<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I’m actually opposed to this.<div class=""><br class=""></div><div class="">First, whois lookups are a query against a public database. All information in the</div><div class="">database is currently public, so there is no possibility that the content of a whois</div><div class="">lookup is sensitive other than, perhaps, the person sending the query wishes their</div><div class="">query to be unknown. In that case, the person sending the query is fully empowered</div><div class="">to choose https if desired.</div><div class=""><br class=""></div><div class="">There is no reason to add SSL overhead to all queries just because.</div><div class=""><br class=""></div><div class="">Owen</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Begin forwarded message:</div><br class="Apple-interchange-newline"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">ARIN <<a href="mailto:info@arin.net" class="">info@arin.net</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">[ARIN-Suggestions] NEW ACSP 2018.3: Automatically Redirect Whois Queries to Secure URL</b><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">March 16, 2018 at 10:02:16 PDT<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:arin-suggestions@arin.net" class="">arin-suggestions@arin.net</a><br class=""></span></div><br class=""><div class=""><div class="">On 14 March 2018, we received a new ACSP 2018.3: Automatically Redirect<br class="">Whois Queries to Secure URL.<br class=""><br class=""><a href="https://www.arin.net/participate/acsp/suggestions/2018-3.html" class="">https://www.arin.net/participate/acsp/suggestions/2018-3.html</a><br class=""><br class="">Description: It appears possible to go to the insecure version of ARIN's<br class="">whois by going to http://whois.arin.net. Would ARIN be willing<br class="">auto-redirect users to the secure version, https://whois.arin.net, and<br class="">additionally, consider using HSTS for this site, too?<br class=""><br class="">Value to Community: Secures all WHOIS lookups, which could sometimes be<br class="">potentially sensitive. It's also consistent with what ARIN has done with<br class="">most of it's other public-facing websites.<br class=""><br class="">Timeframe: Not specified<br class=""><br class="">**<br class=""><br class="">We are currently evaluating this suggestion, and will provide a response<br class="">to the community as soon as it is available.<br class=""><br class=""><br class="">Regards,<br class=""><br class=""><br class="">Communications and Member Services<br class="">American Registry for Internet Numbers (ARIN)<br class=""><br class="">_______________________________________________<br class="">arin-suggestions mailing list<br class="">arin-suggestions@arin.net<br class="">http://lists.arin.net/mailman/listinfo/arin-suggestions<br class=""></div></div></blockquote></div><br class=""></div></body></html>