Browser makers brush me off on DNSSEC support

A couple of weeks back, I emailed PR folk at Microsoft, Mozilla, Google and Opera, asking if they had any plans to provide native support for DNSSEC in their browsers.
As DNS uber-hacker Dan Kaminsky and ICANN president Rod Beckstrom have been proselytizing this week at the Black Hat conference, support at the application layer is the next step if DNSSEC is to quickly gain widespread traction.
The idea is that one day the ability to validate DNSSEC messages will be supported by browsers in much the same way as SSL certificates are today, maybe by showing the user a green address bar.
CZ.NIC has already created a DNSSEC validator plugin for Firefox that does precisely that, but as far as I can tell there’s no native support for the standard in any browser.
These are the responses I received:

Mozilla: “Our team is heads down right now with Firefox 4 beta releases so unfortunately, I am not going to be able to get you an answer.”

Microsoft: “At this stage, we’re focusing on the Internet Explorer 9 Platform Preview releases. The platform preview is a developer and designer scoped release of Internet Explorer 9, and is not feature complete, we will have more to share about Internet Explorer 9 in the future.”
Google: No reply.
Opera: No reply.

In 11 years of journalism, Apple’s PR team has never replied to any request for information or comment from me, so I didn’t bother even trying this time around.
But the responses from the other four tell us one of two things:

• Browser makers haven’t started thinking about DNSSEC yet.

Or…

• Their PR people were just trying to brush me off.

I sincerely hope it’s the former, otherwise this blog post has no value whatsoever.

Comment Tagged: black hat, chrome, dan kaminsky, DNSSEC, firefox, google, ICANN, internet explorer, Microsoft, mozilla, opera, rod beckstrom, ssl

ICANN threatens to shut down registrar flipper

ICANN has said it will terminate one of its registrars for non-payment of fees, the thirteenth such threatening letter the organization has sent out this year.
The unfortunate recipient is #1 Host Brazil, which has just a couple hundred domains under its belt in the generic top-level domains.
I may be wrong, but based on some cursory research I’m inferring that the registrar is basically a shell accreditation, acquired in order to flip to a larger registrar.
There are 10 other “‘#1 Host” registrars, such as #1 Host Australia and #1 Host Canada, listed on ICANN’s list of accredited registrars, almost all of which were awarded in late 2005 to the same Texan.
They all use the same logos and, due to the hash sign, all appear at the top of alphabetical lists of ICANN-accredited registrars.
Apart from the Brazil and Israel variants, most of the other “#1” accreditations have been acquired by Moniker at various times over the last few years, according to Internic and Whois records.
#1 Host Brazil faces de-accreditation (pdf) on August 24 unless it pays almost $9,000 in ICANN fees and provides evidence of $500,000 in commercial liability insurance.

Comment Tagged: #1 host brazil, accreditation, ICANN, moniker, registrar accreditation agreement

ICANN chief to address hackers at Black Hat

Globe-trotting ICANN president Rod Beckstrom is heading to Vegas this week, to participate in a panel discussion on DNS security at the Black Hat conference at Caesar’s Palace.
He’ll be joined by Dan Kaminsky, discoverer of the notorious DNS vulnerability that bears his name, and is expected to sing the praises of the new DNSSEC security standard.
Also on tomorrow’s panel, entitled “Systemic DNS Vulnerabilities and Risk Management” are DNS inventor Paul Mockapetris, VeriSign CTO Ken Silva and NERC CSO Mark Weatherford.
ICANN and VeriSign recently signed the DNS root using DNSSEC standard. The challenge they face now is persuading everybody else in the world to jump on the bandwagon.
It’s likely to be slow going. DNSSEC has more than its fair share of skeptics, and even fierce proponents of the standard sometimes acknowledge that there’s not a heck of a lot in the way of a first mover advantage.
I’ll be interested to see if the subject of a DNS-CERT – a body to coordinate DNS security efforts – is raised either during the panel or the subsequent press conference.
From a policy point of view, DNSSEC is pretty much a done deal, whereas a DNS-CERT is still very much a matter for debate within the ICANN community.
I believe this is the first time ICANN has talked publicly at Black Hat. Beckstrom himself has taken the stage under his previous roles in government, but not as ICANN’s top dog.
Despite its name, Black Hat is a pretty corporate event nowadays. In my experience, the proper black/gray hats show up (or swap their lime green corporate polo shirts for Metallica T-shirts) at the weekend for Def Con, which is usually held at a cheaper venue around the corner.

