Internet Engineering Task Force 101, 19 Mar 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF101-REGEXT-20180319-1740

Description

REGEXT meeting session at IETF101
2018/03/19 1740

https://datatracker.ietf.org/meeting/101/proceedings/

A

B

And also it's part of being a just a working session. The intent was not to have a jabber scribe. Okay, in the usual sense, it's really just us here in the room. The only problem is, we really do need to plan to speak into a microphone because we do have remote participants. Okay, so please try to hand around the microphones. In fact, if we kind of get together, if there's something going on, you can, you know, grab the microphone out of the stand and just pass it in the group.

B

I really want to try to make it convenient to be a working session, so you don't have to line up at the mic. We can pass a mic between each other and we do have the two here. So if we need to have two- and that makes it easier- let's just plan to do that- okay, we're actually right at 1740 here. So again, this is the registration protocols, extensions working group, as I said, the intent is to make this working session.

B

So there are no planned slides, except that Roger did have an outline for the topic that he has here. In terms of registry mapping- and you sent that to me a little while ago, I'm going to take the time to put that into something that I can display, so I'll get it up on the screen and the remote participants can see it. I'm gonna help I'm gonna turn this meeting over to Roger to walk through the discussion and make this a working session.

B

All I'll try to manage the queue over here so that he doesn't have to be distracted by that, and I'll also tried to get the slides I'll try to keep them to the extent that we're using whatever's on the screen and the outline that he gave me I'll try to keep the on screen at that place for remote participants, so that you can see what we're doing and with that.

B

Let me turn it over to Roger I'm gonna hand out the blue sheets and then I'll take care of getting some slides going so Roger over to you. Thanks Jim I.

C

Think we started talking about this, maybe even last year in Chicago, when we are trying to find out where to put launch phase details into the fie mapping document and we decided that it actually didn't belong there. So it was suggested that we actually find a new location for how to define what launch phase information is actually required for a registry or a feed installation.

C

So it was lucky that Verisign actually had already started this idea some time ago and Jim actually suggested that we go and take a look at that and see if it works or not.

C

Jim and I have spent I, don't know last six months back and forth, probably looking at it and deciding that for the most part, if it fills what we were looking for with some slight changes that we've already started making on it, and this idea of the registry mapping is, is I, suppose twofold, it's a system, level information.

C

So if you, if you're looking for your connections, how many connections you have the timeouts on the connections and things you can find that in there, but the the purpose that we were really digging into was some of the TLD more specific information that the registry mapping provides. You know what what host names are. They're allowed, what contacts, what things like that, but taking that one step further.

C

It's also led to an extensible registry mapping where, when a new extension comes in thinking of launch phase and fee, you can actually define those in this registry mapping and how that RFC was actually implemented by the registry for that TLD. So we'll get to those details with, but I just wanted to provide that high-level item.

C

B

So, just to be fair, he keeps saying Jim and although I I do frequently go by Jim, it's only fair to acknowledge he's talking about Jim Gould. Here he's not talking about me every time he says Jim at the moment, so I just wanted to be fair and and acknowledged that the source of all that I should also acknowledge that our co-chair Antoine rashon is out there in the remote participation for this meeting just wanted to make that known to anyone. I'm. Sorry! So back to you thanks James.

C

All right, so, let's just kind of run through what the current registry mapping kind of looks like again, I sort of describe it. The two main parts are the registry level system items and then TLD specific items or zones I think it's called in the registry mapping. So again the when you look at the core system items, it's not a lot of hila or a lot of information, but again max connections idle time, ops, absolute time, the command timeouts.

C

Those type of items are in that system level and then, when we get into the zone level, this really is about the gTLD and what it you know. Its parameters are said inside the SRS.

C

So when you get into the zone level you're talking about what services are available for that TLD, the point deployment groups, management information like create and update dates, creating updated clients.

C

Other items are like batch jobs, shared object zones. So if there's certain things that get shared across one gTLD to the other, maybe you can share a contact from one to the other, so you can use one contact and you can put it in multiple different earths. You know use it in multiple TL DS.

C

Let's see domain policies, obviously, and under that you know the domain name, rules, rules around ID ends domain contact, what those rules are nameservers, child host registration periods, RGB periods, DNS SEC domain check policy and what the supported statuses are any any rules around the auth info expiry policies and again these are all within the main core of a zone, definition for a TLD. So moving on from the domain policies get into the host policies.

C

You know what are the policies around internal host external host? Can you share the IPS items like that post check policy, host, naming rules and again the supported statuses for the host as well? Moving on, we have the contact object as well.

C

What rules around the contact? Identifier and again, any sharing policies on contacts, how they can be shared postal info rules, contact check policies. So how many checks can you do or how many contacts can you put in a check?

