December 1998 - db-wg - mailman.ripe.net

Re: Ripe change to whois
by Hank Nussbacher 03 Dec '98

03 Dec '98

At 04:00 PM 11/30/98 +0100, Joao Luis Silva Damas wrote: Just check http://www.checkdomain.com with some nonexistant domain housed at RIPE and tell me if something isn't wrong here. -Hank >Hello. > >I am including the tld-wg into this discussion so as to make sure all involved >parties are aware of the discussion. > > Alexander Koch <akoch(a)sgh-net.de> writes: > * Hello. > * > * > The design of this feature was specified some time ago by Carol Orange and > * > * > Wilfried Woeber (please see http://www.ripe.net/meetings/ripe/ripe-27/pres > * /rout > * > e/referral/) and discussed in the RIPE db-wg mailing list (please see > * > http://www.ripe.net/mail-archives/db-wg/19970501-19970601/threads.html) > * > * Oh. Fine. Do I get it right that this was discussed and agreed on > * more than a year ago? Argh. > * > >Yes, indeed. We had a period where we have been late with developments. That >period is now behind us. > > * This change breaks too many things, imnsho, and it seems again that if > * you are not able to make it to the RIPE meetings, you have lost. A > * special announce would have been most helpful (an explicit one, stating > * this). > * > >But, we did... or so I thought. We'll look into more ways of getting this >announcements across while trying to minimize the mails sent to people who >don't care about this. > >This particular feature has been actively asked for by the ccTLD >adninistrators and seen as a good thing by everyone I have had a chance to >speak with. These are actually the first complaints about it we have got so >far. > > * > As a side note I would like to stress that the RIPE Database is NOT the so > * urce > * > of authoritative data for domain objects (although we are happy to provide > * a > * > repository for TLD administrators). > * > This is UNLIKE the internic whose business is to sell names. > * > * Oh. Fine. whois.nic.de *cough* barely ever working... Weak argument. > * And If I wanted to know the data about the domain one level higher, > * I can do so myself, I don't need to get it told to me by whois, I > * want to know whether crab.de (bad example, it really exists) is in > * the DB already or not. > >I am sorry but I can't talk about the availability of services we don't >operate. > >I am sure you can look up domains yourself but this was actually seen as >providing the users (specially the ones less familiar with the RIPE DB) with >help on where to find the correct information. > >It seems to me that over time people have developed a sense that the RIPE DB >is the authoritative source of information regarding domain names in Europe. >May be this issue should be up for debate now. > >As a matter of fact the referral mechanism was seen as a way for ccTLD >administrators to include information in the Database pointing to their own >authoritative sources of information. > > * > * > The RIPE NCC is therefore acting according to users directives that were > * > discussed and agreed on an open way. > * > * Hitchhiker's Guide, anyone? *sigh* > >??? > > * > * This was a not-so-nice change, really. Consider this a statement of > * disagreement with the way the change took place. Ok, one more mailling > * list to follow... Time to sell. > >Will do so. As I said before, we will keep modifying and developing the RIPE >DB software and in particular this feature if users feel that is what they >want. We will also provide our point view. >I would like to have the input of the community. > >Regards, >Joao > > * > * Regards, > * Alexander Koch > * > * -- > * SGH Internet Division, Alexander Koch, Systems Administration > * Hannover, Germany, Phone +49 511 909198 0, Fax +49 511 391307 > * > > >

