Latest news of the domain name industry

Recent Posts

Bulgaria polls public for Cyrillic TLD ideas

The Bulgarian government is asking its people what Cyrillic top-level domain it should ask for if ICANN refuses to reverse its rejection of .бг.

The Ministry of Transport, Communications and Information Technology has published a poll on its web site, presenting four options for an IDN ccTLD.

Its first choice, .бг, was rejected by ICANN/IANA in May due to its visual similarity to another ccTLD, believed to be Brazil’s .br.

The four new options are .бгр, .българия, .бя and .бъл.

Bulgarians can also vote for “nothing but .бг” or declare that they do not want a Cyrillic domain at all.

The poll page, via Google Translate, suggests that the Ministry is prepared to wait for another opportunity to apply for .бг or for an ICANN appeals process to be created, if that’s what the public wants.

The Minister had previously promised to appeal the rejection of .бг.

(First reported by Novinite.)

Chinese TLDs now live, broad adoption achieved in just seven days

Check it out: 教育部。中国.

That’s one, but by no means the only, of the first live, fully Chinese-script domain names. It’s China’s Ministry of Education.

Previously, it had been announced that the .中国 internationalized country-code TLD would not go live until August.

But on Friday CNNIC said that 90% of China’s ministries have got their .中國 domains already, along with 95% of news websites, 90% of universities and 40% of China’s Top 500 enterprises.

Not only was that level of adoption achieved very quietly, it was also achieved very quickly. According to IANA, .中國 was delegated just seven days earlier, on July 9.

IANA also reports that .中國, the IDN for Hong Kong went live on July 12. Taiwan’s .中國 was delegated on July 14.

All of these Chinese-script TLDs were approved by ICANN’s board at the conclusion of the Brussels meeting last month.

It’s perhaps not surprising that ICANN did not broadly announce the latest delegations. It got burnt for pre-empting Arab nations’ publicity when the first IDN TLDs went live in May.

I wonder whether this will help CNNIC reverse the trend of declining registrations in its namespace. According to the latest statistics, the .cn has halved in size over the last year.

Bulgaria to file ICANN reconsideration appeal over rejected IDN ccTLD

Bulgaria is to appeal ICANN’s rejection of .бг, the Cyrillic version of its existing country code top-level domain, .bg.

Technology minister Alexander Tsvetkov said that the Bulgarian government will file a reconsideration request with ICANN, according to a DarikNews.bg interview.

The requested IDN ccTLD .бг was rejected because it looks quite a bit like Brazil’s existing ASCII ccTLD, .br, which could create confusion for Brazilians.

ICANN/IANA does not talk openly about ccTLD delegation issues. As far as I know, .бг is the only IDN ccTLD on the current fast-track program to be rejected on string-similarity grounds.

The Darik News interview, via Google Translate, reports Tsvetkov saying he “believes that this domain is the best way for Bulgaria” and that the government “will ask for reconsideration”.

Asked about the clash with Brazil, he said Bulgaria “will not quit” in its pursuit of its first-choice ccTLD.

Brazil has not been silent on the issue.

During the meeting on Tuesday between the ICANN board and its Governmental Advisory Committee, Brazil’s representative praised ICANN for rejecting .бг:

Brazil would like to express its support to the recent board’s decision about avoiding graphic similitude between new country codes and current country codes in Latin. This is particularly important inasmuch as any graphic confusion might facilitate phishing practices and all the problems related to it.

Many thanks to the Bulgarian reader who referred me to this Darik News interview.

For any other Bulgarians reading this, the interview also appears to contain lots of other really juicy information not related to domain names. Check it out.

ICANN staff need to get their pee tested

Kevin Murphy, June 8, 2010, Domain Tech

I imagine it’s a pretty hard job, largely thankless, working at ICANN. No matter what you do, there’s always somebody on the internet bitching at you for one reason or another.