C

Disclose disclosure support policy? You know: does the TLD recognize the disclosure flag and won't disclose certain information again supporting statuses and a privacy policy contact support.

C

C

And that's basically, the core of the registry mapping and the the big item that gets attached to this, of course, is the extensions. So when, when extension is created, you know you, we can start to define those in this registry mapping and in Jim Gould actually has already done a preliminary one of launch phase. So he went through the launch phase RFC and pulled out everything that could be configurable off of that RFC.

C

So all the maze and shoulds all the options he pulled all those pieces out and said: okay for a TLD, you need to define these things and how the TLD implemented it. So what if you? Let's look at the launch phase extension itself.

C

You know you you're talking about policies, including it more not at the RFC, but at the phase. So it's kind of an embedded, embedded policy where it's you know what type of phase is it the name of the phase? What modes first-come-first-serve pendings and it's in an application or is it an actual registration, create.

C

Some other things or start dates: supportive, validators supported, launch phase statuses. You know our pending creates allowed. Is it poll messaging policies, supported market validation methods? Actually Jim actually just mentioned to me. You know, there's multiples in there. I never thought about it. There's multiples in there. So.

B

You please so sorry for the interruption. Anyone have any had the magic HDMI to two Mac adapters. I did not pick one up from the registration desk, I didn't realize they don't have the dongle. If nobody does I can I could go to the desk and get it but I think I'll just stay for this I did upload the document that he gave me with the outline that he's reading from here into the meeting materials. So you could go to the meeting materials for this meeting and you'll find the outline of discussion up there.

B

Let me see if opera is so that he'll be here. Sorry Beck. You.

C

Thanks and really I again, he went through all these and just went through it item by item and pull out all the amazing shoulds. So probably one of the big things to talk about is is this policy concept of when a when a extension is created? We all sit here and talk about it and design it and everybody has to add. You know one or two pieces to it, but that implementation is not that you always have to do those things. It's we went through the fee document and Jody.

C

If I can talk to this better than me, but when we were implementing fee what said five years ago, even though the fee document isn't even done, but when we implemented it five years ago, every registry that we worked with, we had to sit down with them and they kept asking us. Well what about this piece of the fee document? Do you need this one, and do you need this one? So we had to go through with every registry and said you know we don't use it. I mean you guys can implement it.

C

If you want the document, you know makes it optional or whatever, but you know we don't implement. You know we're not going to use it. So we went through this process. Just you know, 300 different companies and had to go through and do the same process with them.

C

What this will do actually is provide that information at htlv, so all 1200 TLDs that are coming will provide that exact information that we need, that we can do it with and we don't have to go back and forth and miss one with one register and pick it up with the next one. So so I don't know Jim did you have anything you wanted to speak specifically on for an introduction, I guess when we can get in questions.

D

Yeah, what I would say is that the experience of being an author of the launch phase extension and then trying to take that and create a policy extension out of it was very worthwhile I'll, just gotta say as we go through these internet drafts, we keep throwing stuff in I mean in essence, you'll see it. I'm saw it in the registered fee extension things are getting thrown in and in essence, you're gonna implement it as a registry. The way that you're going to implement it based on the option that you chose.

D

But the point is, is that in the case of the launch phase policy, there were 15 different maze and shoulds and lists, and that sort of thing that was thrown in there. So as an author really clarified, all the things and all the thought that went in there, but it adds to the complexity for the registrar. So in essence, even if you didn't do this extension, you probably want to document it in some place right. You want to have an artifact that finds exactly how it is that you're, how you implemented a particular extension.

D

But for me personally, it I prefer writing code than it is writing a word doc. That goes to legal, so just to my choice, but I think it's worthwhile to go to that exercise. Anyways. As a author of one of these extensions, hey.

C

That's a good point: I mean that's, it's something you bring up, I mean actually I mean for the fee document. I, don't know it's about four years old now, I think from the original, and you know, I didn't get heavily involved in until last year, so there was a lot of things in there already that and it's probably doubled in size. Since you know the beginning of last year, so it's all those I don't know if you call them compromises but agreements that yeah.

C

It needs to do this and it should do that and they need it over there. So, let's put it in there kind of features that just need to be documented somewhere, so I agree. The policy document really pulls that out and probably really helps. You know when you start to think about true implementation of it and it's like oh yeah. So how do you technically do that then I mean everybody agreed that that makes sense to do that in the RFC. But you know okay, now that we actually have to make it work.

C

How do you make it work so.

D

So yeah one other item is the fact that this would in essence result in two extensions for every extension. Oh yeah right so just think about this, so you create an extension around a registry fee. In essence by creating a policy extension of the registry object, as opposed to an extension of domain.

