Re: EU data protection, was: Extensions in regards to NTLDs

On 21 dec 2011, at 15:40, Klaus Malorny wrote:

> come on, we discussed this already quite a lot, if I remember correctly. If you have, say, the address to be
disclosed, but the phone number to be undisclosed by default by the registry policy, you can't issue a
create or update request that makes the address undisclosed and the phone number disclosed at the same
time. If, for example, the "flag" attribute had been placed on the child elements of the <disclose>
element, this would have been possible. As the example I gave is IMHO a valid desire, I consider this as a
flaw, although not as a serious one.

The problem we have is that in some cases the "disclose" flag on certain attributes is a mix between the
interest of the registrant and various policies. Including what is invented by the registrar, invented
by the registry, legislation in the area where the registry is, where the registrar is, or where the
registrant is. And that boils down to various disclosure flags be set by the registry, and others by the
registrar, and a third possibly by either registry or registrar. And the protocol unfortunately is *E* pp
where the E is a bit too extensive instead of (for example with this disclosure flag on attributes) "us"
trying to solve the problem that exists.

That have lead to each registry invent their own extensions that lead to a pain for the registrars that try to
communicate with more than one registry.

Which of course is very simple as the "cost" for private extensions is linear to the number of extensions a
registry has, but exponential on the registrar as the combination of some policies / extensions are very
very hard to combine.

So, I would encourage people to have as a very explicit goal to have as few extensions as possible, and saying
"we need a different extension because our policy is this" is for me not good enough. It is possible to
either change or tweak the policy so that an already existing extension can be used.

To conclude: I do not care how the disclose mechanism is implemented, I want one. And only one.