), the Funeralgate affair (nailed the whistleblower AND her department). And innumerable others whom we don't hear about because, well, reporters don't want to cross the Bush family either.

Buzzflash.com also hides their identies for the same reason, I think.

Now, on to the cultbusters. During the late '90's, a lot of ex-Scientologists went online, mainly on the Usenet on alt.religion.scientology, but also branched out into the web as well. They had to hide their identities: the utter certainty of the destruction of their lives if they ever were outed was paramount. The viciousness of the attacking Sea Org (secret agents oh my) is legendary, and you can check it out at xenu.net, as well as any number of other sites.

Just don't use the WayBack machine: they purged the history of the internet of all the critical sites with any teeth at the behest of the Hubbardites.

Now there are others: the Moonies, the nutballs in Japan, any number of small, evil little cults all over the U.S. If you want to expose them, anonymity is key. And anonymity was long held constitutional in the U.S. under the 1st amendment as necessary to demand redress of wrongs without fear of retaliation.

I fake my whois info, and always will.

3. Registering users will not stop the spam. Oh please. People who send billions of messages and make millions of dollars aren't scared of fines or jail time. They're rich; they won't see real jail. This registration crackdown is happening because the control freaks in law enforcement can't stand seeing anonymous communications. It's like nails on chalkboard to them. I think Pratchett said it best when he wrote that cops, if they had their way, would make everyone sit at home, at their tables, with their hands on top of the table where the cops can see them.

It's not like we haven't seen this coming. The jail doors are clanging shut, and they won't let us bang on any pipes in Morse code without the ability to listen in any time they'd like.

Re:It's the wrong way to go

[Night Goat]

The internet was not designed to be a telephone system or a post office. Anonymity and openness are what made it what it is today.
If this were truly the case, they wouldn't ask you for contact info for your domain, or it would be marked as voluntary. People need to contact owners of domains on occasion. Whois is the best way to do that.

Re:It's the wrong way to go

[Catbeller]

It's effectively voluntary, since you can fib if you like. If a user finds it necessary to be contacted when the site has problems, then the user may leave accurate info; if they don't find it so, then they accept the consequences.

Re:It's the wrong way to go

[Anonymous Coward]

Here is some interesting domains to look at

blackvoices.com

and

whitevoices.com

While the two dont seem to share any connection, I am certain that the owner of the first arranged to have the second registered, to ensure there would never be a site there.

This is entirely offtopic, but Ive always found it interesting that its acceptable to have a 'black history month' or 'black culture', but if someone were to dare propose a 'white history month', they'd be met with outrage.

Re:It's the wrong way to go

[BillGodfrey]

postmaster@

Re:It's the wrong way to go

[Night Goat]

That only works for e-mail. Not all domains have mail servers associated with them.

Never again.

[Anonymous Coward]

I've owned my domain since the late 90's, and for the first couple years I had legit info in the .whois dbase.

I used to write a lot about moronic white supremicist groups around the country.

One day I saw my home phone and address being passed around on skinhead message boards, and the real-life threats began.

I'll never provide legit info again, ever. I'd rather lose my domain than have someone come to my door and threaten to kill my "nigger loving" family, again.

Re:Never again.

[boltoflightning]

Well, don't feel bad..
There are people that take care of problems
like that. You can find a person for almost
any need! hehe Cleaning up the skinheads
might just be a worthwhile purpose too.

I believe in good and evil. I must
choose a side and act appropriately I guess.
I for one will choose good. I am honest,
and I have honestly represented myself
in whatever way is necessary online.
If I find myself in your position,
I will feel good knowing I am kicking
some skinheads ass because it is GOOD.

Alternatives to ICANN-controlled domains

[Jonathan Quince]

You've never had a right to privacy as a domain owner. If that bothers you, don't use DNS and just publish your web server's IP number.

Or:

• Look for a country-code domain that will allow you to keep your contact info private. I don't know of any that will; but I haven't really looked through the list.
• Use a proxy registration service and don't break their terms of service. (You shouldn't be spamming anyway. :-)
• Buy a subdomain from a private party. I own oligarch.com, so I could hypothetically offer to let you pay me to make NS records on oligarch.com pointing lostcluster.oligarch.com to your name servers. Presto, you now have a working domain delegated to you with none of your info in the WHOIS. True, it's not a second-level domain; but there are many situations where people find this acceptable, particularly when it's under a nice, short second-level domain (e.g., cjb.net).
• Turn off your computer. Go outside and play. <g>

And I'm sure there are other ways to go about using the DNS without putting your data in an ICANN-controlled database.

Re:Alternatives to ICANN-controlled domains

[beebware]

.uk domain names allow you to "opt out" of the WHOIS information - however, it's only for "personal usage" domain names. If you use a domain name for commercial purposes, then you aren't allowed to "opt out" and have to have the information displayed. I believe this is due to the way the Data Protection Act here in the UK affects "private individuals" and "trading entities" (but feel free to have a look round http://www.nic.uk yourself)

Re:Alternatives to ICANN-controlled domains

[Anonymous Coward]

>Look for a country-code domain that will allow you to keep your contact info private. I don't know of any that will; but I haven't really looked through the list.

.PH domains are like that.

The apparently do lots of business with spammers.

They give out free domains. They cite "privacy" and "spam" concerns when you complain about the spammers and crooks using .PH domains with all fake names and information.

You can't get information from their WHOIS, and ICANN won't/can't do anything about it.

.PH is perfect for spammers and crooks who desire anonymity.

Companies and individuals are different

[gorbachev]

I will never, ever register any of my personal domains with valid registration information. There's absolutely no way.

I will not have all the people who don't like what I publish on my websites harrass me at my home address, which is the only "valid" address I currently have to use in my whois records. I will not give that information out in public for any reason. There are way too many net.kooks out there for me to volunteer my home address.

I will also not pay to get a p.o. box to avoid being harrassed. Why should I pay to be left alone?

For businesses, however, I do agree, the whois records should be valid and uptodate. This includes the spamming parasites, who've made it an art form to forge every single record of theirs they possibly can.