3 2

Re: Ripe change to whois
by Hank Nussbacher 03 Dec '98

03 Dec '98

At 06:35 PM 12/1/98 +0000, Niall O'Reilly wrote: >On 30 Nov 98, at 17:14, Hank Nussbacher quoted someone >who had written: > >> > >> >As a matter of fact the referral mechanism was seen as a way for ccTLD >> >administrators to include information in the Database pointing to their own >> >authoritative sources of information. > >I can confirm that this was indeed the intention when this was first proposed in >the RIPE (25, I think) DNS-WG meeting. > >> > * > The RIPE NCC is therefore acting according to users directives that were >> > * > discussed and agreed on an open way. >> > * >> > >Yes and no, I have to say. > >At RIPE 31, the functionality proposed certainly appeared to me to be what had >been sought. I am no longer certain that this is indeed the case. In particular, >the following surprises have arisen. > >First, the key notion of making the referral function available per TLD at the >option of the TLD registry concerned seems to have been lost. This is a >fundamental element of the original concept of over two years ago. > >Second, the "feature" of returning the data relating to the parent domain in the >case that the specified domain cannot be found seems to me to have nothing >to do with referral. The referral concept has to do with re-directing the query to >an authoritative whois server, not with second-guessing the intent behind the >query and substituting other data which is available locally. I suggest that this >"feature" be declared a bug and removed. > >I am sure that these technical problems are based on misunderstandings which >can easily be resolved. > >A more significant surprise is that TLD registries, who have had no specific >prior notification, now find that data about their domains is being returned in >response to a class of query for which this was not formerly the case, and that >they have to deal with the unexpected fallout. Niall, Thank you for bringing sanity to this! I am sure now that this can all be cleared up and we can all go back to what we are all doing and let RIPE continue working the way it has always done - with no hiccups, technical excellence and 3 years ahead of the USA. -Hank > > >Niall O'Reilly > >IE Domain Registry at UCD >Chair, RIPE TLD-WG > >

2 1

Re: Ripe change to whois
by Frank Faubert 02 Dec '98

02 Dec '98

Hi All, Please forgive the intrusion, I am new to this discussion. Hank>Phone call #4 today. User goes to http://www.checkdomain.com to determine Hank>if ubuy.co.il is valid. www.checkdomain.com says the domain is owned by me Hank>(Internet Society of Israel). Now try it for xxxyyy.co.at or xxxxyyy.co.ie Hank>or any domain for that matter located at whois.ripe.net. This is just one Hank>Internet site that has based its site and code on how RIPE works. There Hank>very well may be others. I am the maintainer of checkdomain.com, and to be honest, I was completely ignorant of these changes to the RIPE DB until Mr. Nussbacher sent an e-mail to me. Hank>Just check http://www.checkdomain.com with some nonexistant domain housed at Hank>RIPE and tell me if something isn't wrong here. -Hank I have since updated checkdomain.com to check the "domain:" field returned from the DB and return the equivalent of a "no match" if it is not the same as the user specified. The new behavior is way too confusing to our users, who are checking to see if a domain name is still available. Joao>If people don't want to be subscribed to these lists but the work going on Joao>there is relevant to them may be it would be a good idea to, at least, make it Joao>a monthly task to overview the archives and look at the presentations given Joao>during RIPE meetings. Otherwise, how can we make sure that we reach all Joao>interested parties without spamming the rest? Have you considered an announcement list? I for one do not have time to constantly monitor the discussions on the DB list, as checkdomain.com is not a source of income for my company, but a completely free service we provide to the internet. However, I would very much like to receive announcements from RIPE to my direct e-mail address at frank(a)sane.com. If you choose to implement this, please add me to the announcement list. Joao>I would like to have the input of the community. While I am sure that the change was needed for some users, I'm sure that you can agree that it is also causing problems for other users. I think that it would be a very good thing if you could offer a method of getting the old behavior from whois queries, as well as a method of getting the new behavior. Now, I don't want to get involved in the debate over which way should be the default, but I think that both methods should be offered. Please let me know what I need to do in order to use the old behavior, so I can remove my quick hack from checkdomain.com and replace it with a supported method. BTW: I also want to thank RIPE for the DB service they provide! Sincerely, Frank Faubert checkdomain.com

