Who is WHOIS: a brief biography of Internet user privacy

If you look up the registration details for my personal (and currently non-commercial) website, you'll see

Registrant Name: WHOISGUARD PROTECTED
Registrant Organization: WHOISGUARD, INC.
Registrant Street: P.O. BOX 0823-03411
Registrant City: PANAMA
Registrant State/Province: PANAMA
Registrant Postal Code: 00000
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email:
   9E75215858B04E82BCC8D2E235410D8E.PROTECT@WHOISGUARD.COM

because I register lizdenys.com by proxy. When I first registered lizdenys.com over five years ago, I used proxy registration because I value my privacy, and I continue to do so.

Starting in mid-2013, 282,867 domains registered by eNom via Google Apps had their hidden registration information made public. On April 11, 2014, I noticed lizdenys.com was among them. Having my personal information freely available online to everyone wasn't just theoretical anymore. I am lucky that most of that information is now outdated and that the worst that happened to me was that a slew of recruiters contacted me through the previously unreleased number in my WHOIS record. (I have to admit I'm probably about as impressed as I am creeped out that recruiters admitted to finding that phone number through a WHOIS lookup.) My domain is again protected through a proxy registration.

But ICANN, the global domain name authority, is considering a proposal to disallow proxy registration services for commercial websites. Currently, lizdenys.com isn't and doesn't look like a commercial site, but it could very easily become one. If I needed to put ads on my website to cover hosting costs, lizdenys.com could be considered commercial. If I finished and published my cookbook, Counter Productive, and promoted it here, lizdenys.com would almost certainly be considered commercial.

But the problem with the WHOIS database runs deeper than what should or should not qualify as commercial and whether or not commercial domains should be allowed to use proxy registration services.

To understand the WHOIS database, we have to start with its origins - before the Internet. ARPANET, an early packet switching network whose technologies became the foundation of the Internet, was a closed network for the purpose of supporting government research. Personal and commercial use was discouraged.

ARPANET Directory collected the identities of its users, along with their workplace address, phone number, and network mailbox, and provided this information to other users. As described in RFC 812 (1982), the WHOIS protocol and Identification Data Base were originally designed to provide an "online directory look-up equivalent to the ARPANET Directory." WHOIS was created to have a very specific purpose of connecting those supporting government research more readily, but did not provide information that was not previously available to its users.

In 1984, MILNET, the part of ARPANET used for unclassified Department of Defense traffic, was physically separated from ARPANET for security reasons, but the two networks continued to communicate. RFC 954 (1985) described a natural evolution for the WHOIS Database - that it should continue to include sites that were on the now independent MILNET. The purpose of WHOIS was again scoped to identifying the locations of network names supporting government research, and it still did not provide information that was not otherwise available to its users.

In 2004, RFC 3912 updated the protocol but did not state changes to the scope of the database. By this time, the Internet had expanded from only connecting Department of Defense researchers to also including personal and commercial web endeavors. The WHOIS Database expanded with it, despite no stated change to its purpose, from physical sites of machines passing traffic on a government network to also including personal information about people using an ISP to physically host their site somewhere other than their home address.

During the early days of electronic commerce in the mid-1990s, most participating individuals did not have to worry about their personal information being a part of the WHOIS database. For most sellers, the only WHOIS records for their site were those of their online store platform, such as Viaweb (founded in 1995, later bought by Yahoo! to become Yahoo! Store) and eBay (founded in 1994). Even medium-sized sellers didn't own their own domain names until later in the dot-com era, and individual sellers followed even later. Contact information for e-commerce was handled in other means. While WHOIS records were expanding beyond the needs of the ARPANET Database, they still tended to catalog only major organizations making up the network, not every website owner by their personal information.

In the last two decades, an increasing number of individuals sell through their own domains, where they have the freedom to customize the purchasing experience for their products. Many more individuals, such as myself, have personal domains that will probably venture into partially commercial territory someday by showing ads or promoting their work. Each of these domain owners is also required to be in the WHOIS directory - either they must give their home address, create an alternate address possibly to be used solely for domain registration, or use a proxy registration service. (Most domain owners I know use both proxy registration and an alternate address underneath, like a PO Box, though obtaining an alternate address costs much more than a domain name, a proxy registration service, hosting, and SSL certificates combined.) It's a recent phenomenon for domains to be owned by individuals instead of large companies and government agencies. Proxy registration service is, effectively, a workaround for how WHOIS was not designed to handle this.

The Internet of 2015 isn't the Internet of 2004 or 1994 or 1985 or 1982, and we deserve better than the WHOIS system designed 33 years ago.

That's a lofty undertaking that isn't currently in the works, but the threat of removing proxy registration for commercial websites is immediate. ICANN's working group has called for public comment on this issue - you can send your comments by emailing comments-ppsai-initial-05may15@icann.org and clicking the required confirmation when ICANN replies that they have received your response. I've written in, and I hope you will, too.

Dinosaur pie!

I wanted to make a special pie for my amazing boyfriend, Matt, on his birthday a month ago. Naturally, I decided to make an apple pie because he likes apple pie and because I can make a mean apple pie with fresh ground cinnamon and a small amount of pre-cooking the apples on the stove. But that's a recipe for another post.

Finished dinosaur birthday pie for a very special birthday boy!