How can they prove it?

[boobsea]

I, for one, refuse to let my personal information become public.

What if I were the operator of a website that contained opinions that were very contraversial? One example I can think of is the abortion debate. There are extremists on both sides who will spend every waking moment trying to ruin the lives of people on the other side of the debate.

Do I want to invite people to my house to vanalize my property or burglarize me if I can help it? Certianly not.

I have always used fake information, except for my phone and email contact (I figure that its pretty immune to what I'm worried about, I can filter spam, etc) which I leave in case my registrar accidentialy forgets who my domain belongs to.

How do they know I do not live at this address? Are they going to send someone out? What if its just a drop box for mail?

Re:How can they prove it?

[boltoflightning]

The easy answer is follow the money.
In this case it is simply knowing how
payment is made and by whom. Somebody
knows the answer to that question.
Somebody know the answer to all the questions...

Re:How can they prove it?

[Anonymous Coward]

I payed for all my domains using a money order.

Voicemail drops are cheap.

[Jonathan Quince]

Some people simply do not have voice telphone numbers.

Search Google for various queries involving the term "voicemail". Depending on your needs, you can get a voicemail drop box for very cheap. (Including one that's at an extension if you want to get really cheap.) Voila, valid WHOIS contact info.

After all, you're going to have to spend some money if you want a domain name. I just consider it part of a cost to be amortized across the domains I own.

Why require accurate contact info?

[Bob9113]

Do you believe this is a step in the right direction? Why?

Just firing from the hip here, but corporations and real estate have to have accurate contact information too. I'm guessing this has to do with preventing squatting, and with resolving legal issues which involve the owner of the property in question. Both of these issues have correlaries in domain name space.

One bad side - Privacy

[nurb432]

One case is when private individuals get harassed personally due to their WHOIS postal address...

I know of a couple of cases where this happened.

Letting you put in your ISP's address for contact information, then let the ISP contact you in case of a problem would make more sense. You are still accountable, but have a layer of privacy.

Be yourself

[JohnCub]

For all of those people who think being anonymous and giving fake info is the way to go...

I feel everyone should be accountable for what they say and do. So if you want to spout off about some hate group (just like in real life) you might have to pay the consequences. Nothing in life is free so stand up for what you believe in and live with what comes from saying it. If you aren't willing to pay the price then you should not be saying those things in the first place.

It seems like common sense to me.

Re:Be yourself

[Anonymous Coward]

Thats why you are using your real name to post on Slashdot, right?

Obligation

[The Monster]

a business's obligation to file incorporation papers (including a physical address)

I'm not aware of any requirement that one's home address and phone number be made available to all comers.

#include <ianal.h>

However, the name and address of the registered agent (attorney) for the corporation has to be there so that any potential legal adversary can serve papers at the right place. Legal papers that have been served upon the registered agent thereby have been served upon the corporation itself.

So a registrar that allows you to use a proxy for the publicly-posted contact info isn't doing anything wrong. By putting that name in the WHOIS, you're effectively appointing that entity as your agent.

Re:Obligation

[Fastolfe]

Absolutely, but this really only applies to the administrative contact for a DNS domain. There may be technical issues that need immediate technical action to resolve (abuse, protocol violations, other network problems). WHOIS typically provides different types of contact fields, and each one is useful in its own way.

Of course, that technical contact doesn't need to be the end user either. You can have a registered agent acting as an administrative contact, and your IT guy or Internet provider acting as your technical contact. One might suggest that this is actually a best practice.

In other words,

[Anonymous Coward]

In other words, shut up if you don't want to get hurt.

Some role accounts are no good.

[Jonathan Quince]

webmaster@ is a magnet for spammers. I bounce it at all of my domains. Plus, it's WWW-centric; there's more to the Internet than just the Web. Should a Net site that doesn't run a WWW server be forced to keep a webmaster@ role account open to collect spam?

I do keep postmaster@ and abuse@ open on all my domains. In the latter case, it's just a convention, but a useful one. (And I don't see spammers sending to abuse@ every domain they can find, for obvious reasons.)

As for the rest, why should I keep noc@ (for example) for domains that are virtual hosts?

Re:Some role accounts are no good.

[AndroidCat]

While abuse isn't strictly required mailservers are expected by RFC2142 to accept mail to abuse.

From what I've seen, spammers will not only hit abuse mailboxes, they'll hit abuse@something.mil mailboxes. Rule #3.

Hell no!

[Snaller]

All registrats who don't care should lose their ability to register names! So many times i've complained about faulty information to some registra, and their reply was "there is nothing we can do about" - well if not you who the fuck else! Idiots.

Common Sense? I dont think so.

[boobsea]

The American Revolution was full of dissent. Lots of it was done anonymously (pamphlets, newspapers, etc) because they knew of the reprisals that could occur if the wrong people (who could do much more to them than the people speaking out could do back) heard.

Don't believe me? I will give some real examples.

1. My school district tried to discipline me for publishing a website very critical of them. (Nothing ever ended up happening because the people in the right part of the chain of command had some sense)

2. Many countries, (China for instance), publishing information critical of the government can land you in jail (or with tanks rolling over you if you think a mass protest will somehow help)

3. Extremists hate people who talk bad about them. They would love to egg your house, threaten you day and night, and send you explosive packages in the mail.

It's a crappy rule; change it.

[wurp]

Three years ago some jackass from /. thought it would be funny to call up my home phone and leave a nasty drunken message because I disagree with him about the current SUV craze. The reason he was able to do this was because (stupid me) I kept accurate whois information for my domain names. Had I pissed him off enough, there was nothing keeping him from coming to my home.

Requiring public, accurate whois information is idiotic. I think a requirement for accurate information held in confidence by ICAN is a good idea (to be available to the police with a warrant). Before you run out there cheering for accurate public information, think about how you would feel if every email and every web posting you made had your home phone & address on it. If everyone were sane and reasonable, it would be good. Since everyone's not, and someone can anonymously e.g. burn your house down, it's bad.