D

What you're doing is that by defining the policies of how you're implementing an extension, pretty much creating another extension of something different right, so you may think that it's doubling your work but to me personally that it's something that you should be doing anyways actually, when I create an extension. I typically will always always implement it. Myself on both sides, I want to understand how it works, or how does it work?

D

I, look at all the different options, but being able to capture that in something that's concrete that can be consumed by software I think is really beneficial, so I don't want to start with a negative there's. Two extensions. Instead of just one I think it's it's absolutely necessary.

C

Okay, that's really the high-level overview of what the registry mapping is intended to be I, don't know if anybody has questions concerns, I mean I. Think Jim brought up the biggest concern that I mean I can see authors having this is really. It creates two documents for every extension that you create so.

B

Does it have to be two documents? It doesn't have to be two documents right, I mean I, guess that's the question you're trying to get on the tape on the floor here right, yeah.

C

And it's something we actually have talked about is, you know, do they need to be two separate documents? Can it be a section within one document that explains all this I.

E

Alex may oppo speaking like thirty centimeters above ground. Well, um my general impression I've been reading through the word document that here that you posted on the meetings, materials and I think that I know roughly the internals of photomania registry, but some of the words that you mentioned there I have no idea what they actually are so Beth show bet.

E

Chops is one of the words or points on that Word document I, don't know what what I would need to describe their I'm, saying to you like created that from that exit that you sent to most of the registry.

A

E

So it's like a living experience of what you require from right histories, yeah, good.

D

Yeah, actually that the Badger was coming.

E

Back from maybe a five seconds so I think before we equally, we can work them on the document. We should actually understand, or this some of us should understand what each of these items actually are. Unless the extension is so generic, then essentially it's a key value pair. It says job domain expiration. Yes, whatever that means yeah. You know.

D

I would say that yeah we need agree on the terminology. Yeah I think number. One I thought that it was well I, guess my mind. It was no, but obviously it's not so just to let you know. The fact is that it's generally something that we're going to run on the schedule that the most important one that we have is the the dilly batch. That runs at specific time that will actually purge the domains from the system.

D

But the timing of those batches is really important for the registrar's to know when you know like the nota renew is going to occur when the domain is going to get to lead it. When is a transfer going to get auto approved? You know one of those batches that run on the schedule execute that's what that particular section is about. So if you have another term, that is better for that great to know. Yeah.

C

And this Roger Alex yeah I think for the for the core items. It's definitely not going to be a key value. Pair I mean they're set items so.

F

Chris from core Association.

F

Of course, I think thats always what, if the registries implements this extension differently right, so we need to be if we define something sweet, strict or not, but there is little room for additions.

F

Same thing, I think great of an extension that we can use. For example, you have XML and you can. You can generate a number of tests who Mazda in content. If you can automatically generate sound, the sound took months for registers who bleeds when they come to the registers. You can just put the case in TECO data immediately feed their system. Try to connect, see if there's any boxes that are on all the test cases, and then it need to be there they're far further into having discipline, but we're definitely needs, and you especially.

C

Thanks Christy I think he make a good point again going along with the Alex says that core said it's got to be something that everybody in Greece and you know, maybe not everybody implemented every one of those items but agree that that's what that is, and that's what it's for.

G

C

Up here, Scott this one's a little higher.

G

C

This is okay, Scott.

G

Hollandaise, in terms of the question of do we do this in two documents, or do we do it in one I've got a very strong preference for trying to find a way to do it in one it just you know from an overhead perspective, it makes things much easier, and if that means that we, as a group, you know think a little bit about adopting some kind of a convention for what we might expect to see in terms of a section. You know in an extension document that addresses this. That would be time well spent.

C

Thanks guy um this Roger I, we went through this discussion and one thing we kept coming back to was: how complicated will how complex will that one document get and will it get confusing when it's talking about maze and hoods and shoulds and and then you get into a section that is detailing all those out? Does that complicate? You know how that first draft is written.

C

Okay, any other questions.

C

Online any questions, no is everybody, understand, I, suppose the goal here, and is it a good goal, something that the group would like to move forward with.

E

Yeah thanks Alex here again, maybe I can try summarizing in a single sentence. The goal is to transport the configuration of the registry and all the aspects of that in TPP know between registry.

C

In which that's a good summarization of it yeah so Alex does it it's a nice understand. It.

E

It's a nice goal, it's a hard one. I guess you know, because there's so many ways to do something in a different way. Yeah.

C

And again, I think that the core piece of it will probably be the hard part to do and get everybody agreed that these are the main things every does the extension. You know an e, an extension sends it's probably pretty easy, because it is a little more dynamic, but yeah I think that the core would be the where we would spend our time trying to get agreement on what that actually means, and you know just everybody call it that or not as long as it's there. You know the the the I guess, the meaning behind.

C

It is known that.

