Latest news of the domain name industry

Recent Posts

ICANN’s Draft Applicant Guidebook v4 – first reactions

Kevin Murphy, June 1, 2010, Domain Policy

As you probably already know, ICANN late yesterday released version 4 of its Draft Applicant Guidebook, the bible for new top-level domain registry wannabes.

Having spent some time today skimming through the novel-length tome, I can’t say I’ve spotted anything especially surprising in there.

IP interests and governments get more of the protections they asked for, a placeholder banning registries and registrars from owning each other makes its first appearance, and ICANN beefs up the text detailing the influence of public comment periods.

There are also clarifications on the kinds of background checks ICANN will run on applicants, and a modified fee structure that gets prospective registries into the system for $5,000.

DNSSEC, security extensions for the DNS protocol, also gets a firmer mandate, with ICANN now making it clearer that new TLDs will be expected to implement DNSSEC from launch.

It’s still early days, but a number of commentators have already given their early reactions.

Perennial first-off-the-block ICANN watcher George Kirikos quickly took issue with the fact that DAG v4 still does not include “hard price caps” for registrations

[The DAG] demonstrates once again that ICANN has no interests in protecting consumers, but is merely in cahoots with registrars and registries, acting against the interests of the public… registry operators would be open to charge $1000/yr per domain or $1 million/yr per domain, for example, to maximize their profits.

Andrew Allemann of Domain Name Wire reckons ICANN should impose a filter on its newly emphasised comment periods in order to reduce the number of form letters, such as those seen during the recent .xxx consultation.

I can’t say I agree. ICANN could save itself a few headaches but it would immediately open itself up to accusations of avoiding its openness and transparency commitments.

The Internet Governance Project’s Milton Mueller noted that the “Draconian” text banning the cross-ownership of registries and registrars is basically a way to force the GNSO to hammer out a consensus policy on the matter.

Everyone knows this is a silly policy. The reason this is being put forward is that the VI Working Group has not succeeded in coming up with a policy toward cross-ownership and vertical integration that most of the parties can agree on.

I basically agree. It’s been clear since Nairobi that this was the case, but I doubt anybody expected the working group to come to any consensus before the new DAG was drafted, so I wouldn’t really count its work as a failure just yet.

That said, the way it’s looking at the moment, with participants still squabbling about basic definitions and terms of reference, I doubt that a fully comprehensive consensus on vertical integration will emerge before Brussels.

Mueller lays the blame squarely with Afilias and Go Daddy for stalling these talks, so I’m guessing he’s basing his views on more information than is available on the public record.

Antony Van Couvering of prospective registry Minds + Machines has the most comprehensive commentary so far, touching on several issues raised by the new DAG.

He’s not happy about the VI issue either, but his review concludes with a generally ambivalent comment:

Overall, this version of the Draft Applicant Guidebook differs from the previous version by adding some incremental changes and extra back doors for fidgety governments and the IP interests who lobby them. None of the changes are unexpected or especially egregious.

DAG v4 is 312 pages long, 367 pages if you’re reading the redlined version. I expect it will take a few days before we see any more substantial critiques.

One thing is certain: Brussels is going to be fun.

3 Comments Tagged: , , , , , , , , , , , , ,

ICANN’s Sword algorithm fails Bulgarian IDN test

ICANN has released version 4 of its new TLD Draft Applicant Guidebook (more on that later) and it still contains references to the controversial “Sword” algorithm.

As I’ve previously reported, this algorithm is designed to compare two strings for visual similarity to help prevent potentially confusing new TLDs being added to the root.

The DAG v4 contains the new text:

The algorithm supports the common characters in Arabic, Chinese, Cyrillic, Devanagari, Greek, Japanese, Korean, and Latin scripts. It can also compare strings in different scripts to each other.

So I thought I’d check how highly the internationalized domain name .бг, the Cyrillic version of Bulgaria’s .bg ccTLD, scores.

As you may recall, .бг was rejected by ICANN two weeks ago due to its visual similarity to .br, Brazil’s ccTLD. As far as I know, it’s the only TLD to date that has been rejected on these grounds.

Plugging “бг” into Sword returns 24 strings that score over 30 out of 100 for similarity. Some, such as “bf” and “bt”, score over 70.

Brazil’s .br is not one of them.

Using the tool to compare “бг” directly to “br” returns a score of 26. That’s a lower score than strings such as “biz” and “org”.

I should note that the Sword web page is ambiguous about whether it is capable of comparing Cyrillic strings to Latin strings, but the new language in the DAG certainly suggests that it is.

6 Comments Tagged: , , , , , , , ,

Google blocks Go Daddy for ‘hosting malware’

(UPDATED) Google is currently blocking Go Daddy’s web site, calling it dangerous, because one of its image-hosting domains has been flagged for hosting malware.