Spammers are just going to get phones with junk info and PO boxes. This can only hurt, not help.

I'm surprised to see the responses I'm seeing on a site where most people ostensibly argue for free speech and anonymity.

Re:It's a crappy rule; change it.

[AaronD12]

I agree... that information should be private.

I just registered a domain using my correct information (my registrar would not allow an "invalid" e-mail address), and voila... I've gotten over 500 spam a day on that e-mail address. Previous to the registration, I was getting about 1/10th of that, which is still far too many.

As long as we follow the rules and fill out valid information, there will be bastards that won't follow the rules and will take advantage of us.

Re:It's a crappy rule; change it.

[Anonymous Coward]

Three years ago some jackass from /. thought it would be funny to call up my home phone and leave a nasty drunken message because I disagree with him about the current SUV craze. The reason he was able to do this was because (stupid me) I kept accurate whois information for my domain names. Had I pissed him off enough, there was nothing keeping him from coming to my home.

That's when you call the cops. If someone really wants to stalk you, there are shitloads of other places to get your name, address, phone number, and even more info (where you work, etc) from. How is whois info any different from the phonebook? If you want privacy, get unlisted whois info (most registrars now offer this for a fee, just like your phone company does for a fee).

Requiring public, accurate whois information is idiotic. I think a requirement for accurate information held in confidence by ICAN is a good idea (to be available to the police with a warrant). Before you run out there cheering for accurate public information, think about how you would feel if every email and every web posting you made had your home phone & address on it. If everyone were sane and reasonable, it would be good. Since everyone's not, and someone can anonymously e.g. burn your house down, it's bad.

Huh? My computer doesn't ask me for my address and home phone number every time I post on a website. You must have some newfangled one. Also, there are plenty of places to get a free e-mail address that you can use for posting if you're paranoid. Why do you have to sign it with your domain name? No one's requiring you to do that. Also, do you put your return address on anything you mail? If so, any schmoe can get that and come find you.

I'm surprised to see the responses I'm seeing on a site where most people ostensibly argue for free speech and anonymity.

This is about ICANN enforcing current laws, not creating new ones. Just because something wasn't enforced doesn't make it valid. Tell that to the cop the next time he pulls you over: "But gee officer, I never got pulled over the 20 other times I went 80, I assumed the law was invalid.

Re:It's a crappy rule; change it.

[Anonymous Coward]

Listen, anonymity is silly. Don't you dare to stand up for your opinions? Are you afraid of *violence*? Then perhaps a reality check is in order! People just don't go and bash other people's head in just for fun. Yeah, they may call you, but the best way to counter that is to cut your cord. Because you might be in the phoooone booook [spooky voice] as well...

Re:It's a crappy rule; change it.

[Mad Marlin]

Three years ago some jackass from /. thought it would be funny to call up my home phone and leave a nasty drunken message because I disagree with him about the current SUV craze. The reason he was able to do this was because (stupid me) I kept accurate whois information for my domain names. Had I pissed him off enough, there was nothing keeping him from coming to my home.

You should have called the police, this is the kind of crap that they are here for. That sort of phone call, if he kept it up, might count as harassment. And if you are actually worried about him showing up at your house, consider the possibility of becoming a gun owner.

Re:It's a crappy rule; change it.

[wurp]

You should have called the police, this is the kind of crap that they are here for. That sort of phone call, if he kept it up, might count as harassment. And if you are actually worried about him showing up at your house, consider the possibility of becoming a gun owner.

I did, and I am. (I was before this happened.)

The police didn't do anything, nor did I expect them to based on one anonymous phone call. A gun is nice if someone comes into your house, but is of no help if they burn your house down while you're asleep.

Re:It's a crappy rule; change it.

[pkarlos_76]

I whole heartedly agree with this........I don't want private information public......if it's for lawenforcement, then I suggest they get warrants. And let's have our lawmakers MAKE IT ILLEGAL to spam with out consent, and implement a MAIL protocal that allows for tracking mail's source. This whole freaking INTERNET is way out of date in it's protocal specification...let's update them NOW, not YEARS of Bureacratic crap.....

Re:It's a crappy rule; change it.

[HTH NE1]

Consider also that if you sign up for network access at some universities, unless you provide them with a unique (and acceptable to them) host name, they will encode your name, dorm name, and room number as your host name in their DNS servers, which will be revealed to every website you visit.

And even if you do provide a unique host name, the personal information may still be available to anyone who knows to look in the DNS records.

Did I mention that they also sell electronic copies of the student directory to outsiders?

Then there's the university ID you must carry and provide on demand that doesn't just contain your social security number, it IS your SSN. With no clear way to have it be anything else. Both students and campus employees.

Re:It's a crappy rule; change it.

[DroopyStonx]

I'm surprised to see the responses I'm seeing on a site where most people ostensibly argue for free speech and anonymity

Word to that. Quite a few closed minded goons on here who don't realize that people with personal domains have every right to remain private/anonymous.

Instead you get some jackass trying to convince you otherwise with clever retorts like, "Ooooh you don't HAVE to have a website/domain name/email!!" as if he just injected an insightful revelation into my head.

Re:It's a crappy rule; change it.

[wurp]

Also sprach die Anonymous Coward.

Even government abuses WHOIS

[Anonymous Coward]

A few years ago California set up a website regarding a gun confiscation program (taking registered guns from lawful owners). I discovered that the WHOIS information revealed the website was owned/operated by someone in Bejing, China and hosted in Australia - facts severely inappropriate for the purpose of the website & gov't program. When this information was made public, the WHOIS data quickly changed several times, apparently to cover up a political problem. Would have been nice to demand the coverup info be restored to the correct original & politically revealing WHOIS data.

Its government

[Anonymous Coward]

Just send a FOIA (Freedom of Information Act) request to them.

Bogus: now they charge for "private registration"

[Anonymous Coward]

My registrar (Network Solutions) recently sent out an offer to me for private registration, i.e. I can keep my real whois information private.

