Latest news of the domain name industry

Recent Posts

ICANN found a zero-day hole in Adobe Connect

Kevin Murphy, April 23, 2018, Domain Tech

It’s looking like ICANN may have found a zero-day vulnerability in Adobe Connect, until recently its default collaboration tool.

The organization on Friday announced the results of a “forensic investigation” into the bug, and said it has reported its findings to Adobe, which is now “working on a software fix to address the root cause of the issue”.

If Adobe didn’t know about it, it looks rather like ICANN — or at least the unnamed member of the security advisory committee who found it — has bagged itself a zero-day.

ICANN had previously said that the glitch “could possibly lead to the disclosure of the information shared in an ICANN Adobe Connect room”.

The review found that the only person who exploited the bug was the person who discovered and disclosed it.

AC is used not only in ICANN’s public meetings but also, I understand, in closed sessions of ICANN staff, board and committees, where secret information is most likely to be shared.

After the bug was discovered, ICANN shut off the system and started using alternatives such as WebEx, to a mixed reception.

In the absence of an immediate patch from Adobe, ICANN has been testing workarounds and said it hopes to have two working ones deployed by May 3.

This would allow the tool to come back online in time for its board workshop, GDD Summit and ICANN 62, the organization said.

Some men at ICANN meetings really are assholes

Kevin Murphy, March 24, 2018, Domain Policy

Several men have been accused of sexual harassment at ICANN meetings.

A group of women have written to ICANN with five stories of how they were groped, intimidated, objectified or otherwise harassed in violation of not only common decency but also ICANN’s year-old anti-harassment policy.

They’ve not named the alleged harassers, but hinted that they may do so in future.

If we assume the stories are all the unembellished truth — and we kinda have to nowadays — then the behavior described is unambiguously out of order.

Fortunately, none of the allegations rise to the level of the obviously seriously criminal. In these cases we appear to be talking more Hoffman than Weinstein.

But we’re not talking about bizarro Cheesesandwichgate-level interactions either. The stories allege groping, simulated sexual activity, and physical restraint, among other things.

In one allegation, a woman claims a drunk man touched her rear during a social interaction.

In another, a man is alleged to have attempted to let himself into a woman’s hotel room, prompting her to block the door from the inside with a chair, after his earlier advances were rebuffed.

Another woman claims a man she had never met chose, as his opening conversational gambit, to compliment her appearance and inquire after her marital status — during a daytime coffee break for crying out loud — and then grabbed her waist and wrists to prevent her from leaving.

“If you want to start a conversation, ask what I do, what do I work with and why am I here,” the woman is quoted as saying. “Do not acknowledge physical attributes and reduce me to this.”

“If you want to talk to women in a professional setting, do not tighten her wrists, do not grab her waist. Do not ask whether she is married or not,” she said. “Regardless, you should respect her integrity, not her marital status.”

Another man is accused of simulating a sex position with a woman during a cocktail event.

A fifth is accused of “body-blocking” a woman as she attempted to leave a room.

The letter states:

These actions which are definitely categorized as harassment and even assault, would not only affect the woman who went through the incident but it would also lead to several probable repercussions such as (1) Her withdrawal from the community and physical presence. We all know how important being present in meetings is on different levels of engagement in and outside meetings (2) When no solid response from the community is done towards the harasser, there can definitely be an increase in aggressive characters of harassers as there would be no accountability to stop them (3) With the increase in harassment there surely will be a decrease in the representation of young women’s voices in any proceeding which defies the core concept of diversity.

The letter (pdf) is unsigned, and ICANN broke with its usual practice of listing the sender on the correspondence page of its web site.

The letter also does not name any of the accused men, but it and a related comment from a group of women at the public forum at ICANN 61 last week, said the women “refrain from using names for now, in order to keep the focus on the topic and not the person”.

It’s been DI practice to not name either party concerned in such allegations, even when we know who they are.

While the anti-harassment policy exists to deal precisely with the kinds of behaviors outlined in the letter, we reported in November that the ICANN Ombudsman had received no complaints whatsoever invoking the policy, even after the post-Weinstein sea change in workplace sexual politics.

But the letter-writers say this is because the current Ombudsman, Herb Weye, is a man, and women are sometimes reluctant to report such incidents to a man. The letter states:

There should be a woman ombudsperson for harassment reporting. It has been proven by several studies that given the sensitivity of the issue, harassment reports are more prone to be tackled and come forth with, when the ombudsperson is (a) a woman (b) an expert in gender-related issues and mitigating harassment risks

They’re also not confident that the policy, which has yet to be tested, will cause more good than harm.

They also want all ICANN meeting delegates to read the harassment policy as a condition for attendance, and for signage at the meetings to warn against inappropriate behavior.

