Recent Posts
- Top-level reshuffle as ICANN loses its COO
- Amazon finally gets its dot-brands despite last-minute government plea
- South Africa might raise, or lower, some wholesale domain fees
- Verisign says its coronavirus fee waivers have saved businesses millions
- Industry growth driven by new gTLD(s) in Q1
- World’s youngest country launches its Nazi-risk TLD next week
- Is ICANN chickening out of Whois access role?
- Irony alert! Data protection agency complains it can’t get access to private Whois data
- ICANN dissenter explains why she wanted .org sale approved
- CSC removes reference to “retiring” new gTLD domain after retiring new gTLD domain
- Google launches .meet gTLD after Meet service goes free during lockdown
- Aussie ccTLD surges under coronavirus lockdown
- Spring Break redux! ICANN picks Cancun for 2023 meeting
- ICANN’s .org decision was NOT unanimous, and it was made in secret
- Donuts kicks down .place fences after attempt at innovation
- .org sale officially dead
- Afilias promotes .vote domains amid US vote-by-mail controversy
- After Zoom trolling, ICANN 68 will be password-protected
- Despite Brexit, .eu actually returned to growth in Q1
- ICANN whistleblower expects to be fired after alleging budget irregularities, bugged meetings
- Portugal ccTLD says growth better than expected during pandemic
- The .org deal may be dead and buried, but calls remain for PIR to lose its contract
- “Dangerous precedent” as ICANN rejects $1.13 billion .org buyout
- ICANN may scrap its $0.18 reg tax in coronavirus “solidarity”
- Domain industry likely to suffer from coronavirus as ICANN slashes budget by 8%
- Decision on .org deal may come sooner than you think
- ICANN meeting got “Zoombombed” with offensive material
- CentralNic does not expect big coronavirus impact as it posts almost-doubled revenue for 2019
- Verisign expects to sell fewer domains because of coronavirus
- Coronavirus lockdown is working out great for at least one registry
- Coronavirus could cause “high risk of widespread outages”, ICANN says
- Free domains registrar gets FOURTH breach notice
- Four more dot-brands join the gTLD deadpool
- As ICANN meets to decide .org’s fate, California AG says billion-dollar deal must be rejected
- Whois privacy talks in Bizarro World as governments and trademark owners urge coronavirus delay
- GoDaddy signs up 30 partners to lockdown-era marketing scheme
- Kuala Lumpur meeting cancelled and ICANN 68 could be even trickier online
- Five SAFE ways to buy and sell domains during the coronavirus pandemic
- To show new focus on registry, Uniregistry dumps “registry” from its brand. Um…
- No ICANN tax relief for Chinese registrars
- ICANN declares coronavirus a “natural disaster” to protect expired domains
- Ethos clarifies .org price rises, promises to reveal number of censored domains
- End of the road for Neustar as GoDaddy U-turns again and buys out its registry biz
- ICANN to consider cancelling ICANN 68 tomorrow
- Coronavirus: more delay and free domains for .gay
- CentralNic seeing no impact from coronavirus
- ICANN expects “significant” budget impact from coronavirus
- ICANN’s number two Cyrus Namazi quits. Probably due to sexual discrimination claims.
- ICANN grants Verisign its price increases, of course
- ALL .za domains have to link to government coronavirus web site
- Namecheap and others banning coronavirus domains
- Go here to help fight against coronavirus abuse
- As it releases free download, DomainTools says 68,000 dangerous coronavirus domains have been registered
- No .com price increases this year. Thanks, coronavirus!
- US officials gunning for coronavirus domains
- Nominet to intercept dangerous coronavirus domains
- An open question to the domain name industry about coronavirus
- US senators tell ICANN to reject .org deal
- More ICANN events cancelled for May
- More domain industry response to coronavirus
- .org decision delayed another month
- Delay .org deal because of… coronavirus? Gimme a break
- Not every coronavirus domain registrant is a douchebag
- Roundup: domain industry starts to respond to coronavirus pandemic
- At ICANN 67, nobody knew you’re a dog
- GoDaddy cancels in-person investor day over coronavirus fears
- WE’RE ALL GONNA DIE! In other news, ICANN 67 was… “muted”
- Facebook WILL sue more registrars for cybersquatting
- ICANN chair: “all options open” on .org deal
- Could .org debate bring back the glory days of ICANN public forums?