This is so bogus I don't know where to begin. It is just like the telephone companies. They charge you to *not* have your phone number listed in the phone book. Their justification for the charge? They get paid ad money per name listed.

The purpose of whois is that the information should have to be public.

The only reason ICANN is enforcing this is to line the pockets of private registrars who want to regulate dollars into their new "private registration" bullshit.

My two cents...

[Whitt83]

It is very important that this be updated! I created a company about a year ago, and then promptly went to register my domain and webhosting, conviently through the same company. About 3 months later, I realized this hosting company did not offer some of the services I needed, so I changed companies. Well, 9 months later, when my 1 year domain contract expired, I go to re-register it. I can't. The hosting company that I had previously used had registered the domain in thier name through a third party, and the third party wouldn't deal with me unless my name was on the WHOIS report. I was forced to pay 60 USD to re-register my site through me original hosting company. Bastards.

I hope this would cut down on fraud and spam

[GomezAdams]

The web sites linked in the spam mails forging my domain name to tout off shore drugs all led to false entries in the domain registration. Some of these web sites were selling some fairly dangerous drugs that should only be used under strict controls.

I did track down a couple of the hosting companies and the legitimate ones shut off the web sites. The web sites hosted in China just kept on running for several more weeks.

I just went through getting my domain renewed and had to provide a driver's license and signed statments in order to renew. This should also be the rule for getting a site hosted as well, not just who ever has a check book.

NIC-SE

[Anonymous Coward]

I hope they hit NIC-SE (who runs the .se tld) hard for providing a useless whois database.. :]

http://rfc-ignorant.org/tools/detail.php?domain= se &submitted=997702788&table=whois

I recommend editing the hosts file.

[eugene ts wong]

I think that the best way to deal with it is to edit the hosts file. He could use rsync to update the information on the other computers. That's what I would do. It's cheaper & might even be easier.

Will this limit freedom of expression?

[thesaur]

The proposal to force all domains to use valid WHOIS data would be a boon to law-enforcement efforts. But that leads to another potential concern.

In the US, it's not a problem to express yourself. You can say whatever you like about the government and get away with it. OK, not quite anything. In other countries, however, including western countries like Germany and France, freedom of expression is non-existant -- you may only say what the government allows you to say. In the two countries I've mentioned, it's not much of a problem, because they've basically only banned racist expressions. But there are more than enough other countries (China, anyone?) that actively work to suppress their citizens from expressing themselves freely. For dissidents in such countries, false WHOIS data may be necessary for freedom of expression. Is ICANN trying to help such governments crack down on their citizens?

If ICANN wishes to enforce this rule, I agree with the procedure outlined in the parent post, but disagree that spammer's domains should be treated separately.

The problem is, how do you recognize a spammer's domain? If you simply look at the "to" address, it will result in a lot of legitimate sites getting spammed, because a real spammer will fake the from address. If you look at the originating sender, I've had enough (virus) spam that apparently originated at my mail server. The header information was modified -- the IP did not belong to my mail server. But you can't backtrace to find the domain if the IP is in a dynamically allocated range. Once again, 1:0 for the spammers.

The few honest souls who are dumb enough to use valid information will get caught anyway. Now if we are talking about domains that are linked in spam, that's a little easier to deal with, but there is still a large potential for abuse. So a spammer doesn't like a site. Voila, take them down. In fact, anyone could effectively disrupt any website they like.

Of course, spammers should be prosecuted, provided they are within the jurisdiction of a state that cares (e.g., the US). But intellegent spammers work offshore anyway, which puts them beyond the reach of any western regulatory body except ICANN. We can go after their domains, but there's no easy solution to determine which domains are pure spam.

Re:Will this limit freedom of expression?

[Dimensio]

The problem is, how do you recognize a spammer's domain?

Er, simple. Spammer sends email advertising "p3n|S enh4nc meant". Spammer directs recipient to http://goodpillmed4u.biz/ which is hosted in China. It's safe to say that 'goodpillmed4u.biz' is a spammer's domain.

In fact, it's typically a safe assumption that ANY .biz domain is a spammer domain. There are exceptions, but they are few and far in between.

Also suspect: .info

Re:Will this limit freedom of expression?

[Reziac]

Points on both sides, but how about this -- very crude concept but I'm sure others can refine it into something workable:

Domain owners must provide real and accurate information, which will be stored in a central database -- maybe ICANN could handle it. Object being to NOT have it floating around loose or in a position to get sold by an unethical registrar, but nonetheless it is recorded and available.

People who need to contact you would do a WHOIS in the usual fashion, which would return a database number. You'd then have to go to ICANN's site and look up that number to get valid contact info (possibly with some minor hoop-jumping to prove you're a human, not a spambot -- such as how godaddy makes you read a small graphic and input the number thereon as a password to access their whois info).

This would foil spammers and other bulk marketers as not being worth their time to manually look up each and every contact address, but would keep your contact info available for those who really need it.

[If you're worried about being stalked, you should already have a P.O. Box for use in Real Life. As to phone calls, get on Do Not Call lists (I can attest that WORKS -- I get NO junk calls), use an answering machine to screen calls, or if you're really paranoid, get an answering service so you never have to talk to anyone who hasn't been first screened by a real human.]

Registrars who sell user data should lose their registry status. -- For that matter, registrars should not be allowed to own domains other than those they actually use in their business (I've noticed subethical registrars squatting on domain names).

Re:Will this limit freedom of expression?

[MonsterChicharo]

Spammer directs recipient to http://goodpillmed4u.biz/ which is hosted in China. It's safe to say that 'goodpillmed4u.biz' is a spammer's domain.

It is not. Suppose we are competitors. Suppose I want to drive you out of business. I send spam in your name, and redirect recipients to your domain. Now, without further investigation, your domain is gone.
Easy!

Re:Will this limit freedom of expression?

[Anonymous Coward]

His domain is only gone if his WHOIS data is invalid.

Not so easy.

Re:Will this limit freedom of expression?