Chrome users visiting pages on godaddy.com, including its storefront, currently see the standard Google alert page: “Warning: Visiting this site may harm your computer!”

Go Daddy’s main page seems to be affected because it uses images hosted at img5.wsimg.com, a Go Daddy domain.

A bit of a poke around reveals that the whole of wsimg.com is currently considered a malware site by Google’s toolbar on non-Chrome browsers, and also by the Google search engine.

The question is, of course, whether this is a simple false positive or whether bad guys have somehow managed to inject malware onto Go Daddy’s servers.

Go Daddy’s web site takes revenue in the six figures every hour, so if this is a false positive I can only imagine the content of the phone calls between Scottsdale and Mountain View right now.

But Go Daddy has been a target for the bad guys in recent weeks, with attacks against its hosting customers proving an irritant that the company can’t seem to shake off.

The company was also the victim of a phishing attack yesterday. I’d be surprised if the two incidents are connected.

UPDATE: Warren Adelman, Go Daddy’s chief operating officer, just called to say that this was indeed a false positive.

“Google erroneously flagged some of our image servers,” he said. “We need to go into this with Google, but there wasn’t any malware on our end.”

Adelman said Go Daddy has a pretty good idea what happened, but that it proved hard to get hold of the relevant people at Google on a Sunday morning during Memorial Day weekend.

Further details may be forthcoming later this week. For now, Google has apparently unflagged the servers in question, and Adelman expects the situation to be resolved within the hour.

6 Comments Tagged: , , , , , , ,

Coupons.info sells for over $17,000

Kevin Murphy, May 27, 2010, Domain Sales

Go Daddy might be currently giving away .info domains as freebies when you buy a .com, but that doesn’t mean they’re all worthless.

Coupons.info has just sold through Sedo auction for $17,600, easily the priciest recent .info sale I can recall.

It looks as if the transaction closed yesterday, with the domain now redirecting to its new owner’s existing site at allcouponsdirect.com.

The seller had held a reserve price of $7,000, so I’m guessing he’s a happy bunny today.

Comment Tagged: , , ,

Could litigation delay ICANN’s new TLDs?

Intellectual property lawyers are wondering aloud about the possibility of ICANN being sued in order to delay the launch of new top-level domains.

The idea was raised during a panel at the annual meeting of INTA, the International Trademark Association, in Boston yesterday, according to its daily newsletter (pdf).

Kristina Rosette of the law firm Covington & Burling reportedly “suggested litigation is a possibility to slow down the application launch. One source of litigation could be trademark owners, worried about mass cybersquatting”.

That’s reported speech, by the way, not a quote. The article does not make clear the context.

Rosette is Intellectual Property Constituency representative for North America on ICANN’s GNSO Council.

The IP community is worried that the launch of new TLDs will lead to companies splurging more money unnecessarily on defensive registrations.

The current best, arguably most optimistic guess on the new TLD timeline comes from registry hopeful Minds + Machines. M+M has applications opening next April.

A delay in the launch of new TLDs would hurt most the startup companies that intend to apply for them, and the service providers and consultants hoping to facilitate the launches.

Some of these companies make minimal revenue, are dependent on funding, and would prefer applications open sooner rather than later.

3 Comments Tagged: , , , , , ,

Symantec gets into the DNS game with Dyn

Kevin Murphy, May 27, 2010, Domain Tech

Symantec has partnered with Dyn to offer a free DNS service to mobile Norton users.

As part of its new mobile strategy, expected to be announced later today, Symantec will provide free DNS resolution with a built-in filter that blocks potentially dangerous domains.

Dyn.com will provide the back-end, which will compete with the likes of OpenDNS and Google’s DNS service.

Non-technical users will be able to download a client application that configures their local DNS to work with the service, which drops one barrier to entry.

Symantec reportedly expects to earn revenue from advertising links – presumably by intercepting NXDOMAIN responses and providing sponsored error pages.

So the deal could be a bit of a money-spinner for Dyn; it’s certainly a further validation of its service.

But is it sexy? Hmm…

Comment Tagged: , , , , , ,

VeriSign announces bizarre ‘.com 25’ award winners

Kevin Murphy, May 26, 2010, Gossip

As part of its 25th anniversary of .com celebrations, VeriSign has today announced the 25 winners of its “.com 25” award.

The award was given to “the 25 people and/or companies whose inspiring contributions were fundamental in shaping the Internet and, thereby, our worlds”, VeriSign said.

The winners all seem to deserve the recognition, even if one of them, craigslist, is technically a .org.

But looking at the 75 nominees the judging panel had to choose from, I’m scratching my head on at least half a dozen of them.

What is Zappos? What does Pandora do? Why is Muhammad Yunus on the list? What on earth is TheKnot.com?