- The latest industry C-suite musical chairs
- Poblete to replace Disspain on ICANN board
- Chinese registrars ask ICANN to waive fees due to Coronavirus
- Most languages won’t be available at ICANN 67
- Domain Incite turns 10 today. What the fuck have I done with my life?
- Ethos volunteers for .org pricing handcuffs
- Yup. ICANN cancelled Cancun
- The Queen has beef with Prince Harry’s domain name
- ICANN wants to take your temperature before letting you into ICANN 67
- ICANN might cancel Spring Break over Covid-19 fears
- Verisign shits on domainers, again
- 9,000 people tell ICANN they don’t want .com price increases. Here’s what some of them said
- Covid-19: It’s official, domainers are faster than journalists
- ICA will help you support .com price increases (but doesn’t want you to)
- .gay hires pop star equality campaigner as spokesperson
- Watch: climate change denier on why she trusts .org more than .com
- Ethos’ .org pricing promise may be misleading
- Hacking claims resurface as .hotel losers force ICANN to lawyer up again
- ICANN refuses to release more info on .org deal
- Possibly the strangest new gTLD acquisition yet
- California .org probe — existential crisis or blessed relief for ICANN?
- As Cancun looms, ICANN bans China travel because of Coronavirus
- XYZ expands gTLD stable as L’Oreal exits the domain game
- Is the .co rebid biased toward Afilias? Yeah, kinda
- Amazon governments vow revenge for “illegal and unjust” ICANN decision on .amazon
- SaveDotOrg to protest outside ICANN HQ. #lol
- Ten years ago I predicted Oscar winners wanted a .movie gTLD. Was I right?
- ICANN gets a new European chief
- New CEO to step into the lion’s den at auDA
- Secrets of the .org deal revealed, but much info remains private
- Registrar terminated after what looks like domain hijacking
- NamesCon publishes full agenda for debut Austin conference
- .gay prices and availability revealed as registry promises to give 20% of revenue to charity
- Now .org critics actually want to take over the registry, blocking billion-dollar sale
- Verisign pays ICANN $20 million and gets to raise .com prices again
- ICANN predicts shrinkage in new gTLD sector
- ASO uses super powers to demand ICANN turn over .org buyout docs
- Now PIR rubbishes .org “downtime” claims
- DI Leaders Roundtable #4 — Big predictions for 2020
- Afilias denies .org will go down post-acquisition
- Palestine to release all one-character .ps domains, at a price
- PIR thinks 20-year domain regs are a good idea
- Amazon beats South America! Dot-brand contracts now signed
- Q3 industry growth driven by .tk, .com and .icu
- ICANN throws out second .org appeal, so URS stays
- Warning (or threat?) prices must go up or .org will suffer DAYS of downtime
- Russian company approved as gTLD escrow provider
- Guy gets 14 years for trying to steal a domain with a gun
- GoDaddy girls often make more money than the men
- Non-coms want .org’s future carved in stone
- Kamel’s deputy gets promoted at ICANN
- ICANN delays approval of .org acquisition
- AlpNames died months ago. Why is it still the “most-abused” registrar?
- Ethos promises to keep .org for many many many many years
- Amid .org controversy, Cerf predicts the death of all domains
Reports: .gov fails due to DNSSEC error
Kevin Murphy,
August 14, 2013, 17:34:34 (UTC),
Domain Tech
The .gov top-level domain suffered a DNSSEC problem today and was unavailable to some internet users, according to reports.
According to mailing lists and the SANS Internet Storm Center, it appeared that .gov rolled one of its DNSSEC keys without telling the root zone about the update.
This meant that anyone whose DNS servers do strict DNSSEC validation — a relatively small number of networks — would have been unable to access .gov web sites, email and other resources.
As a matter of policy, all second-level .gov domains have to be DNSSEC-signed.
The problem was corrected quite quickly — looks like within an hour or two — but as SANS noted, caching issues may prolong the impact.
Both .gov and the root zone are managed by Verisign, which isn’t on the best of terms with the US government at the moment.