In response to the public forum comments, ICANN vice-chair Chris Disspain promised that the board will respond to the women’s letter, adding that the Ombudsman is taking a look at how the harassment policy has been implemented.

“It’s very important that ICANN is a safe place for everyone,” chair Cherine Chalaby told the women. “The more we raise awareness, the more it is safe.”

The message to certain blokes at ICANN meetings seems pretty clear: stop being assholes.

Like most places of work, the ICANN community is resplendent with examples of people forming lasting romantic relationships — or even just getting laid — but none of them began with a man grabbing a woman’s backside without her consent.

Privacy could be a million-dollar business for ICANN

Kevin Murphy, March 22, 2018, Domain Registrars

ICANN has set out the fees it plans to charge to officially accredit Whois proxy and privacy services, in the face of resistance from some registrars.

VP of finance Becky Nash told registrars during a session at ICANN 61 last week that they can expect to pay $3,500 for their initial accreditation and $4,000 per year thereafter.

Those are exactly the same fees as ICANN charges under its regular registrar accreditation program.

Registrars that also offer privacy should expect to see their annual ICANN flat fees double, in other words. Per-domain transaction fees would be unaffected.

The up-front application fee would be reduced $2,000 when the privacy service is to be offered by an accredited registrar, but it would stay at $3,500 if the company offering service is merely “affiliated” with the registrar.

Nash said all the fees have been calculated on a per-accreditation basis, independent of the volume of applications ICANN receives.

Director of registrar services Jennifer Gore said that while ICANN has not baked an estimate of the number of accredited providers into its calculations, registrars have previously estimated the number at between 200 and 250 companies.

That would put the upper end of annual accreditation fees at $1 million, with $875,000 up-front for initial applications.

Volker Greimann, general counsel of the registrar Key-Systems, pointed out during the session that many registrars give away privacy services for free or at cost.

“This just adds cost to an already expensive service that does not really make money for a lot of providers,” he said.

He suggested that the prices could lead to unexpected negative consequences.

“Pricing this in this region will just lead to a lot of unaccredited providers that will switch names every couple months, an underground that we don’t really want,” he said. “We want to have as many people on board as possible and the way to do that is to keep costs low.”

“Pricing them out of the market is not the way to attract providers to join this scheme,” he said.

Nash responded that registrars are forbidden under the incoming privacy/proxy policy from accepting registrations from unaccredited services.

She added that the fees have been calculated on a “cost-recovery” basis. Costs include the initial background checks, outreach, contract admin, compliance, billing and so on.

But some registrars expressed skepticism that the proposed fees could be justified, given that ICANN does not plan to staff up to administer the program.

Another big question is whether proxy/privacy services are going to continue to have value after May this year, when the European Union’s General Data Protection Regulation kicks in.

The current ICANN plan for GDPR compliance would see individual registrants have all of their private information removed from the public Whois.

It’s not currently clear how many people and what kinds of people will continue to have access to unmasked Whois, so there are likely still plenty of cases where individuals might feel they need an extra layer of protection — if they live in a dictatorship and are engaged in rebellious political speech, for example.

There could also be cases where companies wish to mask their details ahead of, say, a product launch.

And, let’s face it, bad actors will continue to want to use privacy services on domains they intend to misuse.

The proxy/privacy policy came up through the formal GNSO Policy Development Process and was approved two years ago. It’s currently in the implementation phase.

According to a presentation from the ICANN 61 session, ICANN hopes to put the final implementation plan out for public comment by the end of the month.

Is ICANN over-reacting to Whois privacy law?

Kevin Murphy, March 20, 2018, Domain Policy

Is ICANN pushing the domain industry to over-comply with the European Union’s incoming General Data Protection Regulation privacy law?

Governments and plenty of intellectual property and business lobbyists think so.

After days of criticism from unhappy IP lawyers, ICANN’s public meeting in Puerto Rico last week was capped with a withering critique of the organization’s proposed plan for the industry to become GDPR compliant as pertains Whois.

The Governmental Advisory Committee, in unusually granular terms, picked apart the plan in its usual formal, end-of-meeting advice bomb, which focused on making sure law enforcement and IP owners continue to get unfettered Whois access after GDPR kicks in in May.

Key among the GAC’s recommendations (pdf) is that the post-GDPR public Whois system should continue to publish the email address of each domain registrant.

Under ICANN’s plan — now known as the “Cookbook” — that field would be obscured and replaced with a contact form or anonymized email address.

The GAC advised ICANN to “reconsider the proposal to hide the registrant email address as this may not be proportionate in view of the significant negative impact on law enforcement, cybersecurity and rights protection;”.

But its rationale for the advice is a little wacky, suggesting that email addresses under some unspecified circumstances may not contain “personal data”:

publication of the registrant’s email address should be considered in light of the important role of this data element in the pursuit of a number of legitimate purposes and the possibility for registrants to provide an email address that does not contain personal data.