1 0

NIC handle writeup
by David Kessens 02 Dec '98

02 Dec '98

Hi, We discussed in depth the issue of NIC handles during the db-wg session of the Stockholm RIPE meeting. I promised to write a draft with a proposal. It's enclosed below for your review, David K. --- Internet Engineering Task Force David Kessens Draft ISI Expires March 1999 <draft-kessens-registryobject-identifiers.txt> Registry Object Identifiers Status of this Memo This document is an Internet-Draft. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet- Drafts as reference material or to cite them other than as ``work in progress.'' To learn the current status of any Internet-Draft, please check the ``1id-abstracts.txt'' listing contained in the Internet- Drafts Shadow Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe), munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or ftp.isi.edu (US West Coast). Abstract NIC handles have existed for a long time while they were never properly defined. At the same time, many registries started with their own interpretation of a definition that didn't exist. This document attempts to describe a definition that mostly backwards compatible with the definitions that most registries currently use. Introduction For a long time, a need existed for a unique identifier to identify personal data in the regional registries. The NIC handle has been invented to address this issue. However, the concept of NIC handles has never been documented in any place and as a result, several registries use different definitions. This draft is an attempt to write up a definition that is compatible with the current definitions that most registries use and that allows other, possibly new registries, to design their own identifiers that Kessens [Page 1] Draft RIDE References August 1997 are guaranteed to be unique. In addition, this document generalizes the concept to allow registries to use these unique identifiers for other classes (like host objects) then the personal data classes. Concepts The identifier consists of two parts: - internal registry identifier The identifier is unique within the registry, but doesn't need to be unique on a global scale. This gives the registry maximum freedom to design their own identifiers for local use. In the past, one of the most difficult problems was the entropy in the the NIC handle name space. - global registry identifier This identifier makes the internal registry identifier unique on a global scale. A registry can be queried using the internal identifier or with a combination of internal and global identifier. The registry will add it's own identifier when the internal identifier is omitted. Definition InternalIdentifier[@GlobalIdentifier] The global identifier is the same as a domain which is in use by the registry. The internal identifier is an RPSL word [1]. Identifiers are not case sensitive. Discussion No central authority was ever present to allocate global identifiers. This caused name collisions. However, it's undesirable to have such an authority. Therefore, it is needed to get an identifier from some other already defined namespace. The domain name system provides us such an identifier with minimal cost. A convention for internal identifiers for use in conjunction with Kessens [Page 2] Draft RIDE References August 1997 personal data exists: InitialsOfPerson# It is recommended but not required to follow this convention. The '@' sign is choosen since it cannot be part of the internal identifier. In the past '-' was used which is causing ambiguities. It is not required that every registry is actually using the convention. A registry can mirror another registries data that doesn't participate in the scheme and assign a global identifier using a domain that is used by the other registry. Example example: KH1(a)ARIN.NET KH1 is local identifier ARIN.NET is global registry identifier (last part of domain name can possibly be omitted) Security considerations The model describes a dataformat which doesn't have security problems in itself. It doesn't make the system more or less secure. Acknowledgments The ideas presented in this document are a composition of ideas and thoughts of the author and many other people that have developed over the years. In particular, the people that were present at the RIPE database working group, IETF ride BOFs and their respective mail lists have had quite some influence on the final outcome of this draft. References [1] Cengiz Alaettinoglu e.a., RPSL, rfc2280.txt Author's Address: David Kessens, ISI Kessens [Page 3] Draft RIDE References August 1997 4676 Admiralty Way, Suite 1001 Marina del Rey, CA 90292-6695 USA davidk(a)ISI.EDU Kessens [Page 4]