1 Comment Tagged: black hat, dan kaminsky, def con, DNSSEC, ICANN, las vegas, rod beckstrom

Yes, .co domains are subject to the UDRP

I’ve been getting a fair bit of search traffic over the last few days from people evidently wondering whether .co domain names are subject to the same UDRP rules as .com, so I thought I’d answer the question directly.
Yes, they are.
For avoidance of doubt, I’ve just talked to .CO Internet’s director of marketing, Lori Anne Wardi, who had just talked to the registry’s policy people.
She told me that .co domains are subject to the exact same ICANN UDRP as .com.
If you’re a .co registrant, you’re bound to the policy the same as you are in .com. If you’re a trademark holder, you file a complaint in the same way.
The only difference at the moment is that .CO Internet has contracted with only one UDRP provider, WIPO, but Wardi said that more providers may be signed up in future.

1 Comment Tagged: .co, .co internet, colombia, ICANN, lori anne wardi, udrp, wipo

Using Go Daddy equals “bad faith” registration

Registered a domain name with Go Daddy recently? Unless you’ve updated your name server settings, you’ve automatically committed a “bad faith” registration.
At least, that’s the conclusion I’m drawing from a couple of recent clueless UDRP decisions.
The most recent example is the case of Churchill Insurance, which just won churchillimports.com, following a proceeding with the National Arbitration Forum.
The registrant claimed he planned to use the domain, which he registered just six months ago, to sell cigars. Seems reasonable. Other sites sell cigars using the name “Churchill”.
But the NAF panelist, Flip Petillion, wasn’t buying it:

Respondent uses the churchillimports.com domain name to resolve to a directory website that displays links to third-party websites, some of which provide insurance products and services that compete with Complainant’s business.
…
it is shown on a balance of probability that Respondent uses the disputed domain name to operate a directory website and, thus, profits from this use through the receipt of “click-through” fees. Accordingly, the Panel finds that this use constitutes bad faith registration and use pursuant to Policy
…
as the disputed domain name was registered after the registration of Complainant’s established trademark rights and given the fact that Respondent’s website employs insurance themed links that resolve to websites of Complainant’s competitors, Respondent could not have registered and used the disputed domain name without actual or constructive knowledge of Complainant and its rights in the CHURCHILL mark.

What Petillion clearly failed to realize – or decided to conveniently ignore – is that everything he ascribes to the registrant was actually caused by default Go Daddy behavior.
Churchill sells car insurance in the UK. The registrant is an American, from Georgia. There’s a very slim chance he’d ever heard of the company before they slapped him with the UDRP.
But Petillion decided that the fact that insurance-themed links were present on the site shows that the registrant must have known about the company. Like he put the links there himself.
He concludes the registrant had “bad faith” because Go Daddy’s parking algorithm (I believe it’s operated by Google) knows to show insurance-related ads when people search for “churchill”.
In addition, churchillimports.com is the default parking page that Go Daddy throws up whenever a domain name is newly registered.
The registrant didn’t need to do anything other than register the name and, according to this bogus ruling, he’s automatically committed a bad faith registration.
Where does NAF find these people?
I’m sure I’m not the first to notice this kind of behavior, and I’m sure Go Daddy’s not the only registrar this affects.

4 Comments Tagged: churchill insurance, churchillimports.com, Flip Petillion, go daddy, naf, national arbitration forum, udrp

Stalemate reached on new TLD ownership rules

An ICANN working group tasked with deciding whether domain name registrars should be able to apply to run new top-level domains has failed to reach a consensus.
For the last several months, the Vertical Integration working group has been debating, in essence, the competitive ground rules of the new TLD market, addressing questions such as:

• Should existing ICANN registrars be allowed to run new TLD registries?
• Should new TLD registries be allowed to own and control ICANN registrars?
• Should new TLD registries be allowed to sell domains directly to end users?
• What if an approved registry can’t find a decent registrar willing to sell domains in its TLD?
• Should “.brand” TLDs be forced to sell via ICANN accredited registrars?
• Should “registry service providers” be subject to the same restrictions as “registries”?
• Where’s the harm in allowing cross-ownership and vertical integration?

