Re: [DNSOP] Proposal: Whois over DNS

[Ted Lemon <[e-mail]>]

On Jul 9, 2019, at 10:07 AM, John Bambenek <jcb=[e-mail]> wrote:
> But ICANN won’t allow such a system with meaningful data, so here we are. 

The question you should be asking is “why not?”   The answer is that nobody whose info you need will publish it, because the info you need is from people who are engaging in misfeasance or malfeasance.  The people who will publish accurate information here are likely naive, so you’ve really just created a vuln that bad actors can exploit.

You can’t use the fact that no information, or false information, is provided as a basis for seeking out bad actors, because any sensible person will not put their information in this database unless they have to to get something they need.  If they have to to get something they need, they will likely put in false information, because they have no legal obligation to do otherwise, and putting in correct information would not be in their interests.   So all you’ve done here is create two attack surfaces.

The first attack is against people who are naive: you now have personal information about them that they shouldn’t have given you.   The second attack is that you can use the fact that someone posts false information, or doesn’t provide information, as a pretext for investigating them.

If you genuinely think this is worth doing, please come up with a real-world use case that meets the following three criteria:

It would be in my interest to put information about myself in this database
That information would be useful to you, or to someone specific whom you can identify
My participation in, or non-participation in, this mechanism is entirely voluntary, and can’t be used against me

You haven’t done that yet.  If this depends on people acting against their own interests, we shouldn’t publish it.  If it solves a paper problem but isn’t actually useful, we shouldn’t publish it.  It needs to solve a real problem in a way that is ethical.   I don’t think it does.