What really made this pie special was a new idea I tried for shaping the upper crust - cookie cutters. I rolled the pie crust as thin as I normally would for an upper crust, about 1/4-inch thick, before cutting and imprinting it with dinosaur cookie cutters with stamps of their bones.

Coating the dinosaur crust in cream

Rolling it out as thin as usual meant that the imprints made that part of the dough thinner than I ever would making a stamped cookie. I don't really have any evidence that this made the final product have clearer detailing, but I do believe that by not thickening the pre-cut, pre-stamped crust, the crust expanded less than than it would have with a thicker crust and kept the outlines of the dinosaurs clearer. Brushing with cream also probably helped define the design by helping to brown the crust.

Presenting the dinosaur pie to the birthday boy!

I look forward to maybe making a Star Wars themed pie in the future - maybe a Darth Vader blackberry pie?

Dresses, 'dressing up', and the software industry

A few days ago, Lea Coligado, a junior at Stanford, wrote about some of the sexism she's experienced in computer science. One of the things she mentioned was how wearing dresses caused her to be treated differently. I, too, prefer dresses because I find them much more comfortable than pants; I (probably) wear pants once or twice a year outside of the gym and cleaning my apartment. I, too, have noticed that people treat women differently for deviating from the "software engineer uniform" of jeans and a t-shirt.

It seems like fashion choice shouldn't be that big of a deal within academic environments and the workplace, as long as it's appropriate.

An acquaintance mentioned that he gets treated differently when he wears nice slacks to his workplace. His experiences match up with the ways I've seen my male friends get teased by others in the industry for dressing up, and they'll hear comments like "Oh, are you going on a date tonight?" and "What kind of occasion could be cool enough to warrant putting in that much effort?" Both my friends and Lea are dressed up because they think it's important to "seem like they tried," and they both get responses for it.

It is unfortunate that our industry questions people who choose to regularly or occasionally dress up for work. But there are a couple of ways that this bias manifests particularly badly for women.

The first is that wearing a dress and "dressing up" aren't the same thing. Similarly to how there are places where jeans and a t-shirt would be highly disrespectful, there are dresses too casual for many settings as well. Many women, Lea and myself included, wear dresses for the same reasons that many men in software wear t-shirts: comfort and personal preference more generally. It's no more of an attempt to flirt than wearing a witty t-shirt; it's just another option.

On top of that, the responses I've gotten when I've worn dresses are usually directed at my character or skill level. The kindest of them call me naive or better suited for non-engineering positions: "Software engineers learn they don't need to dress that way." Men, too, are mistaken for different roles, though for dressing up as opposed to simply wearing a different article of clothing. However, women are told much more frequently than men that they are just not suited for the positions those people already know they hold: "Real coders don't focus on fashion." I've even seen men who don't dress the part get extra credit for commanding respect in spite of their atypical clothing choices!

Clothing choices have nothing to do with technical ability, and conflating the two will only help perpetuate the gender gap in an industry that already has a serious problem retaining women.

Why is it easier to teach girls to code than to teach ourselves to treat women well?

When we ask ourselves "why aren't there more women in tech?", we're quick to discuss how the pipeline fails young women. I would be lying if I didn't think there's room for improvement here - I've written about my own negative experiences as a young programmer - and it's exciting to dream about new ways to expose eight year old girls to programming, with or without pink. Unfortunately, we only have limited efforts to put into solutions, so it's important to understand how we can be the most efficient. Wanting to get more girls interested in computer science is fun and non-threatening. Changing workplace environments would have a more immediate impact.

Half of the women in technology leave.

We know that we lose women over caregiving issues. There are too many maternity leave policies that show workplaces are uninterested in their female employees having healthy family lives, and we expect mothers to put in time at odd hours just to keep up. Our industry needs to find ways to be flexible with talented women who also want to have families.

But the main reason we lose women isn't related to caregiving - it is a myth that pregnancy is the main thing that holds women back when it only accounts for a sixth of women who leave engineering. We primarily lose women to toxic work environments: misogyny and sexual harassment are commonly cited as reasons for leaving. This ranges from assumptions that women can't possibly be good engineers to a man erasing the work of a woman because she refused to date him. Treating women fairly could very well be the simplest way to increase the number of women in technology.

But we don't discuss the importance of fixing these problems like we discuss the importance of the pipeline. Discussing the pipeline is convenient - we've agreed that improving the pipeline is a complicated and daunting task that we can't be expected to solve in a quick timeline. So we're able to put it off and pat ourselves on the back for thinking about how to fix things in ways that make us feel good about ourselves. Blaming the pipeline means we don't have to confront the internalized misogyny in our day-to-day environments. It's a cop-out.

Admitting that the culture can be hostile is admitting that there's something we can work on changing now. It's time for us to decide to change.

The next time someone asks you to help get girls interested in technology, also ask them what they're doing to support the women who've already made it through the pipeline.

xoxo

XOXO stage banner

You and I meeting
for the first time.
Together, we found
spaces
built in polygons,
yellow, orange, and red.

Places to experiment, learn,
play, create.
The safety to
talk of speed bumps, loss,

failure.

But you and I -
an army -
propping up those colored polygons
to turn defeat against itself or,
at least,
make it something we take on
together.

Places and spaces into
moments and memories and
bonds to hold onto
beyond those polygons,
yellow, orange, and red.