It’s an extraordinarily complex set of questions, so it’s perhaps not surprising that the working group, which comprised a whopping 75 people, has managed to reach agreement on very few answers.
Its initial report, described as a “snapshot” and subject to change, states:

It is impossible to know or completely understand all potential business models that may be represented by new gTLD applicants. That fact has been an obstacle to finding consensus on policy that defines clear, bright line rules for allowing vertical integration and a compliance framework to support it

Having lurked on the WG’s interactions for a few months, I should note that this is possibly the understatement of the year. However, the WG does draw four conclusions.

1. Certain new gTLDs likely to be applied for in the first round will be unnecessarily impacted by restrictions on cross-ownership or control between registrar and registry.

I believe the WG is referring here primarily to, for example, certain “cultural” TLDs that expect to operate in linguistic niches not currently catered for by registrars.
The operators of the .zulu and .kurd TLDs would certainly find themselves without a paddle if the rules obliged them to find an ICANN-accredited registrar that supports either of their languages.
There are other would-be registries, such as .music, that call themselves “community” TLDs and want to be able to sell directly to users, but my feeling is that many in the WG are less sympathetic to those causes.

2. The need for a process that would allow applicants to request exceptions and be considered on a case-by-case basis. The reasons for exceptions, and the conditions under which exceptions would be allowed, vary widely in the group.

There’s not a great deal to add to that: the WG spent much of the last couple of weeks arguing about “exceptions” (that they could not agree on) to a baseline rule (that they could not define).

3. The concept of Single Registrant Single User should be explored further.

An “SRSU” is a subset of what a lot of us have been calling a “.brand”. The proposed .canon TLD, under which Canon alone owns .canon domains, would likely fall into this category.
The WG’s report suggests that SRSU namespaces, should they be permitted, should not be subject to the same restrictions as a more open and generic TLD that sells to the average man on the street.
The alternative would be pretty crazy – imagine Canon owning the registry but being forced to pay Go Daddy or eNom every time it wanted to add a record to its own database.
I do not believe that a hypothetical .facebook, in which Facebook is the registry and its users are the registrants, falls into the SRSU category. Which is also pretty nuts, if you’re Facebook, forced to hand your brand over to the world’s domain name registrars.

4. The need for enhanced compliance efforts and the need for a detailed compliance plan in relation to the new gTLD program in general.

One principle that has come through quite clearly whilst lurking on the WG mailing list is that the degree of distrust between participants in this industry is matched only by the lack of confidence in ICANN’s ability to police bad actors effectively.
Domain name companies are masters of the loophole, and ICANN’s enforcement mechanisms have historically been slow enough that yesterday’s scandal often becomes today’s standard practice.
This sums it up pretty well:

Some members feel that loosening vertical integration/ownership controls may let the proverbial “genie out of the bottle that can’t be put back” should competitive harms result in the marketplace. Others believe that adopting restrictions on vertical integration or cross ownership is the wrong approach altogether, and that the focus should be on protecting against harms, and providing sanctions where harms take place.

The WG currently has six policy proposals on the table, which vary from the “no VI allowed” of the current Draft Applicant Guidebook to “some VI allowed” to “full VI allowed”.
There was a poll of WG members a few weeks back, to see which proposal had most support. It was inconclusive, but it left three proposals clearly in the lead.
The so-called Free Trade proposal, which advocates no limits on cross ownership, was originally authored by Sivasubramanian Muthusamy of ISOC India Chennai.
The proposal as it currently stands puts the focus on ICANN troubleshooting undesirable activities through compliance programs rather than ownership restrictions.
Opposed, a proposal known as RACK+, offered up primarily by Afilias, some of its partners, and Go Daddy, favours a much more restrictive policy that is more aligned with business models established under the last ten years of gTLDs dominated by .com.
RACK+ would impose a 15% ownership limit between registries, registrars and registry service operators, ostensibly in order to prevent registrars abusing privileged registry data.
But under RACK+, all TLDs, including .brands and obscure community TLDs, would be obliged to accept registrations only through ICANN registrars, on a non-discriminatory basis.
This would probably render the .brand TLD market stillborn, if adopted by ICANN, I reckon.
A third proposal, called JN2+, originally authored by representatives of NeuStar and Domain Dimensions, occupies a spot somewhere in the middle ground.
It also proposes 15% ownership caps between registrars, registries and registry service providers, but it contains explicit carve-outs for SRSU-style .brands and “community” TLDs.
Because I’m a wimp, and I have no desire to be drawn into the kinds of arguments I’ve been reading and listening to recently, I’m going to quote Milton Mueller here, saying JN2 “had the highest acceptability ranking of all the proposals” when the WG was polled.
(Sorry.)
I find it rather surprising that the WG seems to be calling for more policy work to be done on ICANN’s compliance programs before the issue of vertical integration can be fully resolved.
If anything, this seems to me to be yet another way to risk adding more delay to the new TLD program.
There’s a public comment period now open, here. And here’s the report itself (pdf)