E

Looks again, I try not to be the elephant in the room, but shall we include information regarding previously policy with regards to what type of data is being published on the other end as well listed just the provisioning end.

E

So, which of the data is going to end up in buoys.

C

That's interesting, I mean again one of the items in EPP was the disclosure flag, so you you're starting to touch on it, but is it more yeah I would.

E

Like to try to stay away from that, on the other hand, my question is with the configuration information being complete to you, then I.

D

Would respond to that and say that's around provisioning if there was an extension like, for example, like you said that the disclosure element that outlines you know what is possible that that way? What how the registry implements that particular feature would be described in this particular extension.

D

So I'm not sure if you want to go beyond that at boundaries, yeah I.

E

Think that most most registry is Utley that I've been talking with in the CCT of the world might want to go beyond of what's possible cities, collective samhita might not even display a handle or a contact ID for a domain important.

D

Yeah part of my concern as well and doing something like this is trying to capture every possible combination of implementation that may be kind of what I would call snowflake kind of one-off. Potentially, the issue is that for us to have something: that's common across those I would see that if there are some registries that do things in a very unique way, then they want to create a separate extension of this to be able to communicate their particular unique policy.

D

So I wouldn't want to bake this and making it so big to cover every possible little nuance, but so.

E

What you are saying is that we are going for the 8020 Queen's exactly.

D

C

Just to add on to that Alex 80/20, where you can still define the 20 just on the side of it. So it's not it's that we had to agree with every 20 here, it's an extension that you can add into it. Since.

D

It's an object in EPP. You can create command response extensions for that. So therefore you can define whatever it is. You want to find palsy.

F

Chrissa component, one of the ways may be to prevent people from writing. They want and causing ability is if, if there is a way that allows you to generate it's, not maximal definition and then you can in in actually finding the extension versus register, you can define it on their own and they say: okay, Aarthi extension is supposed to look like this. Therefore, here is what you should use to generate for the c'mon create this.

F

What you should send to us and rivers then uses, are periods and immediately generate what certain service or in any way kind of bypasses people. If I write something combined a person example: okay, someone because they look at it and say: okay, this, but it's it's called problem.

F

Okay, they defined something straightening.

D

Actually, we've already implemented our proprietary version this and you know what 150 plus TL these yeah. We have everything data-driven to be able to generate a policy, but the intent is to help the registrar's to be able to see those variances between those TLD ease. So that's there for the Registrar can auto configure their side of things, and we have we use this ourselves for our own monitors. So no one would like launch phase particular TLD Ireland and what you can it can't be done.

D

It's very, very useful, so yeah it's it's got to be Dave, driven as much as possible.

C

C

All right, we did have a few I guess, suggestions, questions that have come up since we started talking about this Anton actually brought up a question. I think the last time we talked on this was, you know: should the key relay mapping RC be included in here and and I? Think that the easy answer is yes, the hardy answer is, you know, isn't an extension or isn't in the core and to me it seems simple enough just to make it part of the extension.

C

You know leave it out of the core, but you know that's just my opinion, but.

D

Actually, antenna might be able to describe this so I like to know what options there are in the key relay that you would want to communicate. Something like this. It may be just that the TLD supports it, yes or no. If it's a yes or no, then the core already supports that, because I already enlists, the the XML namespace is supported by that particular TLV.

D

So if you connect to a registry that supports 150, TLDs you're going to see an aggregate of all the different extensions supported by that system, but in essence you want to be able to query for a particular extension I mean it's particular tle why they supported when I says, if key relay was only supported by a subset of those TVs on the system, you'd be able identify that, but if there's more than that, then you'd be able to identify those specific specific options in the key relay. That would be useful.

C

C

And actually Patrick gave us quite a few different. Those talking points to look at. He brought up a few different attributes of zones, the rules around domain names, number and type of objects, and.

C

Policies on unlinked object relations, which is an interesting one, because we've been talking about that for a little while now, as you know, what are the deletion rules around an object? That's been sitting there not associated to anything for a year. You know I said you know after six months you get rid of it. You know if it's not linked, it's an interesting one. That I think could be useful in there. Alex.

E

Alex again, I'm I'm, trying to turn my head around the fact that this can actually be depending on other effects like, for example, registries can introduce new again scripts yeah, which changes that rule, but in turn registries might want to introduce those idea scripts in like samurai style. So we have like combinations of those things and I have no idea how we could ever convey that in a machine, readable format that would enable you to like press the button through Yahoo or take E is enabling Cyrillic yeah next months, and it's.

F

E

So yeah see to it, so we could either focus on the like I like to say the stable operations mode of the registry and try to include like wait from Wendie to thousands or we could go for a winter to actually try and look at whether we can manage to represent those combinations. There.

A

E

Launch phase with la you audience creep that creates applications.