It is ironic that the very initiatives that are supposed to help security have introduced errors into the system, while those that are identified as likely to produce errors — for instance, the introduction of new gTLDs, in the context of name collision issues — have produced none.
The DNSSEC problem — that of needing a chain of trust to make it effective — has been frequently raised by registrars and others. This shouldn’t have been a surprise to anyone.
What is does show is that *if* there is a problem, it can be addressed quickly and without major repercussions. That is true of DNSSEC or of name collision. The ICANN staff obsession with risk — that is, in preventing *all* risk, rather than assessing its probability, severity, and ease of mitigation — seems to be limited to those areas where the ICANN corporation faces some liability. In contrast, ICANN appears to be blandly unconcerned in areas where they could have done something (I’m thinking of better planning and communication rolling out DNSSEC), but where they unlikely to be identified as a culprit.
ICANN needs some real risk assessment capabilities, instead of relying on risk assessment from a legal perspective, which typically is satisfied only with 0% risk — which is not a real-world position to take, especially in a field as fast moving, and as filled with so many unknowns as the Internet. They would then be able to communicate honestly to the world as to why they take certain positions, instead of pointing helplessly at nebulous unknowns. If ICANN *really* wants to secure the security and stability of Internet, it’s going to need to take risks — calculated ones. There is no zero-risk scenario where ICANN is effective.
Antony
Problem started somewhere between 2013-08-14 08:51:41 UTC and 2013-08-14 12:26:40 UTC. It persisted at least until 2013-08-14 13:49:03 UTC.
.gov DNSSEC snapshots:
http://dnsviz.net/d/gov/UgtFHg/dnssec/
http://dnsviz.net/d/gov/Ugt3gQ/dnssec/
http://dnsviz.net/d/gov/UguK0A/dnssec/
http://dnsviz.net/d/gov/UguRGg/dnssec/
Everything involves risk. Crossing the street involves risk. We humans are constantly assessing the risk vs the benefit.
Shall I cross this slightly trafficked street (very small probability but risk of very bad event happening – death) to make my meeting on time (some benefit)?
We have to assess not only 1) the risk (chance of it happening) but 2) the magnitude of the potential harm, and 3) the magnitude of the benefit.
In the DNSSEC case, the probability of a negative event happening is non-zero (as this event shows), the magnitude of the bad event is medium and the benefit is medium.
The benefits to DNSSEC outweigh the risks. But make no mistake, there are risks to implementing DNSSEC. In fact, comparing DNSSEC and new TLDs, the change DNSSEC imposed on the DNS is much much larger than the change that new TLDs impose on the DNS.
Therefore the risks to implementing DNSSEC is much larger than the risk of new TLDs.
Comparing the benefits of the two, there are net benefits that DNSSEC brings to the world (more security), but the net benefits that new TLDs bring are even larger (competition, innovation, etc).
So we, the ICANN community, implemented DNSSEC even thought the risks are more (more change to the DNS) and the benefits are less than new TLDs.
“Name collisions” have a non-zero probability of happening, true (they happen every day in .com for example). But the consequence of a “name collision” is small (in my opinion very small, which is why we allow them to happen in .com) and the benefits brought by new TLDs, such as .home and .corp are big.
The v6 and DNSSEC evangelicals successfully added their pet causes as mandatory-to-implement by new gTLD operators, even if (a) located where native v6 is not available and/or (b) for use models lacking valuable targets (e.g., community-based applications).
These new operators are compelled to waste resources on v4 exhaustion & security theater, and are likely to make more mistakes than experienced, highly capitalized operators.
I differ from Antony and Paul, who offer specific comparisons of argued risk, and offer, as a general error of staff the insertion of the v6 and DNSSEC requirements for new registry operators, for which little value at start-up (years 1-5) can be offered.
There is a chicken-and-egg situation happening with both IPv6 and DNSSEC that requires the industry to adopt those even its numbers would indicate otherwise. I think ICANN was right in requiring those to be deployed, but it could have lessened such burden by indicating that IPv6 tunneling was OK (it’s possible to get tunneled-IPv6 for free) and providing DNSSEC capacity building as another avenue of applicant support.