4 Comments Tagged: .brand, afilias, canon, domain dimensions, go daddy, milton mueller, neustar, new TLDs, Sivasubramanian Muthusamy, vertical integration

Isn’t it about time for ICANN Las Vegas?

ICANN is now almost 12 years old, it’s held almost 40 public meetings in diverse cities all over the planet, and it’s never been to Vegas. Not once.
That’s got to change.
The organization is currently looking for a North American city in which to hold its fortieth public meeting, slated for next March. It’s the perfect opportunity for a company to put in a Las Vegas bid.
It’s about time ICANN headed to The Strip. It’s got to be the only industry organization in the world to never convene there. If the International Beverage Dispensing Equipment Association gets to have a Vegas convention, why can’t we?
Vegas is the conference center of North America, if not the world. There’s literally dozens of venues capable of handling a thousand or less beardy domain types, all within walking distance of each other.
If the conference facility prices are anything like the hotel room prices, ICANN and its sponsor should be able to find a real bargain.
For overseas visitors on a budget, flights to and hotels in Vegas can be very reasonable – rooms are generally subsidized by the money lost in the casinos downstairs.
The ICANN Fellowship Program would be massively oversubscribed. Live in the developing world? Fancy a free trip to Vegas? ICANN will be fighting off applicants with the proverbial stick.
But who would sponsor such a meeting?
Let me think… we’d be looking for a domain name company with deep pockets, something to sell, and no particular queasiness about sponsoring a Sin City event.
Can you think of anyone like that?
By March 2011, ICM Registry will very likely be in the pre-launch stages of the .xxx TLD.
The company will be looking for registrar partners, trying to assure IP interests that it’s not going to screw them, preparing for its sunrise and landrush periods… perfect timing.
Plus, we could have strippers at the Gala Event.
The stars are aligning on Las Vegas for ICANN 40.
ICANN, ICM – let’s make this happen.

Comment Tagged: ICANN, icm registry, las vegas, xxx

UNICEF looking for a .brand TLD partner

The UN-backed charity UNICEF has become the second organization, after Canon, to confirm publicly it is planning to apply for a .brand top-level domain.
The organization has put its feelers out for a registry operator to apply for and manage .unicef, publishing a Request For Information on its web site this week.
The RFI says:

Taking the long view, as time goes on a name such as www.donations.unicef and www.cards.unicef will become more intuitive in a more crowded Internet, and thus more valuable because the name reflects exactly that of an organization and declares what it does.

With unscrupulous individuals frequently seeking to capitalize on global tragedies to bilk money out of people through bogus web sites, charities could very well see some anti-phishing benefits from having their own sufficiently publicized TLD.
As I noted yesterday, it looks like the Red Cross may be thinking about a similar initiative.
UNICEF appears to want an operator that will be able to both manage the ICANN application process and then, for at least two years, the operation of the registry.
The deadline is July 30, so vendors have just a week to fill out and submit a questionnaire outlining their capabilities.
The questions appear, to me, to betray a degree of unfamiliarity with the DNS business and the new TLD process in particular.

What are the timeframes for developing and provisioning the application including all necessary activities (i.e. obtaining ICANN’ registration, facilitating the transition of current domains to the top level domain etc) from the moment a contract is signed with the selected vendor?