[danila]

In other countries, however, including western countries like Germany and France, freedom of expression is non-existant -- you may only say what the government allows you to say.

You may not say what the government explicitly disallows you to say (and then again, it usually only applies to public speech). There is a big difference.

Re:Will this limit freedom of expression?

[Dimensio]

1) Your domain is only gone if you falsify your WHOIS data.

2) Why would you be running a penis pill website, hosted in China, in the .biz tld if you're not a spammer?

Re:Will this limit freedom of expression?

[hjf]

2) Why would you be running a penis pill website, hosted in China, in the .biz tld if you're not a spammer?
Because you are a chinese manufacturer of penis pills, who doesn't like its domain to end up in .cn?

Re:Will this limit freedom of expression?

[foobsr]

In other countries, however, including western countries like Germany and France, freedom of expression is non-existant -- you may only say what the government allows you to say. In the two countries I've mentioned, it's not much of a problem, because they've basically only banned racist expressions. (emphasis mine)

Now I would not state that I live in a state as described by Eric Frank Russell, quote: "Anarchy in action - an excellent model of an anarchist or free society", but still - a little more precision might be appropriate (even on /. where there presumably are also some who are responsible for all the fine documentation ... erm). .

According to the Worldwide press freedom index (yes, of course it is biased, yes, the social sciences are fuzzy, blahh...) Germany ranks 7, the US comes in at 17 (France is at 11).

CC.

Ex-directory or unlisted

[Garry Anderson]

Even BT allow you to ex-directory for your telephone here in UK.

Those in charge of DNS should have allowed domains to be ex-directory right from the start.

Get a Lawyer

[Detritus]

If your privacy is that critical, hire a lawyer to act as your agent.

Re:Get a Lawyer

[acceleriter]

Great idea. Free speech for those who can afford to pay an attorney to act as an agent.

WHOIS data should be for getting into contact

[hta]

WHOIS data should be useable for one purpose only: Getting into contact with the person or organization that owns the domain.
Any amount of redirection, clearinghouses, care-of addresses and so on SHOULD be permitted - *as long as legitimate communication to the address listed gets to the domain name owner*.
I've said this many times over the last 10 years, because it seems so blaringly obvious to me - but people *still* say things like "the WHOIS data must list correct address information for the owner" and think it means that it must list the street and number of the house I live in.
That's JUST PLAIN WRONG.
Forgive me that I shout.....

I don't feel like publishing my personal data

[drwho]

I own my domains, not some company. My I am not going to publish my phone number, and get more junk calls like the postal spam I get due to the fact I used my legitimate address (at the time) for registering my domain(s) years ago.

What's next, publishing my SSN and birthday in whois data?

I know some other countries (france, for example) are very strict and will only issue domains to a company with a tax ID and right to the name. Well, go right ahead france, but I think the generic domains (com/net/org) should remain open to all without prying eyes.

If we wanted such open access to domain owner data, how how about a .inc TLD, with data linked to corporate registration number and state and country of inc.? and leave the rest of us alone!

Re:I don't feel like publishing my personal data

[Animaether]

com/net/org aren't actually generic... they, once upon a naive time, had an actual designation...

commercial
networks
organization

Your site, sinister.com, with claims of being an ISP, should probably be sinister.net

Of course the owner of sinister.net may disagree, but his site is rather personal, and should likely have been sinister.us

Whereas sinister.us seems to be cybersquatted by 'duShant, Inc.'

Of course practically all TLDs and secondaries have lost their original intent, except in some countries (.co.uk, .gov.uk anyone ?).

But I understand a dot-com(!) name is much more interesting :)

Re:I don't feel like publishing my personal data

[gnu-generation-one]

Are there any domains which are known for protecting the anonymity of their subdomain owners?

Re:I don't feel like publishing my personal data

[Anonymous Coward]

.gov.uk is government controld i don't think ordinaryy people can get a domain under that

but .co.uk .net.uk and .org.uk are open to all (and cheap too)

Re:absolutely

[Anonymous Coward]

Maybe you can learn grammar and how to spell first.

Naive assumptions

[Anonymous Coward]

I run a bunch fo websites so I have my share of domains. The information for most of these domains is up to date. One domain has inaccurate snail mail address information and I want to keep it that way. Why? Well, I agree that the Internet is a cooperative network but the problem is rogue capitalists, especially the ones who send me cease and desist letters for silly reasons. As an activist and free speech advocate, it's in my interest to make life difficult for these retards. I'll gladly update the contact information for my domains, as soon as we can get these legal zealots to start understanding that intellectual property is dead and that the Internet benefits everybody if we learn how to share.

it's about time

[linux_author]

- tracking down spammers is a 'maze of twisty little passages, all alike'... - i think domain registrars should be held responsible for sponsoring, enabling, and hiding spammers...

What if you don't know as a webmaster/owner???

[adzoox]

I was given the name jackwhispers.com by a group of anonymous people. They gave me the address to report on Jack Campbell. I have since rolled the domain and contents into my own website, but I still have NO IDEA WHATSOEVER as to who registered it. I got an anonymous email telling me the domain had been registered for 7 years and that I had editing priveleges. Thing is, I didn't get any other information. I have no way to access the registry information.

The information is inaccurate... what do I do in a case like this?

Gandi provides antispam & bulk whois protectio

[Jayfar]

I've been using gandi.net as my registrar for a handful of domains for about 3 years. When I updated my handle contact info recently, I found they've added a couple privacy features. First they provide a gandi.net email addy to mask your true email. Second, you can select the option to have your personal contact information excluded from the bulk whois info that they are required to make available for sale (it'll still be visible through normal whois inquiries). No extra charge for that and their 12 euros/year includes dns (configurable thru web interface, though a bit less flexible than hand-carved zone files). You can use your own dns elsewhere if you need the flexibility of editable zone files (ie. anything more than adding and deleting A, CNAME and MX records). Their web interface is in English and French.

well that sucks!