And where are Jon Postel and Paul Mockapetris, who between them basically created the domain name system in the first place?

It’s a little disappointing that the only European with a gong appears to be web inventor Tim Berners-Lee. It’s even more disappointing that I can’t think of any other deserving Europeans.

The full list of winners can be found here.

1 Comment Tagged: , , , , , ,

E.co up for charity auction at Sedo

Kevin Murphy, May 26, 2010, Domain Sales

Sedo is to host a charity auction for the domain name e.co, under a deal with .CO Internet, manager of the newly relaunched Colombian ccTLD.

The auction will run from June 7 to June 10, with the final hour hosted live at the Internet Week show in New York, simultaneously webcast to the Internet Retailer and TRAFFIC conferences.

The winner of the auction gets to choose which charity the sale price is donated to.

Juan Diego Calle, CEO of the registry, said e.co is “perhaps the shortest, most memorable digital brand in the world”, which is hard to argue with.

You’ve got to hand it to .CO Internet, and to its PR outfit BM, they’re doing a hell of a job keeping the pre-launch .co buzz going. New TLD applicants take note.

Could we see seven figures? It seems quite possible.

Let’s hope the winning bidder throws the money at a worthy cause and doesn’t blow it on a donkey sanctuary or something.

Comment Tagged: , , , , , , ,

Four of the top 100 brands have insecure domain names

Kevin Murphy, May 26, 2010, Domain Tech

Some of the world’s most famous global brands have domain names that are still vulnerable to the Kaminsky exploit and could be hijacked by others.

Earlier today, I ran all of the brands on Deloitte’s list of the top 100 brands through a vulnerability testing tool provided by IANA.

The results show that four of these brands – all household names – have domains classed as “highly vulnerable” to the Kaminsky exploit.

If the IANA test is reliable, this means that false data could be injected into their name servers, potentially redirecting users to a web site belonging to the attacker.

Another eight brands had domains that the IANA tool reported might be “vulnerable” to attacks, but which had measures in place to mitigate the risk.

The Kaminsky bug has been public for almost two years. It’s a cache poisoning attack in which a recursive name server is tricked into providing false data about a domain.

It becomes particularly scary when a domain’s authoritative name servers also have their recursive functions turned on. A successful attack could redirect all traffic to a compromised domain to a server managed by the attacker.

The surest way to avoid vulnerability is to turn off recursion. IANA says: “Authoritative name servers should never be configured to provide recursive name service.”

Alternatively, a method known as source port randomization can make the risk of being compromised by the Kaminsky exploit so small it’s barely a threat at all.

The IANA tool reports that four of the top 100 brands have at least one “highly vulnerable” authoritative name server that has recursion enabled and no source port randomization.

The other eight “vulnerable” domains were identified as running on at least one authoritative server that had recursion turned on and source port randomization enabled.

I’m not an expert, but I don’t believe this second category of companies has a great deal to worry about in terms of Kaminsky.

I picked the Deloitte brand list for this experiment because it is the list of brands Deloitte believes require the most trademark protection under ICANN’s new TLD process.

.CO Internet is already using the list during its sunrise period for the .co domain.

Michele Neylon of Blacknight has found some more vulnerable servers over here.

3 Comments Tagged: , , , , ,

dotSport complains to ICANN about other .sports

One of the companies that intends to apply for the .sport top-level domain has written to ICANN, begging that it does not approve any TLDs for individual sports.

dotSport’s Policy Advisory Committee, which appears to think it already has rights in the .sport string, said ICANN should respect “sport solidarity”.

In other words, please don’t allow .tennis or .golf to be approved.

The company wrote:

The PAC members reiterate our concern that ICANN may be prematurely entertaining a process that will allow proliferation of names in sub-categories or individual sports, which will lead to a number of detrimental effects

The detrimental effects, referenced in this letter last August, basically boil down to the potential for user confusion and the need for defensive registrations by sports teams and personalities.

You could apply the same arguments to pretty much any potential new TLD – what would .music mean for the .hiphop community?

The dotSport PAC is filled with high-level appointees from more than half a dozen sports federations, representing sports from basketball to rugby to archery, so its views are far from irrelevant.

Its position appears to be that the DNS hierarchy should be used for taxonomic purposes, at least when it comes to sports.

It’s an argument that was floated all the way back in the 2000 round of TLD applications, and probably before.

Purely from a marketing point of view, it seems like a self-defeating objective to mandate the use of www.example.hockey.sport when www.example.hockey is an option.

The main example of such a mandatory multi-level taxonomy, the old-style .us ccTLD, was a spectacular commercial failure.

Could it be that dotSport wants to be the registry for all .sports for the price of one? It certainly appears that way.

2 Comments Tagged: , , , ,