Angry gTLD applicants lay into ANA and Verisign “bullshit”

They’re as mad as hell and they’re not going to take it any more.
New gTLD applicants yesterday laid into the Association of National Advertisers and Verisign with gusto, accusing them of seeking to delay the program for commercial reasons using security as a smokescreen.
The second TLD Security Forum in Washington DC was marked by a heated public argument between applicants and their back-end providers and the ANA’s representatives at the event.
The question was, of course, name collisions: will new gTLDs cause unacceptable security risks — maybe even threatening life — when they are delegated?
ANA vice president Dan Jaffe and outside counsel Amy Mushahwar had walked into the lion’s den, to their credit, to put forth the view that enterprises may face catastrophic IT failures if new gTLDs show up in the in DNS root.
What they got instead was a predictably hostile audience and a barrage of criticism from event organizer Alex Stamos, CTO of .secure applicant Artemis Internet, and Neustar VP Jeff Neuman.
Stamos was evidently already having a Bad Day before the ANA showed up for the afternoon sessions.
During his morning presentation, he laid the blame for certain types of name collision risks squarely with the “dumb” enterprises that are configuring their internal name servers in insecure ways. He said:

Any company that is using any of these domains, they’re all screwing up. Anyone who’s admitting these collisions is making a mistake. It’s a bad mistake, it’s a common mistake, but that doesn’t make it right. They’re opening themselves up to possible horrible security flaws that have nothing to do with the new gTLD program.
…
There is a mechanism by which you can split DNS resolution in a secure manner on Windows. But unless you do that, you’re in trouble, you’re creating a security hole for yourself. So stop complaining and delaying the whole new gTLD program, because you’re dumb, honestly. These are people who are going to have a problem whether new gTLDs exist or not. Let’s be realistic about this: it’s not about security, it’s about other commercial interests.

That’s of course a reference to Verisign, which is suspected of pressing the name collisions issue in order to prevent or delay competition to .com, and the ANA, which tried to get the program delayed on trademark grounds before it discovered collisions earlier this year.
Executives from Verisign, which put the ANA onto the name collision scent in the first place, apparently lacked the cojones to show up and defend the company’s position in person.
Stamos was preaching mainly to the choir at this point. The fireworks didn’t start until Jaffe and Mushahwar arrived for their panel a few hours later.
The ANA’s point of view, which they both made pretty clearly, is that there seems to be a risk that things could go badly wrong for enterprises if they’re running internal names that clash with applied-for gTLDs.
They’ve got beef with ICANN for running a “not long enough” comment period on the topic primarily during the vacation month of August, which didn’t give big companies enough time to figure out whether they’re at risk and obtain the necessary sign-off on disclosing this fact.
In short, the ANA wants more time — many more months — for its members and others to look at the issue before new gTLDs are delegated.
Mushahwar dismissed the argument that the event-free launches of .asia, .xxx and others showed that gTLD delegations don’t cause any problems, saying:

Let me admit right now: DNS collision is not new, it’s been around since the beginning of the internet… what is new is the velocity of change expected within the next year to 18 months.
I really dismiss the arguments that people are making on the public record saying we’ve dealt with this issue before, we’ve dealt with these issues, view the past TLDs as your test runs. We have never had this velocity of change happening.

The ANA seems to believe that the risk and the consequences are substantial, talking about people dying because their voice over IP fails or electricity supply gets cut off.
But other speakers weren’t buying it.
Stamos was first to the mic to challenge Mushahwar and Jaffe, saying their concerns are “mostly about IP and other commercial interests”, rather than sound technical analysis.
He pointed to letters sent to ICANN’s comment periods in support of the ANA’s position that were largely signed by IP lawyers. Security guys at these companies were not even aware of the letters, he said.

The internet is this crazy messy place where all kinds of weird things happen… if this is the mode that the internet goes forward — you have to prove everything you do has absolutely no risk of impacting anyone connected to the internet — then that’s it, we might as well call it done. We might as well freeze the internet as it is right now.
…
If you want to stall the program because you have a problem with IP rights or whatever I think that’s fine, but don’t try to grab hold of this thing and blow it up under a microscope and say “needs more study, needs more study”. For anything we do on the internet we can make that argument.
…
Any call for “we need to study every single possible impact for all several billion devices connected to the internet” is honestly kinda bullshit… it really smacks to me of lawyers coming in and telling engineers how to do their job.