[zogger]

I was real interested in this discussion, and thought it a nice niche business performing a service that this whois obfuscators were doing. It kinda blows it if you can still get the accurate info. Why aren't they sued for fraud? Being able to at least remove your personal info away from casual goombahs intent on spamming or stalking is a good idea.

Is this true of these other services referenced in the thread? Anyone?

What is your name and address?

[Anonymous Coward]

I have a few choice packages I wish to send you.

Oh, you dont want to give me this information?

Then you're a hypocrite.

I don't care to give out my address ...

[Anonymous Coward]

What if I don't want people to know it's my site. I may post something that could bring me and/or my family harm. ICANN can kiss my ass.

Absolutely

[digitalgimpus]

Most scam websites, child pornography websites will use bogus whois info.

If we ensure it's all accurate, we are holding webmasters, ISP's accountable for the crap on the web.

It's a great step towards removing the garbage that scares so many from the internet.

If every webmaster's address was listed in WHOIS accurately. How many scam websites would be set up? How many would setup child pornography websites and list their own address as the contact?

If they are that stupid, at least it becomes that much easier to catch.

I see no reason why they shouldn't go about it. It's good for the Internet as a whole.

I'm opposed, but ...

[HiThere]

I think it's a bad idea. The right solution is to replace ICANN with some decentralized approach.

Also, the IP allocation should be totally redone...no organization should be allowed more than one IP number, let them use NAT internally to make up the difference. If they need to go to IPv6, then that's fine.

And similarly no organization should be allowed more than one web ... sorry, forgot the terminology, but when I look up I see http://yro.slashdot.org/... the part I mean is the .slashdog.org.

I realize that in this context "organization" is a bit difficult to define, but with names like ://yro.slashdot.org/comments.pl?sid=... now being common, there's no need to let people monopolize anything that sounds like the name they want. Perhaps there are legitimate reasons to assure that people aren't being fooled, but that's a separate matter (fraud).

Re:I'm opposed, but ...

[kobaz]

Also, the IP allocation should be totally redone...no organization should be allowed more than one IP number, let them use NAT internally to make up the difference. If they need to go to IPv6, then that's fine.

Ever hear of internet based apps requiring end to end connectivity as in something like netmeeting or various other similar apps. NAT just would not work with such things. Port forwarding is just a hack to get around NAT which is a hack in itself (a pretty good hack I will admit).

With the current designs as they are, things like ssl web servers MUST run on a seperate ip than the main web server because the domain name needs to be known before ssl negotiation takes place. This means that you can only run one ssl server per ip.

And similarly no organization should be allowed more than one web ... sorry, forgot the terminology, but when I look up I see http://yro.slashdot.org/... the part I mean is the .slashdog.org.

This is silly comment because you can have a million subdomains point to the same ip and things like web servers work just fine. In fact, that exact method is used by thousands of servers all over to save on ips. Its called name based virtual hosting.

I realize that in this context "organization" is a bit difficult to define, but with names like ://yro.slashdot.org/comments.pl?sid=... now being common, there's no need to let people monopolize anything that sounds like the name they want. Perhaps there are legitimate reasons to assure that people aren't being fooled, but that's a separate matter (fraud).

Are you talking about someone taking joe.com which prevents someone else named joe from using that domain? If so, with the current domain name system it would be a complete mangled mess if we were to implement some sort of forced domain management so that multiple people could use the same domain under the same tld.

Domains like co.uk already exist for more orginization, but trying to split up joe.com into mr.joe.com and harry.joe.com would not prevent any of the problems that currently exist in the current domain name system. someone would register harry.joe.com and someone else would still not be able to use that domain.

In terms of the ://yro.slashdot.org/comments.pl?sid= type url locations, I have no idea what your talking about, but what ever it is, it probably wouldn't work since that only applies to web and weblike services (like ftp, gopher, etc, etc).

Re:I'm opposed, but ...

[kobaz]

Also, the IP allocation should be totally redone...no organization should be allowed more than one IP number, let them use NAT internally to make up the difference. If they need to go to IPv6, then that's fine.

Another thing... It would also be a logistics nightmare since an orginization like ibm has locations all over the world that need internet access, why have a single entry point to their entire network as well as a single point of failure?

Also, what makes you think that you could just drop in ipv6 and everything will be good and fine? Most of the hardware/software around doesn't support ipv6 out of the box (think the $30 dlink NAT routers from compusa and what about windows 98?). It will be a very very long time before every single bit of networking hardware produced will support ipv6 out of the box.

Re:I'm opposed, but ...

[HiThere]

It wasn't a particularlly well thought out comment, in the sense that it needs more development. But ipv6 can tunnel on ipv4, so distribution isn't a problem, and the larger organizations can reasonably easily afford to use ipv6 capable networking equipment for internal use. So that's not a problem.

The better reply was the other one. Some applications do need direct access to the net, so NAT isn't a cure-all. But a lot of the problem is the large blocks of address space allocated during the early days. I should be more explicit, but I don't remember the details right now, the ip's of the form nnn.xxx.xxx.xxx where nnn is some particular number and the xxx's can be whatever they want. Well, nobody ever expected the net to be popular enough for that to cause a problem. Surprise!

Will they enforce this for NAMBLA or not?

[Anonymous Coward]

Just try to figure out which child-fucker is the contact data for North American Man Boy Love Association.

Of course, I too would hesitate to put my name in front of an organization that advocates having sex with kids not even 10 years old...

BOO!

[Anonymous Coward]

I am going to put some po box or something for mine. there is no reason to have to put that crap.

Yes I do

[nberardi]

Yes I beleive this is a nessisary step. Last year I found out that there were 3 domains registered to me that were being used as spamming domains. By registered to me I am saying they used my name and address in the WHIOS database. When I brought this to the attention of Network Solutions, they put me though a huge ordeal of faxing. Yes faxing, what kind of tech company uses faxes anymore. Well I digress. I think this is important because I don't want my name on anything that sends out spam.

False Entitlements

[firewood]

The system has been abused for year. So, I'm sure there are those who feel entitled to the privacy and anonynimity they've been able to get for free so far.