That’s kinda like saying your mailing address and phone number aren’t personal data, in my view. Makes no sense.

The GAC advice will have won the committee friends in the Intellectual Property Constituency and Business Constituency, which throughout ICANN 61 had been pressuring ICANN to check whether removing email addresses from public Whois was strictly necessary.

ICANN is currently acting as a non-exclusive middleman between community members and the 20-odd Data Protection Authorities — which will be largely responsible for enforcing GDPR — in the EU.

It’s running compliance proposals it compiles from community input past the DPAs in the hope of a firm nod, or just some crumbs of guidance.

But the BC and IPC have been critical that ICANN is only submitting a single, rather Draconian proposal — one which would eschew email addresses from the public Whois — to the DPAs.

In a March 13 session, BC member Steve DelBianco pressed ICANN CEO Goran Marby and other executives and directors repeatedly on this point.

“If they [the DPAs] respond ‘Yes, that’s sufficient,’ we won’t know whether it was necessary,” DelBianco said, worried that the Cookbook guts Whois more than is required.

ICANN general counsel John Jeffrey conceded that the Cookbook given to the DPAs only contains one proposal, but said that it also outlines the “competing views” in the ICANN community on publishing email addresses and asks for guidance.

But email addresses are not the only beef the GAC/IPC/BC have with the ICANN proposal.

On Thursday, the GAC also advised that legal entities that are not “natural persons” should continue to have their full information published in the public Whois, on the grounds that GDPR only applies to people, not organizations.

That’s contrary to ICANN’s proposal, which for pragmatic reasons makes no distinction between people and companies.

There’s also the question of whether the new regime of Whois privacy should apply to all registrants, or just those based in the European Economic Area.

ICANN plans to give contracted parties the option to make it apply in blanket fashion worldwide, but some say that’s overkill.

Downtime for Whois?

While there’s bickering about which fields should be made private under the new regime, there doesn’t seem to be any serious resistance to the notion that, after May, Whois will become a two-tier system with a severely depleted public service and a firewalled, full-fat version for law enforcement and whichever other “legitimate users” can get their feet in the door.

The problem here is that while ICANN envisions an accreditation program for these legitimate users — think trademark lawyers, security researchers, etc — it has made little progress towards actually creating one.

In other words, Whois could go dark for everyone just two months from now, at least until the accreditation program is put in place.

The GAC doesn’t like that prospect.

It said in its advice that ICANN should: “Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties”.

But ICANN executives said in a session on Thursday that the org plans to ask the DPAs for a deferral of enforcement of GDPR over Whois until the domain industry has had time to come into compliance while continuing to grant access to full Whois to police and special interests.

December appears to be the favored date for this proposed implementation deadline, but ICANN is looking for feedback on its timetable by this coming Friday, March 23.

But the IPC/BC faction are not stting on their hands.

Halfway through ICANN 61 they expressed support for a draft accreditation model penned by consultant Fred Felman, formerly of brand protection registrar MarkMonitor.

The model, nicknamed “Cannoli” (pdf) for some reason, unsurprisingly would give full Whois access to anyone with enough money to afford a trademark registration, and those acting on behalf of trademark owners.

Eligible accreditees would also include security researchers and internet safety organizations with the appropriate credentials.

Once approved, accredited Whois users would have unlimited access to Whois records for defined purposes such as trademark enforcement or domain transfers. All of their queries would be logged and randomly audited, and they could lose accreditation if found to be acting outside of their legitimate purpose.

But Cannoli felt some resistance from ICANN brass, some of whom pointed out that it had been drafted by just one part of the community

“If the community — the whole community — comes up with an accreditation model we would be proud to put that before the DPAs,” Marby said during Thursday’s public forum in Puerto Rico.

It’s a somewhat ironic position, given that ICANN was just a few weeks ago prepared to hand over responsibility for creating the first stage of the accreditation program — covering law enforcement — wholesale to the GAC.

The GAC’s response to that request?

It’s not interested. Its ICANN 61 communique said the GAC “does not envision an operational role in designing and implementing the proposed accreditation programs”.

A lazy blogger’s wish-list for ICANN remote participation

Kevin Murphy, March 19, 2018, Domain Policy

Remote participation at ICANN meetings is pretty damn good, but I’m an ungrateful asshole and I want more.

I’ve had a personal wish-list of remote participation features during and immediately after every ICANN meeting for a few years now, but when ICANN turned off Adobe Connect for the back half of ICANN 61 last week I was inspired to put pen to paper and rant about it in public.

Make no mistake, these are minor quibbles and no diss to the thoroughly lovely people on the ICANN meetings team.

