[dns-operations] shunning malware-hosting registrars

[Paul Vixie]

Mark E. Jeftovic wrote:
> Paul Vixie wrote:
>
>> but it's not just registrants i worry about. we've seen a handful of
>> borderline-to-really bad registrars over the years, who are able to
>> pollute the "internet commons" with malevolent and criminal waste for
>> years at a time until icann or the courts finally have enough evidence
>> to put them out of business. if every domain's registrar were reliably
>> determinable at scale, then after blackholing the 10,000th or so domain
>> from a single registrar, many of us might decide that our best interests
>> lay in blackholing all future domains from that registrar.
>>
>
> I have long pondered an idea for implementing this sort of mechanism via
> RBLs - and today there is certainly the processing power to do it.
>
> * An RBL per-registrar where you could simply drop a given registrar's
> domains traffic on the floor
>
> * RBL per nameserver sets (gets a lot of spammer, malware, botnet, etc)
>
> * even an RBL for domains with whois privacy enabled, in fact I started
> building this already (now that I think about it, my prototype list
> builder has been turned on for about a year and I haven't looked at it
> in nearly that time)

as the co-creator of both the RBL concept (with eric ziegast) and the
RPZ concept (with vernon schryver), i think you mean RPZ not RBL.

>> "your business model requires externalizing your costs onto the larger
>> economy/environment, thus i refuse to do business with you" is much
>> closer to where we're all living and working at this moment.
>>
>
> Yes, I agree and this *can* be implemented and it can still co-exist
> with the model of insisting on due process, etc.
>
> When private entities decide that "Registrar X" is externalizing their
> costs and they decide not to do business with Registrar X, it isn't
> censorship and it isn't repression, it's a market force.  (And anybody
> who knows me knows I love me my market forces)

on the topic of due process, we may disagree. if someone is breaking the
law "over there" by doing something that's not illegal "over here" then
there may be no due process which can result in takedown, yet the
internet social contract ("if you want the uniqueness of your internet
identifiers to be respected by others, then you should behave
responsibly") may call for takedown in spite of there being no
applicable law.

we appear to agree that market forces exerted against registrars is a
good application of the Invisible Hand with regard to local takedown
policy. a registrar might decide that on complaint, suspension should
occur, on verification, takedown should occur, and on repeat offense
then blacklisting should occur -- all because the registrar have hard
and real reasons to cherish and protect their own reputation.

vixie
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20140129/f2f27245/attachment.html>