[ppml] Policy Proposal: Authentication of Legacy Resources

[Rich Emmings]

On Tue, 10 Jul 2007, michael.dillon at bt.com wrote:

>> Finally, the contact data may be 15 years old, but that
>> doesn't relate to it's veracity.  If it's out of date, how do
>> you get a hold of someone to let them know it's out of data?
>> Breaking their Internet isn't a nice thing to do.  Who gets
>> sued when it happens?
>
> I wonder what the courts would think if a plaintiff admitted that they
> had not contacted their provider of critical infrastructure for the past
> 15 years? Might the courts consider that the plaintiff had been
> negligent and therefore, the author of their own misfortune?

I think it's called extortion, when you have no agreement with an 
organization, and they say "Give us money or else" or "Sign this or else"

If can sign an RSA, but don't have to, legacy user, it is a voluntary 
document, and legacy assets can't be held do it.

I'll restate, just because it's 15 years old, doesn't mean it's not valid. 
Put this into a court of law, and I can guarantee everyone on this list will 
be worse off of the outcome, with 12 [probably] non-technical people making 
this decision.  ("which end of the pipe is this again????")

But we can go around in circles.  Doesn't matter how we got here, we're here.

ObConstructive:

I have no disagreement with writing a letter asking a non-RSA legacy holder 
if they are using the asset.  At worse case, the realize they have an asset, 
and keep it, and we're no worse off then we are now.  Why do we have to go 
to the woodshed and get out the largest stick?  Let's not threaten everyone 
as a first step.