Good luck answering that one.
(Hat tip: newTLDs.tv)

Comment Tagged: ICANN, new TLDs, unicef

Brand owners drop hints about .brand TLD plans

The flood of negative comments to ICANN yesterday almost obscured the fact that a few companies have hinted that they will apply for their own “.brand” top-level domains.
As Antony Van Couvering first noted on the Minds + Machines blog, IBM’s comment on version four of the Draft Applicant Guidebook makes it pretty clear the idea of a .ibm is under consideration.
IBM’s filing raises concerns about the issues of sunrise periods and vertical integration, with particular reference as to whether .brand owners would be exempt from such things.
This suggests IBM is thinking about its own .brand.
If we make the (admittedly cheeky but probably realistic) assumption that the large majority of comments filed with ICANN are self-serving, we can infer that anyone taking in an interest in the nuts and bolts of running a new TLD has probably considered applying for one.
Other than IBM, I’ve notice two others so far: Microsoft and the American Red Cross.
Microsoft, while generally opposed to a large-scale new TLD launch, is very concerned about parts of the DAG that would allow ICANN to transfer a .brand delegation to a third party if the original registry were to shut down for whatever reason.
In other words, if Microsoft one day decided that running “.windows” was a waste of time and decided to shut it down, could ICANN appoint Apple to take it over?
I suggest that this is something that you only really worry about if you’re thinking about applying for a .brand TLD.
The American Red Cross comment contains references to a hypothetical scenario where it applies for its own TLD throughout.
It’s especially concerned that its administrative overheads would increase due to the high ICANN application fees, eating into the money it can spend on worthier causes.
To date, Canon is the only company I’m aware of to publicly state it will apply for a .brand.

4 Comments Tagged: .brand, american red cross, canon, ibm, ICANN, Microsoft, new TLDs, trademarks

Will new TLDs be delayed by the trademark owner outcry?

Yesterday’s flood of criticism from big trademark holders has put another question mark next to ICANN’s plan to finalize the new top-level domain application process this year.
Heavy-hitters including Microsoft, AT&T, Time Warner, Adobe and Coca-Cola filed strong criticisms of the trademark-protection mechanisms in version four of the Draft Applicant Guidebook, and urged ICANN to delay the new TLD launch until the perceived weaknesses are addressed.
The concerns were echoed by the Motion Picture Association of America, the International Olympic Committee, Nestle, the International Trademark Association, Lego, the World Intellectual Property Organization, the American Intellectual Property Law Association, News Corp, the BBC and the American Bankers Association, among others.
Two ICANN registrars, MarkMonitor and Com Laude, also threw in with the anti-DAGv4 crowd. Indeed, MarkMonitor appears to have orchestrated at least a part of the trademark owner commentary.
It’s clear that many IP owners feel they’re being ignored by ICANN. Some organizations, notably WIPO and Time Warner, filed scathing criticisms of how ICANN makes policy.
These aren’t insignificant entities, even if some of their comments read like cases of throwing toys out of the pram.
After conversations with others, I know I’m not the only one who believes that this outcry could add delay to the new TLD process.
It certainly casts doubt on comments made by ICANN chair Peter Dengate Thrush in Brussels last month to the effect that the trademark protection portions of the DAG were very close to being finalized.
Trademark owners, including most of the outfits listed above, are concerned that the Uniform Rapid Suspension policy, designed to create a faster and cheaper version of the UDRP, has become bloated and now in some cases could take longer than a UDRP proceeding.
They also don’t think the Trademark Clearinghouse, a database of brands maintained by ICANN that new TLD registries would be obliged to protect, goes far enough to protect their marks. The previously proposed Globally Protected Marks List seems like a preferred alternative.
ICANN currently hopes to have the final guidebook close to readiness by its public meeting in Cartagena, Colombia, this December. Its board of directors will meet over a weekend in September to try to knock the document into shape. I don’t envy that task.
There’s a possibility, of course, that ICANN will soldier on with its time-line regardless. Dengate Thrush indicated in an interview last month that he did not want trademark issues to delay the launch any more than they have already.
Asked about the IP lobby’s concerns with the speed of the URS, he told the World Trademark Review:

I have conceptually no problem with making sure that expedited processes are available. If this one turns out to be too slow, we’ll do something else. What we can’t have is the hold up of the entire process until this is resolved.

It’s wait and see time again, but at the very least I think it’s pretty clear that the new TLD launch timeline is more in doubt today than it was 24 hours ago.

1 Comment Tagged: brussels, cartagena, dag, draft applicant guidebook, ICANN, markmonitor, new TLDs, peter dengate thrush, time warner, trademarks, wipo