In a community where are great many people are tasked with herding cats, the meetings guys are the only ones who have to physically herd the cats into their windowless pens through the sheer power of their organizational skills.

Not to mention they have to ensure all the cats are fed, watered, caffeinated, inebriated, and have trays of gravel into which to do their dirty business.

(Sorry, that metaphor got away from me a little there.)

My point is, the fact that anyone ever gets anything done at an ICANN meeting is due in no small part to the folk who actually organize the events, including the remote participation.

With all those disclaimers in mind, here are a few things I would like to see in future.

Archive the scribe feeds

The ICANN scribe feed, provided for as long as I can remember by Brewer & Darrenougue and StreamText is excellent.

It provides a live, scrolling, text transcription, in English, of whatever is being said in a session. It’s not 100% accurate all of the time, but it’s damn close.

Over the years, the scribes seem to have gained an ear for the regular speakers. It’s increasingly rare to see “[SAYING NAME]” in a feed, and we don’t often see pleas from the scribes for speakers to slow down any more.

This allows Anglo monoglot basement-dwellers such as myself to identify who’s talking and get a rough idea what they’re saying, even when they are Catalan registry operators speak quickly in heavily accented, non-native English.

The problem with the feed is that they disappear immediately after each session ends, usually at lunch time and again at the end of the day. Remote participants then have to wait anywhere from a day to several days for the full, edited transcript to be published.

I think the resource cost of immediately publishing the full, warts-and-all scribe transcript would be negligible.

Even if StreamText doesn’t offer it as an automated feature, copy-pasting a session transcript from a browser window into a PDF and banging it on the ICANN web site shouldn’t take more than a few minutes. I know; for several meetings I did it myself on selected sessions as a public service.

Bring back the MP3s

Not too long ago, the audio-only streams were recorded into MP3 files and dumped on the meeting web site in short order, often the same day.

Now, instead, we get M3U files, which are basically just links to streams. And the streams are extremely temperamental, regularly skipping around, restarting or simply stopping for no readily apparent reason.

Today, attempting to re-listen to the M3U of last Thursday’s Public Forum, I had to restart the stream and go hunting for the position I’d been kicked out maybe a dozen times. It was very irritating.

MP3s have the added advantage that they can be listened to offline, allowing you to catch up on sessions you missed while, for example, loitering at an airport with crappy wifi.

I want the MP3s back, dammit!

Consider YouTube maybe?

Recent meetings have seen the introduction of Livestream.com as an alternative to Adobe Connect for viewing live video.

I assume ICANN is paying for this service, probably five figures per year, but I have no idea what benefit (if any) the service offers over YouTube live streaming.

It doesn’t even always work. Try getting Thursday’s Public Forum recording to play. I couldn’t.

Is there any particular reason YouTube is not a viable option? As far as I know it’s free and reliable. YouTubers with far greater audiences than ICANN seem to get away with using it on a daily basis.

It could even be monetized, turning an expense into a small source of additional revenue.

Bring back meaningful filenames

ICANN is pretty good about publishing transcripts, presentations and other documentation as PDFs on the pages for each session. But for some reason in Puerto Rico it started naming the files with apparently meaningless numerical strings.

In all the meetings I can recall before ICANN 61, a downloadable transcript might be named something like “transcript-public-forum-10mar16-en.pdf”. Now, you’ll get something like “1521076292.pdf” instead, which is a step backwards.

Sure, I could manually rename the file to something meaningful myself, but that would take me at least 30 seconds — 30 seconds I could better use listening to Marilyn Cade introduce herself, Goran Marby apologize for something, or literally anyone else in the community complain that nobody listens to them any more.

Keep the redundancy!

Finally, as ICANN discovered this week, redundancy is essential to maintaining uninterrupted remote participation.

Even with Adobe Connect offline across the board for half of the week, it was still possible for those of us in the cheap seats to see video, hear audio, read the scribes, and submit questions and comments.

It wasn’t perfect, but it did the job well enough (previous complaints notwithstanding).

Even when Adobe is turned on, the alternative methods of listening in are extremely useful for overcoming its occasional limitations.

Often, AC rooms are barely audible. This problem occurs on an almost daily basis during ICANN. It affects some rooms but not others and I’ve yet to spot a predictable pattern.

But when you can’t hear what’s going on in AC, it’s always possible to mute the room and launch the always-audible live M3U stream separately.

Similarly, on the rare occasions the audio or video is down, the scribes can often allow us to follow the gist of the discussion while the nerds work on a fix.

In short, redundancy is good.

UPDATE (MARCH 21): Josh Baulch from the ICANN meetings team has left a comment addressing some of these points. It turns out MP3s are actually available elsewhere on the ICANN web site and Livestream costs ICANN far, far less than I had estimated based on Livestream’s published price list.