4 6

Re: Ripe change to whois
by Hank Nussbacher 01 Dec '98

01 Dec '98

At 01:01 PM 11/30/98 +0100, Joao Luis Silva Damas wrote: Yes, that may be all correct - from a techno standpoint. What I am stressing is the human engineering aspect. Up till now, thousands of hits are sent to the whois.ripe.net every month to determine whether a domain exists or not. Users have been doing this for years. Suddenly, the output is different and they do not realize it. I highly doubt that the human engineering aspect was discussed or analyzed to any extent in the DB WG. -Hank >Dear all, > >The implementation of the referral mechanism is a new feature of the latest >release of the RIPE DB software. > >The design of this feature was specified some time ago by Carol Orange and >Wilfried Woeber (please see http://www.ripe.net/meetings/ripe/ripe-27/pres/rout >e/referral/) and discussed in the RIPE db-wg mailing list (please see >http://www.ripe.net/mail-archives/db-wg/19970501-19970601/threads.html) > >According to this proposal the algorithm to be implemented is > >(extracted from the proposal): >*********** >Algorithm >--------- >If the following query is submitted to the RIPE database: > > whois [flags] xxx.yyy.zz > >the algorithm will work as follows: > >------- >NAME="xxx.yyy.zz" > >until (NAME = "") { > If object with domain = NAME found, > If object contains referral (see "Referral" below) > forward query (see "Forward" below) > Else > return object > Else > Strip(NAME) (xxx.yyy.zz -> yyy.zz, etc) >} > > >NOTES >----- >1. We move up the tree here, and return the next level answer >if present. If the query requests "tuintje.cwi.nl" (Piet, do you >mind?), they currently get "No entries found ...". In the new >mechanism, they would get: > >domain: cwi.nl >. >. >. >mnt-by: NL-DOMREG >changed: hostmaster(a)domain-registry.nl 19950227 >source: RIPE > >Moreover, if the object for cwi.nl contains a referral, the query >would be passed on to the specified server as explained below. > >2. The algorithm will be set off by any query which causes a search in >the domain object index. This means any query with "-T domain", or >any general query (no -T flag) with something that "looks like a >domain". >************* > >Currently and due to s small desynchronization within the RIPE NCC DB group >and the fact that the proposal was not clear about a particular point the >referred query is for the truncated object in the RIPE DB containing the refer >attribute. We want to modify this so that the query to the authoritative >server is for the user's initial query and not the result of the truncating >algorithm. This change will take place either today or tomorrow and a note >will be sent to the db-wg. > >As a side note I would like to stress that the RIPE Database is NOT the source >of authoritative data for domain objects (although we are happy to provide a >repository for TLD administrators). >This is UNLIKE the internic whose business is to sell names. > >The RIPE NCC is therefore acting according to users directives that were >discussed and agreed on an open way. > >We are happy to hear any comments about this or any other issues regarding the >DB software and will keep working to suggest and provide users with >functionality that will help them the most. > >Please send any comments to the RIPE mailing lists. > >Best regards, >Joao Damas >RIPE DB Group manager >RIPE NCC > > > NCC local-ir list Moderator <lir-mod(a)ripe.net> writes: > * > * I feel this is more appropriate to be discussed on the db-wg. > * > * Mirjam Kuehne > * RIPE NCC > * > * ------- Forwarded Message > * > * Date: Thu, 26 Nov 1998 19:21:13 +0200 > * To: <local-ir(a)ripe.net> > * From: Hank Nussbacher <hank(a)ibm.net.il> > * Subject: Ripe change to whois > * > * I may have missed it, but a serious *bad* change has occured to the whois > * interface. Previously, if I did a check on abcdef.co.il and abcdef did not > * exist, whois would return an error message. Now, whois returns the domain > * and role records for the next upper level domain - i.e. co.il or .il. Other > * examples: zzzz.ac.uk, zzzz.ac.at. > * > * How did I find out about this? I received 3 phone calls already in the past > * 24 hours from users in Israel stating that I personally am registered as > * owner of hundreds of domains. They state that being on the board of the > * ISOC-IL which oversees the registration, I have violated the rules (limit of > * 10 domains per person - other countries have similar restrictions). I have > * tried explaining to them that I am not the owner of these domains. If it > * was 1 user, I would assume they didn't read the entry correctly. But the > * fact that 3 totally different people have called me to ask whether I would > * sell certain domain names to them, I can only conclude that the RIPE change > * is not that successful. > * People have been used to getting an error message from RIPE, similar to the > * "No match" one gets from Internic. When they now get a valid response, they > * don't bother to check that the response is not for the domain they > * requested. There is no error message or error code. > * > * This needs to be rectified (and changes discussed in the future - ignore if > * it has been mentioned). > * > * - -Hank Nussbacher > * ISOC-IL board member > * > * > * > * > * ------- End of Forwarded Message > * > * > * > > >

4 7