I liken them to homeowners and small businesses who are dumping their pollution directly into the river, and then complaining when told that the same new environmental laws which apply to mega-toxic-corp upsteam also apply to them. However, just like the river, which may supply drinking water to people living downstream, DNS is a public service hosted on other peoples servers, not your own. If you want to use a public service (as opposed to running your own private DNS server for your buddies, etc.) you may have to abide by public rules.

The beginnings of a clean-up mechnism are simple. Notify people to clean up their DNS records and then randomly snail mail letters to a percentage of domain owners. Lock domains for owners who do not respond.

If you want your privacy and anonynimity, which was not implicit in the original rules for DNS service, pay for a proxy service (electronic equivalent of a PO box, answering service, subsidiary in the Bahama's, etc.). But don't depend on being entitled to a mechanism which makes you look exactly like joe toxic spammer at zero cost, and which leads to a Tragedy of the Commons.

About f*cking time

[Mycroft_514]

I just went to the lsited site and registered a complaint against a site that has:

1. Invalid Whosis data
2. Use of copyrighted images without permission
3. Use of copyrighted text without permission
4. Slander or libel (whichever one is written)
5. Sends spam but claims not to
6. Works with others to support them harming the environment
7. Works with others who threaten people via e-mail (I was one so threatened).

With this new ruling, maybe we can finally get them shutdown and/or sued out of existance.

Because I want a persistent address

[phr1]

If I have a lower level domain under some ISP, then I'm trapped with them. If my ISP's service goes down the tubes, or if they go out of business altogether, or if they jack up their prices or whatever, I can't switch ISP's without losing email or web contact with anyone I gave my address or URL to. I move around a lot; my physical addresses and phone numbers change all the time. My internet domain is the most stable point of contact that I have.

I had a stable email address with an ISP for about ten years, but the ISP discontinued my service plan and said I'd have to change addresses if I wanted to stay with them, so that's why I registered a domain, so I have a permanent net address that I can give out to friends and acquaintances. That doesn't mean I want it advertised to the public. It's like an unlisted phone number. I'm ok with the registrar having my contact info in case law enforcement needs to find me, but I see absolutely no reason they have to publish it in WHOIS.

Maybe ONLY for commercial sites.

[not_bio]

The problems of making everyone post their real info greatly outweigh the benefits. Beyond just spam and stalking, it is a matter of freedom of expression. What if the person was in China and did not want their true ID being made public? Or if they were a single young female who ran a blog? For sites that have a commercial nature, yes, they should be encouraged to post their real info. If I run a site with a controversial topic, I really would not want to be threatened by religious nuts who more often than not, get really excited over the stupidest issue.

How about this?

[Adam9]

Some registrars provide some extra privacy for a small fee (Netsol charges $5). Other registrars have similar offerings. Check it out.

Valid data?

[CherniyVolk]

I'll put accurate, current physical contact information in my whois data when I finally get a P.O. Box or some such obscure, vague association to my whereabouts.

I think the only people really complaining about this sort of thing are lawyers and companies looking to screw over the individual.

RIAA: "He has a domain name!? Quick, I know a 31337 trick! 'WHO IZ' his domain name to get l337 infoz! Then we can get him!"

Later.

RIAA: "What the hell is this? A run down shack in the middle of the desert? Obviously, the terrorist mp3 file sharer has tricked us and our super-hacker 'WHO IZ' trick! What else can we do?"

RIAA Lawyer: "Let's see into making it more difficult to use contact data for domain registration. That way, you can easily find all your terrorists with your elite 'WHO IZ' uber-hacker skillz!"

Simple solution

[PsiPsiStar]

How hard is it to just have the ISP act as a 'relay' in case of trouble. E-mail or letters are directed to them, and they are responsible for relaying the information if pertinent. Maybe this could be optional for a small fee. That would preserve privacy, yet still allow for people to be contacted, hunted down and shot, etc. in case it ever was required.

They have 'no call lists.' So it wouldn't be stepping on anyone's toes to say that commercial solicitations through this medium would be forbidden.

Or am I missing somthing.

Bad, bad Registrar!

[htacoma]

Besides bad information in the WHOIS placed by the Registrant, there are also cases where the Registrar has placed bad information on purpose because of some bad blood between them.
This has the effect that the Registrant has very little chance to make modifications to the record (specially when they are technically illiterate and didn't get the ID/PW) and little recourse to complain to the uplink.
About the only chance they have is to go to a Backorder service, hope that the Registrar will forget to renew before expiration and try to regain control of the domain name that way.

Cheers!
--
Han Tacoma

Not until they secure the db's

[KnightWolfJK]

I already get spam containing my [incorrect] home address located in my WHOIS info. It's asinine that they can start enforcing correct information when the WHOIS databases obviously aren't protected well enough.

Here's a question...

[jdreed1024]

Can someone please explain to me how the whois database is any different from having your name, address, and phone number in the phone book?

No, seriously. Think about it. If you have phone service, your name, address, and phone number ends up in the phone book. Now, you can customize it a little (omit your first name, omit the street number), but it's there. If you want it not to be there, you pay the phone company for an unlisted number, and they take it out. If you want your whois info not to be there, you pay your registrar a fee (most offer "unlisted" or "proxy" registration in which the domain is registered under their name) and they take it out. This process is perfectly fine as far as ICANN is concerned.

Sure, you could argue you can't reverse-lookup a phone number using the phone book, but there are other directories that provide that service for free (go to any large public library and ask for Cole's City Directory - provides address-to-name/number mapping). So really, if you consider that (domain=address; phonebook=whois; telemarketers=spammers) these two scenarios are really the same. And yet no one goes apeshit when the phone company requires you to provide a valid address.

If you want anonymity online, that's all well and good. But if you want a domain name, you need to pay a little more to remain anonymous. There are tradeoffs in life. There are plenty of ways to hide your whois contact info and still remain in compliance with ICANN rules. Listing your address as "123 Fake St" is not one of them.

Its about time.