D

I'll respond to that one. um Actually, a launch phase is pretty unique in the fact that it has schedules defined schedules, something like they're talking about I that may be better suited. We're in essence, there's an updated date for the policy. So the idea is the fact: there's two different forms of getting policy information for what we call the zone.

D

When does it get a list of all the zones and then there's an updated date in there to be able to support updating you, the cash on the client, so in essence, if you've loaded it all up, then let's say that we change the IDN policies. Let's just say right and let's say that we're able to code the idea in policies effectively inside the zone.

D

What you'd be able to do is do a query find out that it's been updated, then query for the specifics right. So, in essence, what you would be doing is that you would be having the data provided from response to be able to drive your logic instead of saying I'm going to schedule ahead of time and look at you know at this particular day, you'll be able to do it dynamically in that instance, not not in the case of launch days.

C

Okay, another thing Petra prophet brought up was the the epp transport content number of connections, which I think is obvious time outs and to me those were the the obvious system, ones that we actually had in there I don't know if their TLD ones would be specific or not so.

C

Registrar content: this was an interesting one that password policies you know lifetime pass to password.

C

Can you reuse on complexity? Things like that? Is that something that we could design into this so that it's defined, and you know anytime anybody logs in they know hey. My password expires in 30 days, so it's another context that is useful. Today is obviously fairly manual.

C

We just went through it with filius not too long ago, but another good idea, I think so. I.

E

Have fun like year with two things? One thing is I think we should reuse previous word so I, don't know whether there is some XML or whatever that describes a password policy. If such a thing says exists, we shouldn't reinvent the wheel, for example, IDN scripts.

E

We should use LGR yeah because that's already existing and they're groups actually describing the policies for every script, so, if possible, which we could include LGR here, and the second thing is that there are so many of those things we should maybe at one point goes through all those things and try to figure easy, not that easy, but doable hard, very hard, yeah and then inside which of the things we would want to include the most pressing ones. I would say if.

A

The most pressing wants out.

E

Of that are very hard to do, then we have a problem if the most, if 80% of the most pressing ones and easy ones, let's go.

C

For the easiest ones,.

E

First and try to move up from there, so you're thinking the hardest.

C

Technically, to solve yeah and balancing that, against the the cost of how.

E

It's currently.

C

Being done basically.

E

I think it menu yeah.

D

Yeah, what I would be asking for is the other registries specifically out there take a look at this. A lot of the elements in here make sense to me, because you know we get Verisign one hasn't implemented it so that matches our way of doing things, but our is not. The owners is not the only way so you'd be great. If other registries take a look at this and and think about what kind of policies you have on your end, that could be communicated to the registrar's in a structured way.

D

If you can't, you may want to think about it, I'm just just throwing it out there. If you can't represent your policy in a way, that's easily consumable, then it mean it may be too complex of a policy right, but take a look at this and see if it's something that is missing, something that could be adjusted because the idea here is to be able to come up with one way that registries can do this.

B

So um Jim Galpin, just speaking for myself here um since I guess, I, want to say two things: first, just in response to Jim Gould air immediately. You know we are carefully looking at this. You know we Phileas and trying to decide what we want to do here. We want this to work. This particular register our content, stuff and password policies. Not actually sure this belongs here. I think it probably belongs somewhere else. I just don't have an alternative to suggest at the moment.

B

So you know with that in mind: it's okay, to talk about what this might look like, because even if we move it somewhere else, we will have had the discussion about what this kind of this kind of information looks like, and so you know, I mean I, like the fact that we have an opportunity to talk about this line item and the second thing is yeah. You know, since Roger just mentioned that you know they meaning meaning GoDaddy and and Asif Ilyas.

B

We actually tried to go through a password change for all of the registrar's that are with us for all of our TL DS and found that to be I'll, just call it an interesting exercise, so we're very interested in trying to find a way to better manage this kind of information. I'm, not sure it belongs in this registry mapping, but at some point it's either going to go here or we'll have a suggestion on a different kind of framework to do that.

B

So I just wanted to put that out there for discussion. Since all this is just under discussion, it's it's fine to just take that in for right now, I'll.

D

Chop it on that one actually I kind of think that it does belong this. It may be that warning messages and that sort of thing about expiring password would be more for an extension of the login response or something, but in the case of defying policy, if you're going to on the registry side expect a password, you changed every 90 days right. That would be a basic system level policy that you could communicate to the registrar, so their systems are.

B

Aware of it so I guess, the interesting is the distinction that I would make and why this is just sort of a discussion for us is. Are we talking about the registry as a service provider, so that I mean, for example, you like us, you know we have a couple hundred GL DS, you know so are these policies about that or are they about a TLD, because, on the one hand, it's not clear that these passwords are purty Aldi, which is what the whole mapping is for as opposed to that and I.