Mushahwar pointed out in response that she’s a “security attorney, not an IP attorney” and that her primary concern is business continuity for large business, not trademark protection.
A few minutes later Neustar’s Neuman was equally passionate at the mic, clashing with Mushahwar more than once.
It all got a bit Fox News, with frequent crosstalk and “if you’d let me continue” and “I’ll let you finish” raising tempers. Neuman at one point accused Mushahwar of “condescending to the entire audience”.
His position, like Stamos before him, was that new gTLD applicants have looked at the same data as Interisle Consulting in its original report, and found that with the exception of .home, .corp and .mail, the risks posed by new gTLDs are minor and can be easily mitigated.
He asked the ANA to present some concrete examples of things that could go wrong.
“You guys have come to the table with a bunch of rhetoric, not supported by facts,” Neuman said.
He pointed to Neustar’s own research into the name collisions, which used the same data (more or less) as Interisle and Verisign and concluded that the risk of damaging effects is low.
The two sides of the debate were never going to come to any agreements yesterday, and they didn’t. But in many respects the ANA and applicants are on the same page.
Stamos, Neuman and others demanded examples of real-world problems that will be encountered when specific gTLDs are delegated and the ANA said basically: “Sure, but we need more time to do that”.
But more time means more delay, of course, which isn’t what the domain name industry wants to hear.

newdomains.org ticket compo winners announced

The winners of the recent DI prize draw, with three free tickets for the newdomains.org conference at stake, have been confirmed.
To enter the competition, you simply had to leave a comment on DI completing the sentence “The biggest challenge facing new gTLDs next year will be…”
I read all the submissions and found them all interesting but ultimately the comments were completely irrelevant in determining the winners, which were selected by three random numbers generated by Random.org.
The winners were:

• Colin Campbell of .CLUB Domains.
• Jeffrey Sass of .CLUB Domains.
• Phil Buckingham of DotAdvice.

It definitely looks weird that two people from the same company won tickets. Weird enough that for half a second I wondered whether justice would be better serviced if were to fix a different outcome.
But I didn’t. If it looks unjust, blame randomness. Fate’s a bitch.
Many thanks to all who entered. There were some interesting comments.

Authentic Web wants to be dot-brands’ pocket registrar

Toronto-based start-up Authentic Web launched today with a set of workflow automation tools for dot-brand gTLD registries.
Because ICANN requires all new gTLDs, even the closed ones, to make registrations via accredited registrars, there’s often talk about dot-brands signing up with “pocket” registrars.
That’s what Authentic Web wants to be, according to CEO Peter LaMantia. The company is focused on the dot-brand market.
The company’s new Brand Registry Asset Manager will provide a way for dot-brands to control the registration process workflow so that only approved second-level domains are registered, he said.
For example, a smaller dot-brand might have a single person responsible for registering all domains in the gTLD, while a multinational might have multiple layers of delegated power.
Instead of plonking down a credit card at Go Daddy to buy a .com domain, a marketing manager would place a request into the BRAM system and have it approved up a chain of command before the ultimate Add command was made with the registry.
Authentic Web would usually act as the registrar middleman, but the plan is to also integrate the software with third-party registrars.
The software will also give dot-brands greater visibility over their portfolios, LaMantia said.
Many big brands already have a hard time keeping track of their existing portfolios of domain names in gTLDs they do not control, he said.
“I know a lot of companies that do this on Excel sheets,” he said. “If they own the registry they’re not going to want to do that. That’s the hole in the market.”
BRAM is web-based and hosted by Authentic Web, so it won’t at first integrate with existing enterprise identity systems, though LaMantia said integration tools are on the road-map.
The software will be priced on a monthly subscription basis, with a per-domain component.
LaMantia, who founded Authentic Web last year, previously was president of the registrar Aplus.net.

Win free tickets to the newdomains.org conference

DI has three tickets to the upcoming new gTLDs conference newdomains.org to give away to three lucky readers, courtesy of organizer United-Domains.
It’s the second newdomains.org event. The first, in 2011, was pretty good but hampered slightly by being scheduled before the ICANN new gTLD program officially kicked off.
With new gTLDs likely to be in the root by the time this year’s conference rolls around in October, the chance of good conversation and some productive networking is likely to be much improved.
Speakers on the agenda include ICANN CEO Fadi Chehade and Google’s Jordyn Buchanan, as well as many senior domain name industry executives, and me.
The event runs from October 28 to 29 at the Sofitel Munich Bayerpost in Munich, Germany.
Our giveaway covers tickets for the conference (valued at €821.10 each) but not the cost of your transport or accommodation, so if you can’t make it, please don’t enter.
To be in with a chance of winning, just leave a comment on this post completing the following sentence:

The biggest challenge facing new gTLDs next year will be…

We’ll use a random number generator to pick a winner early next week.
UPDATE 9/16: Entries are now closed. Winners will be selected on Tuesday.

dotShabaka Diary — Day 8, Launch Uncertainty

Today, the eighth installment of dotShabaka Registry’s journal, charting its progress towards becoming one of the first new gTLDs to go live, written by general manager Yasmin Omer.