[heybo]

Personally I am so glad to hear this. About 100 or so of those complaints came from our company. The biggest tool spammers use to cover their tracks is bad whois info. How can you serve papers on someone if you don't have an address? Even the wimpy CanSpam law can't be enforced without an address. Without one its not worth the disk space it takes up.

This information is also needed for admin work between networks. This information is used by Systems Admins to contact each other when things get weird between networks not just for catching spammers. It a great time saver when a sick server on a network is hitting ours to be able to type "whois" and find an email address and a phone number for the person you need to talk with to fix the problem. These are helpful calls between networks to keep it all working. Its not so much contacting the owner as much as contacting the SysAdmin.

I do see the problem with personal sites and whois info that contains personal information. What we do for the sites we host that aren't corporate sites is we carry the Techinal Zone Contact Address and phone number as the address and phone numder for the site. This way the site can be contacted and the owners can be indirectly contacted without their home addresses or phone numbers exposed to the strange. This way if some weirdo calls they get to talk to us. Most hosting companies will do this. If they don't move your site to one that does.

You can't complain about having to have updated information on your whois. You agreed to it when you bought your domain. It was in the EULA.

Besides how can you enjoy the smell of burning mail servers if you don't know where to build the fire?

Not that I would ever do anything like that ;)

Require nonexistent information?

[Anonymous Coward]

I used to have a domain regged with NSI, mainly thru intertia - I had registered it back before the competitive registration stuff.. (In fact, before you had to pay - GASP!)

Originally I had a phone in my name, and I had it listed. Eventually, I moved, and I did not obtain a phone. I currently have no phone number to provide. I eventually changed the old obsolete phone number, and put 000-0000 in its place.

Then one day (back when the whole 'valid whois thing started') NSI sent me an email telling me I better get my correct info listed or they were gonna turn me off.

The cycle went more or less as follows:

"You must list your phone number"

"I dont *HAVE* a phone number"

"You must provide correct contact info"

"Ok, the correct info is 'I dont *have* a phone number', how do I list that, correctly?"

"Im sorry, you must list your phone number"

(ad naseum)

After about half a dozen rounds of that, I moved the registration elsewhere and havent had a problem since. It still has 000-0000 listed. My name, email address, and mailing address are all properly and correctly listed.
(The mail address is a PO box I maintain anyway so as to keep my mail seperate from where I physically live, mainly becuase its a rural area and the local punks like to play mailbox baseball $20/yr for a small box is a cheap price to pay to know my mail is safe and secure behind a little locked door, in a building thats kept *very* secure)

I'm curious what anyone else might have to say about that. Is having a phone number a prerequisite for registering a domain name? If not, then how should someone who does not have a phone indicate that, so that the record *is* in fact accurate? I feel that making up a real-appearing, but false, phone number would be more inaccurate and wrong than listing something which makes it obvious it isnt a valid number.

No, this isn't

[Anonymous Coward]

And I don't feel like giving my full address, telephone, and other data, so I use "Upon Request". Giving the e-mail is bad too, since lots of spammers use it.

And frankly, fuck the ICANN. According to my registrar, they allow any to include your e-mail in bulk lists. I choosed no...

whoopsy

[weekendwarrior1980]

I have the godaddy's private registration service. Will that affect me?

Off topic?

[Anonymous Coward]

Who the bloody hell modded this off topic and what were they smoking?
Or am I missing somthing here?

Re:Yes. So that abuses of the system are dealt wit

[BillGodfrey]

Yes. So that abuses of the system are dealt with.

Will the brick that gets thrown through my window have contact details attached?

Re:Yes. So that abuses of the system are dealt wit

[sonamchauhan]

Will the brick that gets thrown through my window have contact details attached?

Why? Haven't they found you? Get the law to protect you.

Valid reasons include:
"We cannot easily sue fraudsters if we cannot find them"
-- Federal Trade Commissioner J. Howard Beales III, director of the Bureau Of Consumer Protection.

Having the authority of being a full peer on the Internet, also has responsibilities attached.

When it's necessary to send information anonymously - signup on a blog site, or get a court order suppressing your contact details, or register your domain through a lawyer, or write a letter.

tis a straw...

[robin147]

Just don't expect to see a camel with a broken back.

Likely to help a little.

But don't throw out your cuisinart

MOD PARENT UP!!! +5, Insightful

[Anonymous Coward]

I don't want my info to be public. Simple as that.

[DroopyStonx]

My domain is a personal domain.

If the public goes to the front page, they see a blank page. I use it primarily for web-development testing as well as a place to host any files that I might like to share out to friends. I also have email accounts based on that domain name.

There's absolutely no reason for *my* information to be made public. I have invalid whois data, and I won't be changing it simply because there's no reason to. I don't run a business online, I don't make profit, therefore, it's of no use to anyone to know where I live or what my phone # is.

WHOIS merely one of the stalker's tools

[dcavanaugh]

Can anyone really become invisible to stalkers just because they have a bogus WHOIS record? Any stalker worth his salt can track people from any one of hundreds of publicly accessible databases and grab all kinds of information. How much data can you really keep private? Registering a domain is a quasi-public act that results in loss of privacy, similar to what happens when you buy a car. Nobody makes you buy a car. But if you choose to do it, alot of people can easily find who you are and what you bought.

You mentioned pointing your domains at your old address. In some databases, that would be enough to help a stalker. I can think of at least one easily accessible place where knowing a person's name and previous residence would reveal their age and possibly their current town and state.

If online anonymity is the goal, I would opt for a dynamic IP address, such as my dyndns.org, with throwaway e-mail accounts (Hotmail, ICQ, etc.) for those times when you must publish an e-mail address.

Actually, I'm more concerned with the spam. Some if it is obviously the result of WHOIS harvesting.

Re:I don't want my info to be public. Simple as th

[Anonymous Coward]

But what if your mail server starts spewing spam or something to my servers? How would I track you down to let you know about the problem. I guess I just call your ISP/WebHost and tell them and have them disconnect your account and charge you a very hefty fee to get reconnected.