B

Think it's it's just it's an interesting distinction and if we're going to come up with a framework sort of manage these things, we have to decide what that distinction is going to mean and and how that would apply to this particular content. So make sense. Oh yeah.

D

It does and actually based on the connection policy and the timeouts, and that's where those are system level, and that was added, so there's a different area for a system, and then the system contains many zones or TL DS, and then you have specific policies at the TLV level. So it supports both and in the case of the long face. What roger have referred to is the fact that it's a a sub element of a TLD. So our TLD has many phases.

D

So we look at the policies of a phase they're unique per phase, but there's no way that it will limit limit in this way by the Knesset's. What ones have happened is that, by having a system level set of policies, have a TLD level policy and even have the option for sub policies that.

F

I think in terms of the password policy, do you think it is actually a good thing, because there is typically in a registrar, there are various people working with worse than some people barely typically, these are some people, the technical hospital and every time there is something like a password change. It has to go through multiple people until it reaches the responsible person that can actually change. If the system camera already notified legally technical person, but there's Batanes about police power changes or something and.

D

Yeah one item that we discussed actually today was whether or not this would be strictly policy like, for example, you could say yeah if the password expired with 90 days. The other is that you could tell you, based on your log and when your password is going to expire next, based on that request, right.

D

That may be better suited for separate extension related to telling you proactively, that your password is about to expire, but it could be done that so I'm not sure whether or not that's something that you just put as policy within this extension, then you put the other somewhere else.

B

So I mean I'll complicate this even further I mean there are multiple passwords that may or may not apply at different times, and all of this, which is part of why we're in that's right, I, mean there's the epp, passwords and the connections. Their registrar's have access to portals you know and on our website, and there are different passwords that go with that.

B

There are multiple role-based passwords that go, and this is why, for us, it's a it's a larger question of an overall framework for dealing with authentication and whatever we do here just needs to fit into that larger framework, and you know that's kind of why I bring it up. I mean it makes sense. I agree to a first order, since this is about EPP and you're. Talking about credentials for EPP and sure I, don't want to disagree that it should go here.

B

There may or may not be more things to say there so I'm just observing that we're thinking about it in a larger framework all and one open the door for you know there may be something else that this this work has to relate to. For you know for it to make sense well,.

D

Actually, you bring up a good point now if this was broader than the actual system, I'll.

A

D

You know for FTP or whatever other passers a there would be there. I, don't think this that would be applicable to this, and actually this is specific to each system. So in essence each if you have multiple registry systems, each registry system would return back the policies of that system and any TLDs on that system.

D

So, in essence, if you are looking for a central place to look at all the systems and then all the deities within all those systems- and that would be even a bigger problem where in essence the the password broader password issue may apply, but this is kind of targeted per system. So, in essence, when a registrar connects to a registry system, this would be target for that one system and not talking about a different system, so I'm not sure whether or not there would be a desire to have it be broader than that.

D

But I think that might be too big right. Well,.

B

And then, in those lines, if we go down into another layer, so we're talking we've sort of casually thrown out the idea that you might tell the tell the client when they log in that their password is about to expire. Well, if we're talking about an EPP client- and this is an EPP server on the other side- there's probably no place for that kind of notification. A notification probably needs a different mechanism to get out there, so that the Registrar knows that kind of thing.

B

That's why I'm thinking about a different framework for dealing with credentials that there's a relationship here, but you know I'm not sure that all the details are in here or not I'm,.

D

Actually, with you on this one, so I would say: put the policy in here for things like warnings about expiry of passwords, expiry of certificates, expiry of or insecure cipher Suites, and that sort of thing could be an extension or a login security extension or whatever it is. That would provide additional information in the in log in response, which would be more useful or more real-time than it is taking a look at policy of that system. I think that's my okay.

B

So, like great things in just a time check 15 minutes.

C

B

C

Okay, any further questions comments.

C

Chris is coming up.

H

F

Paul messages, notifications: does the system of the Registrar recognize what this poll SS is? It's a whole amount of story, but if we want to send something right, I would say it doesn't make sense to make an extension, since this and I know that wasn't registries or sending some watts of this type of format. So it's not exactly a notification of things that are not within the spectrum of what is typically.

B

So Jim Calvin Jim cool will come up next.

B

Just to say, I mean all messages are interesting because and I'm sure that Jim Gould would say something similar registrar's willingness to actually react and take on board poll messages varies quite broadly, shall we say I mean I, think you know as a registry and we're very much in favor of trying to migrate more things to all messages, as opposed to individual email messages and other kinds of things, because there is greater opportunity for automation and- and you know, a little more stability and and standardization in it, but I think the problem that we have is we kind of have to do that.