Thursday 5 September 2013
Having passed PDT on the 27th of August, we were notified of our eligibility to transition to IANA for delegation and told that we will receive instructions regarding the next steps via the Customer Portal.
We’re still waiting to hear from ICANN. We have no visibility regarding when we will be delegated.
There are so many moving parts in the new gTLD program right now that the delegation timing impacts everything from hiring staff to deciding on launch strategies. Discussions with registrars and marketing agencies beg one simple question – when will you be launching? My response: no idea.
We’re trying to launch a business in what can only be described as a vacuum. We understand that delays may be inevitable right now, however, it would be great if the nature and impact of those delays on our TLD was officially communicated to us (perhaps by a designated account manager?).
Communications during the PDT Pilot and Beta periods were great but seem to have slowed down since we passed PDT. We look forward to receiving some clarity about delegation from ICANN soon.

Read previous and future diary entries here.

ICANN’s name collision plan “creates risk of abuse”

One of ICANN’s proposed methods of reducing the risk of name collisions in new gTLDs actually may create its own “significant risk for abuse”, according to RIPE NCC.
Asking registry operators to send a notification to the owner of IP address blocks that have done look-ups of their TLD before it is delegated risks creating a “backlash” against ICANN and registry operators, RIPE said.
Earlier this month, ICANN said that for the 80% of applied-for strings that are categorized as low risk, “the registry operator will notify the point of contacts of the IP addresses that issue DNS requests for an un-delegated TLD or names under it.”
The proposal is intended to reduce the risk of harms caused by the collision of new gTLDs and matching names that are already in use on internal networks.
For example, if the company given .web discovers that .web already receives queries from 100 different IP blocks, it will have to look up the owners of those blocks with the Regional Internet Registries and send them each an email telling them than .web is about to hit the internet.
RIPE is the RIR for Europe, responsible for allocating IP addresses in the region, so its view on how effective a mitigation plan this is cannot be easily shrugged off.
Chief scientist Daniel Karrenberg told ICANN today that the complexity of the DNS, with its layers of recursive name servers and such, makes the approach pointless:

The notifications will not be effective because they will typically not reach the party that is potentially at risk.

In addition, it will be trivial for mischief-makers to create floods of useless notifications by conducting deliberately erroneous DNS queries for target TLDs, he said:

anyone can cause the registry operator to send an arbitrary amount of mandatory notifications to any holder of IP address space. It will be highly impractical to detect such attacks or find their source by technical means. On the other hand there are quite a number of motivations for such an attack directed at the recipient or the sender of the notifications. The backlash towards the registry operator, ICANN and other parties in the chain will be even more severe once the volume increases and when it turns out that the notifications are for “non-existing” queries.

With a suitably large botnet, it’s easy to see how an attacker could generate the need for many thousands of mandatory notifications.
If the registry has a manual notification process, such a flood would effectively DDoS the registry’s ability to send the notices, potentially delaying the gTLD.
Even if the process were to be automated, you can imagine how IP address block owners (network admins at ISPs and hosting companies, for example) would respond to receiving notifications, each of which creates work, from hundred of affected gTLD operators.
It’s an interesting view, and one that affected new gTLD applicants (which is most of them) will no doubt point to in their own comments on the name collisions mitigation plan.

dotShabaka Diary — Day 6, TMCH Integration Testing

Today, the sixth installment of dotShabaka Registry’s journal, charting its progress towards becoming one of the first new gTLDs to go live, written by general manager Yasmin Omer.

Monday 26 August 2013
We attended the second IBM webinar on the TMCH which ran smoothly. The guys at IBM were pretty responsive and helpful.
Having received our registration token from ICANN, we logged on to the TMDB System to create credentials for the OT&E platform, provide contact details and accept the TMCH Terms and Conditions. TMCH integration testing is now on hold since we were not able to download the DNL file or upload the LORDN file. IBM confirmed that this functionality will not be available until the Trademark Claims functionality update scheduled for the 9th of September.
The testing environment was communicated as the TMCH accreditation environment that would include all the functionality required for Sunrise processing. It’s currently a limited test environment but we’re looking forward to conducting further tests as IBM continue to add functionality.
We recommend those planning on conducting TMCH Integration Testing in the near future wait until the Claims functionality update scheduled for the 9th of September before proceeding.

Read previous and future diary entries here.