The job may be about to get even more irksome for some staffers, if ICANN decides to implement new security recommendations made by risk management firm JAS Communications.

In a report published yesterday, JAS suggests that senior IANA staff – basically anyone with critical responsibilities over the DNS root zone – should be made to agree to personal credit checks, drug screening and even psych evaluations.

To anyone now trying to shake mental images of Rod Beckstrom peeing into a cup for the sake of the internet, I can only apologise.

This is what the report says:

JAS recommends a formal program to vet potential new hires, and to periodically re‐vet employees over time. Such a vetting program would include screening for illegal drugs, evaluation of consumer credit, and psychiatric evaluation, which are all established risk factors for unreliable and/or malicious insider activity and are routinely a part of employee screening in government and critical infrastructure providers.

I’ve gone for the cheap headline here, obviously, but there’s plenty in this report to take seriously, if you can penetrate the management consultant yadda yadda.

There are eight other recommendations not related to stoners running the root, covering contingencies such as IANA accidentally unplugging the internet and Los Angeles sinking into the Pacific.

Probably most interesting of all is the bit explaining how ICANN’s custom Root Zone Management System software, intended to reduce the possibility of errors creeping into the root after hundreds of new TLDs are added, apparently isn’t being built with security in mind.

“No formal requirements exist regarding the security and resiliency of these systems, making it impossible to know whether the system has been built to specification,” the report says.

It also notes that ICANN lacks a proper risk management strategy, and suggests that it improve communications both internally and with VeriSign.

It discloses that “nearly all critical resources are physically located in the greater Los Angeles area”, which puts the IANA function at risk of earthquake damage, if nothing else.

JAS recommends spreading the risk geographically, which should give those opposed to ICANN bloat something new to moan about.

There’s a public comment forum over here.

UPDATE (2010-06-13): As Michael Palage points out over at CircleID, ICANN has pulled the PDF from its web site for reasons unknown.

On the off-chance that there’s a good security reason for this, I shall resist the temptation to cause mischief by uploading it here. This post, however, remains unedited.

Four of the top 100 brands have insecure domain names

Kevin Murphy, May 26, 2010, Domain Tech

Some of the world’s most famous global brands have domain names that are still vulnerable to the Kaminsky exploit and could be hijacked by others.

Earlier today, I ran all of the brands on Deloitte’s list of the top 100 brands through a vulnerability testing tool provided by IANA.

The results show that four of these brands – all household names – have domains classed as “highly vulnerable” to the Kaminsky exploit.

If the IANA test is reliable, this means that false data could be injected into their name servers, potentially redirecting users to a web site belonging to the attacker.

Another eight brands had domains that the IANA tool reported might be “vulnerable” to attacks, but which had measures in place to mitigate the risk.

The Kaminsky bug has been public for almost two years. It’s a cache poisoning attack in which a recursive name server is tricked into providing false data about a domain.

It becomes particularly scary when a domain’s authoritative name servers also have their recursive functions turned on. A successful attack could redirect all traffic to a compromised domain to a server managed by the attacker.

The surest way to avoid vulnerability is to turn off recursion. IANA says: “Authoritative name servers should never be configured to provide recursive name service.”

Alternatively, a method known as source port randomization can make the risk of being compromised by the Kaminsky exploit so small it’s barely a threat at all.

The IANA tool reports that four of the top 100 brands have at least one “highly vulnerable” authoritative name server that has recursion enabled and no source port randomization.

The other eight “vulnerable” domains were identified as running on at least one authoritative server that had recursion turned on and source port randomization enabled.

I’m not an expert, but I don’t believe this second category of companies has a great deal to worry about in terms of Kaminsky.

I picked the Deloitte brand list for this experiment because it is the list of brands Deloitte believes require the most trademark protection under ICANN’s new TLD process.

.CO Internet is already using the list during its sunrise period for the .co domain.

Michele Neylon of Blacknight has found some more vulnerable servers over here.