B

A little bit at a time would be what I'd say, because not all registrar's are the same. They don't all react to the poll messages, so we have to begin to figure out how to get traction in the parsing of whole messages and get more registrar's on board with doing the right thing, and that's that's a that's. A real problem for us, especially with with smaller registrar's I, mean GoDaddy, obviously is not a problem in that respect, but there are many that are.

D

Actually, what I would say is that I equate the pool cue as to email. So in essence imagine that you're a client is on your website. They have to change their password. You probably tell them right there on on your webpage and send an email, so I think it would be better if you're able to return the information right within the response to the login.

D

Is that way what you can do is provide additional information related to that particular connection like what like I say: they're, not your certs could expire, whether or not the cipher suites are insecure. Those sorts of things could be returned, but again I don't think it's related to the registry mapping, because I think that's policy.

I

Calfire, some of this material relates to actually connecting to the registry in the first place. How do we bootstrapped this? How do you communicate a password policy before you have a password and to communicate certificate, information or cipher suites before you connected to the registry? In the first place,.

C

Thanks Kel, were you talking to Jodi, cuz I think he brought this up before as well. Yeah. That's that's a good question as to how you can do that, because one of the biggest problems that registrar's have is is really onboarding the TLD. So by the time we get a password into this system, we've answered the 500 questions that we needed answered. So it is is something that we need to look at and figure out how you know. Where does that information set?

C

Can you get an OT any that describes the production system, but I don't know. Is it's something that we've been throwing back and forth it? How we can do that so good question.

B

And I'll tell you that you know we've thought about this issue ourselves, because we very much like to do something like this I mean this would just be a super thing and I'm sure that you guys would think of it. The same way and- and that is that is an issue you know, I mean there's a certain manual process associated with onboarding a registrar, and what you want to do is find a way to get to a point where you can set them up, so they can just go.

B

Do this and get it automated and at what point does that? Where is that point time in all the set of manual things that you do and we haven't decided that yet so what that is a discuss we have to have and we're hoping to bring. You know we'll give that some thought and decide what we think and we should have some discussion.

B

Maybe it isn't really clear: we're gonna, try to standardize at point time or not we're if that'll be left for individual registries to decide, but it would be a good point of discussion at some point.

D

This is a crazy idea, because I was I was just saying: I hate, Word documents, but I. Think honestly, this is consumable definition.

D

So in essence, whether or not you were formally defined in a structure like this and put it into an artifact that then could be worked in and then use to configure you can do in batch. Instead of doing it, real-time, not that I'm suggesting it that way, but it's consumable all right.

B

So a related idea about this is what happens when this changes, the apology change. If the policy changes over time, you know you'd really like to set up an automated way to alert registrar's, that there's been a change and they should go grab it again, or should they just grab it each time and there's.

D

A policy for that. No, yes, that was the purpose of the updated day honestly. So the point is, is that you would expect the registrar to be able to periodically query efficiently, which provides a list, not all the detail with an updated date, and they see that it's been changed. I would anticipate that the registrar's will cache it on there. So you see it. This change that you can go in query and reset configuration.

C

No, that's a that's actually a good point, and how do you announce that that changes upcoming as well.

C

Jodi go ahead, your mouth is moving, but we cannot hear you.

C

Can you get Shirley now.

J

H

C

And loud sorry,.

J

About that you know, one of the one that may be one of the options would be to be able to add this to be updated. It has an attribute in there to say that the registry mapping will be updated at this time. For this TLD.

J

It's just a thought in case it. You know if it's going to be updated in three days, put the next updated date in there.

B

So I mean I think in principle, I agree with you. There needs to be some kind of early alert that a change is coming as well as the fact that it changes, but it still just brings us back to this. This basic problem about you know whether people, even if you automate that and put it in here and I, do think that it should be there. You know we really do need to migrate people to dealing with it in an automated way, and that really is a bigger problem for us.

B

We do want to have that and have that feature, but you know how do we move the community to doing it in that way is kind of the issue, but the.

D

Only way I could see that work and it's kind of the way that the launch phase policy extension was done where you're like segmenting it off to allow for multiple by dates, and that gets a lot more complex. I got to tell you by implementing this. Yes, it's data-driven, but in essence you have to like restructure your data to be by schedule.

D

So in essence, when you're going to schedule your deployment of your new logic, you're gonna have to like load it up, I'm, saying it it's technically feasible, you could do it, it's definitely much more complex to produce and to consume.

C

Yeah I was thinking similar lines. Jim did it yes know that the I mean it seems simple enough that there could be an attribute in here that says: hey, there's a future mapping coming up 90 days from now. You know, I could say on August 1st, there's gonna be a new mapping and then technically the registrar could call it and say give me the mapping for August first yeah again a lot harder, but can.