New gTLD Application Tracker 3.0 launched

While we’ve added several smaller requested features to the DI PRO New gTLD Application Tracker over the last few months, the time has come for the second big update to the service.
Subscribers have asked for a number of changes and upgrades to make it easier to quickly get at the data they need, and we’re happy to oblige.
The Application Tracker, has been updated in three areas.
New “Current Status” Tab
Talking to subscribers over the last few weeks, it became clear that different people are using the Application Tracker in different ways for different reasons.
Some want to be able to find out if, for example, an application has ever been objected to or received GAC advice, while others only want to know whether those objections and advice are still active.
From today, both use cases are made easier with the introduction of a new Current Status tab.
Searches conducted under this tab automatically filter out all withdrawn and rejected applications. If a contention set has been won, the winner will not display as contested in results.
Similarly, if an application managed to fight its way through objections or GAC advice, it will show as unopposed and unencumbered in search results pages.

Subscribers who want to carry on using the service to access historical information about applications can continue to use the previous version of the Application Tracker under the new “Original Status” tab.
Full IE Results
The existing IE Results database has been folded into the Application Tracker under a new tab, and there’s also a new option to see the full scores for each application that has passed through Initial Evaluation.
The new IE Results (Detailed) tab shows the scores each application received for each of the 27 Applicant Guidebook questions for which scores are made available
The Basic tab shows the financial and technical evaluation subtotals along with other information about the applicant and back-end provider.
New Search Options
With ICANN’s publication of Interilse Consulting’s report into the potential security risks of new gTLDs last week, each string was assigned a risk profile: Low, High or Uncalculated.
The database was updated with this information the same day it was published, but now you can search on it too, choosing to limit your search to, or omit, any of the three classes.
You can now also search for, or exclude, applications that have been rejected by ICANN. There are only three such applications right now, but I’m sure this option will become more useful in future.
Past and Future Updates
For details of all the original features of the Application Tracker, see this April blog post. For DI PRO subscription information, click here.
Subscribers can send suggestions for future updates to kevin@domainincite.com, as always.

Donuts details second private gTLD auction list

Donuts has committed 68 of its new gTLD applications to a set of private auctions due to commence August 13.
It’s the second round of auctions conducted by Innovative Auctions, which last month settled six contention sets for an average of $1.5 million per TLD.
Here’s the full list of Donuts’ strings:

.apartments .hot .art .jewelry .auction .law .audio .lawyer .baseball .legal .beauty .life .blog .living .boats .loans .broadway .memorial .broker .online .cafe .phone .casa .pizza .chat .place .church .plus .city .property .construction .rent .data .run .deals .salon .direct .school .discount .search .dog .show .expert .site .fish .soccer .football .storage .forum .store .furniture .studio .fyi .style .garden .team .global .theater .gratis .trading .group .website .guide .wedding .help .world .hosting .yoga

It’s very similar to the list of 63 strings that Donuts committed to the first round of auctions, which was under-subscribed by its rivals.
The additions since then are: .broker, .casa, .data, .deals, .dog,. expert, .lawyer, .life, .loans, .place, .property, .rent, studio, .website, .world and .yoga.
This list does not include the six gTLDs that were settled in the first round, for obvious reasons, but the following strings have also been removed: .forsale, .juegos, .marketing, .media, .sale.
Some of those appear to have been removed because Donuts has already won the contention set due to withdrawals.
The list still includes many in which Donuts is in a contention set with Uniregistry, which has previously said it would not participate in private auctions due to legal concerns.
Innovative said recently that over 100 applications had been committed to the August 13 auction.
It had previously said that the over 40 strings being applied for by applicants that had participated in the first auction had also been committed.
The deadline for committing to the auction is August 5.

Microsoft and others join London gTLD strategy conference line-up

Momentum Event Group has updated its agenda for the forthcoming Digital Marketing & gTLD Strategy Congress, with additional speakers from Microsoft and the new Domain Name Association joining the line-up.
Dave Coplin, “chief envisioning officer” of Microsoft UK, has been tapped to deliver a keynote entitled “What Lies Ahead. Looking Forward to the Future of Brand Marketing Post-gTLD”.
Momentum also said that ARI Registry Services, NetNames, Interbrand and the Domain Name Association are also set to speak at the event.
The agenda at this point is an interesting mix of industry regulars and dot-brand gTLD applicants. From the brand side of the house, the conference will feature also speakers from Richemont, LEGO, HSBC, Google and KPMG.
From ICANN, vice president of stakeholder engagement for North America Christopher Mondini is delivering a keynote, apparently on the wrong continent.
The Congress runs from September 26 to 27 at the Park Plaza Hotel in London. Tickets are priced at £795 ($1,220) until August 3, when prices go up.
DI is a media sponsor but has no financial interest in the conference.
The first morning session on day one of the conference is me interviewing Uniregistry CEO Frank Schilling on stage about the future of the internet, post-gTLDs. Coffee had better be provided.