B

You actually do that I have to I. Don't remember in detail enough. If we you know, can you can I actually asked for a mapping of a particular date that would be kind of interesting I'm, not sure that that even the the spec that you guys had would let you do that, but yeah anyway yeah.

B

It's a it's a good topic for discussion to figure some of this stuff out I mean especially since for for cctlds I mean they're, they're sort of individually different I mean for us, and you guys you have gTLDs a lot of things, especially certain changes are, are have mandated notification periods. You know, so all this stuff has to be sort of tied together into your processes. You have 90 days out 60 days out that kind of stuff. That's all. There are just issues and making all this work right.

A

No, this is a relational place. Are we really talking about to fully automate the running of EPP client, adapting to different registries, changing to specifications on-the-fly kind of automated code generation? Whatever? To do this? That there you go guys all web client would like deploy a new style of connecting whatever, without going through testing just by getting the new definition online.

B

So this is Jim Galvin and I'll. Give you my partial answer to that. Others may have a different point of view in fairness. What I imagine this registry mapping encompassing is all standard extensions and, and yes, a standard registry plus extensions that are known and documented and standardized the reality is there are registries which are going to not map right on to this thing it will be different for whatever reason, there'll be things which are unique to them, which won't necessarily be standardized. That kind of thing so I mean all of that applies.

B

What I do imagine is that, at least for us, when we have a new service that we're launching, you always have to go through testing or you have to go through three delegation testing, so not pre delegation testing. You do have to go to OTE, it's gonna.

A

Gatien testing yeah right.

B

But but I think is, as as the other Jim I'll be the Jim he can be. The other Jim said you know you can imagine these things being available in Oh teeny first, you know so the registrar's can connect and do their thing and do their own testing, and you know, then they can. You know, make their appointments for for being accredited for doing things, the the ability of a registrar to do anything.

B

That's in a mapping is dependent on the Registrar having been accredited to do that, and so that's a separate check that the registry has to do on its side. Even if you see the whole thing, you may not be able to do things so, there's yeah, there's, there's still some steps in there. It's not fully automated, because there there are some particular decision points that have to be made that are outside the scope of the mapping. I, don't know if that helps or not, and now we'll let now I'll be the the other.

B

Germany can be each other.

A

But because what what I think is, if we talking about now, what you say is okay, we will have this otome system where we would do it all. First, then we don't have you know that we can reduce the complexity in the in the extension, because we're not expecting it to fully automate it work only actually expecting that there is the system aware of the changes coming so I mean. That makes a lot easier terms of definition that you want to do.

A

What we're saying is we have a note when we put in the new things we have when a client connecting see that it does the right thing and then the the actual extension on the production system will somehow tell them okay. Now we change today with at this point in time we're changing to the new thing, but the system is already aware of it, because it's grown testing. So we put.

D

This way we like I, said we currently use this today and in our monitors. So in essence, our monitors have to react based on what's going on in the registry, based on changes and phases, changes in policy, so in essence yeah in a perfect world. Yes, you would Auto configure the whole thing and be able to react based on changes if you're saying that you need to be a little certify that on the client side before that change occurs. Well, that's what the other Jim said.

D

You say the other Jeff said: that's why you do have a separate environment to be able to do that kind of testing, so at least we're getting a notice. You have an environment to go to to test it out beforehand before the change actually does occur. Right, yeah.

B

I guess the only closing comment that I would make is, at least from our point of view. The intent is to automate things to the greatest extent possible, but there are some manual decision points that have to happen along the way in this, and that's just because some of this is based on contracts. You know, I mean making extensions, you need approvals, got to be accredited all that stuff and that's outside the scope of automation. So there are limits, but we certainly like to automate it, as you said, to the greatest extent possible.

B

Okay, yeah and the time check is we are now at the end of our hour. So I'll give you a moment. Yeah.

C

I was just gonna say: yes, now the works time it good discussion today again, I think I. Think that the reason we brought this and continued I I think we tried once before to bring this forward. Is we do want the group working on? We do want these questions. You know when I say oh yeah, but what about this you know can. Can we build for that or not and how automated can we make those things now from again the earlier mentioned for GoDaddy?

C

This will be great because you know we'll put the resources to automating this. We do have to make considerations for the other registrar's that don't have the ability to adapt to this. So we can't say yes, you know you're in configure your system by reading this. Well, you know a few registrar's. May you still have that manual process for other registrar's as well, so.

B

I'll turn back over to the gym all right, thanks very much so the blue sheets are up here. If you haven't signed a blue sheet, please come up and do that and we will see everybody on Wednesday and I should know off the top of my head when the meeting is on Wednesday, but I actually don't.

B

But it is one of these late afternoon meetings again too, but we have a 90 minute time slot at that time, and so we'll have a more formal structure to working group meeting then with some discussion so other than that thanks very much, everyone see you on Wednesday.

B

We should work.