Donuts bought .reise

Donuts has been confirmed by a German news site as the new owner of .reise, which was auctioned by its previous owner last week.
It was the first time a live gTLD had been sold at auction.
The deal, which is believed to have cost Donuts at least $400,000, means the company now owns .reise and .reisen.
Both mean “.travel”. According to my GCSE German skillz, last exercised 22 years ago, .reisen is a verb and .reise is a noun, but .reisen is also the plural of the noun .reise.
I believe this means that Donuts is the first company to own both the plural and singular forms of a new gTLD string.
Heise Online reports that former registry Dotreise was forced to sell up due to competition from Donuts.
Donuts’ .reisen has over 4,000 names in its zone file, compared to .reise’s 1,300. It’s a small market so far, but Donuts has the lion’s share.
The article notes that Donuts got a better position in ICANN’s prioritization draw in late 2012, meaning it got to market slightly earlier. Donuts also sells for a much lower price.
I doubt time to market was as much of a factor as price.
But it might be interesting to note that while Donuts’ advantage was just six days in terms of contract-signing, that lead had been extended to six weeks by the time .reise was delegated.
Donuts, which has more experience than any other company when it comes to the transition to delegation process, managed to hit general availability two weeks sooner than .reise, even though Donuts’ sunrise period was twice as long.

ICANN wins .hotels/.hoteis confusion appeal but has to pay up anyway

The proposed new gTLDs .hotels and .hoteis are too confusingly similar to coexist on the internet.
That’s the result of an Independent Review Process decision this week, which denied .hotels applicant Booking.com’s demand to have ICANN’s string confusion decision overturned.
But the IRP panel, while handing ICANN a decisive victory, characterized the string confusion and IRP processes as flawed and said ICANN should have to pay half of the panel’s $163,000 costs.
Booking.com filed the IRP a year ago, after the new gTLD program’s String Similarity Panel said in February 2013 that .hotels was too similar to rival Despegar Online’s proposed .hoteis.
.hoteis is the Portuguese translation of .hotels. Neither string was contested, so both would have been delegated to the DNS root had it not been for the confusion decision.
In my view, the String Similarity Panel’s decision was pretty sound.
With an upper-case i, .hoteIs is virtually indistinguishable from .hotels in browsers’ default sans-serif fonts, potentially increasing the ease of phishing attacks.
But Booking.com, eager to avoid a potentially costly auction, disagrees with me and, after spending a year exhausting its other avenues of appeal, filed an IRP in March 2013.
The IRP decision was handed down on Tuesday, denying Booking.com’s appeal.
The company had appealed based not on the merits of the SSP decision, but on whether the ICANN board of directors had acted outside of its bylaws in establishing an “arbitrary” and opaque SSP process.
That’s because the IRP process as established in the ICANN bylaws does not allow appellants to changed a decision on the merits. IRP panels are limited to:

comparing contested actions of the Board to the Articles of Incorporation and Bylaws, and with declaring whether the Board has acted consistently with the provisions of those Articles of Incorporation and Bylaws.

The IRP panel agreed that the SSP process could have been fairer and more transparent, by perhaps allowing applicants to submit evidence to the panel and appeal its decisions, saying:

There is no question but that that process lacks certain elements of transparency and certain practices that are widely associated with requirements of fairness.

But the IRP panel said Booking.com was unable to show that the ICANN board acted outside of its bylaws, highlighting the limits of the IRP as an appeals process:

In launching this IRP, Booking.com no doubt realized that it faced an uphill battle. The very limited nature of the IRP proceedings is such that any IRP applicant will face significant obstacles in establishing that the ICANN Board acted inconsistently with ICANN’s Articles of Incorporation or Bylaws. In fact, Booking.com acknowledges those obstacles, albeit inconsistently and at times indirectly.
…
Booking.com has failed to overcome the very obstacles it recognizes exist.

The IRP panel quoted members of ICANN’s New gTLD Program Committee extensively, highlighting comments which questioned the fairness of the SSP process.
In contrast to usual practice, where the losing party in an IRP bears the costs of the case, this panel said the $163,000 costs and $4,600 filing fee should be split equally between ICANN and Booking.com:

we can — and we do — acknowledge certain legitimate concerns regarding the string similarity review process raised by Booking.com, discussed above, which are evidently shared by a number of prominent and experienced ICANN NGPC members.
…
In view of the circumstances, each party shall bear one-half of the costs of the IRP provider

Booking.com and Despegar will now have to fight it out for their chosen strings at auction.
The full decision can be read in PDF format here. Other documents in the case can be found here.
The TL;DR version: ICANN wins because it has stacked the appeals deck in its favor and the IRP process is pretty much useless, so we’re going to make them pay up for being dicks.

More security issues prang ICANN site

ICANN has revealed details of a security problem on its web site that could have allowed new gTLD registries to view data belonging to their competitors.
The bug affected its Global Domains Division customer relationship management portal, which registries use to communicate with ICANN on issues related to delegation and launch.
ICANN took GDD down for three days, from when it was reported February 27 until last night, while it closed the hole.
The vulnerability would have enabled authenticated users to see information from other users’ accounts.
ICANN tells me the issue was caused because it had misconfigured some third-party software — I’m guessing the Salesforce.com platform upon which GDD runs.
A spokesperson said that the bug was reported by a user.
No third parties would have been able to exploit it, but ICANN has been coy about whether any it believes any registries used the bug to access their competitors’ accounts.
ICANN has ‘fessed up to about half a dozen crippling security problems in its systems since the launch of the new gTLD program.
Just in the last year, several systems have seen downtime due to vulnerabilities or attacks.
A similar kind of privilege escalation bug took down the Centralized Zone Data Service last April.
The RADAR service for registrars was offline for two weeks after being hacked last May.
A phishing attack against ICANN staff in December enabled hackers to view information not normally available to the public.

The IANA transition in a nutshell

The US plan to remove itself from its unique DNS oversight role is about creating a coalition of nations to thwart attempts by Russia and other “authoritarian” countries to increase government control of the internet.
That’s according to Larry Strickling, assistant secretary at the US National Telecommunications and Information Administration, who delivered a beautifully succinct explanation to confused senators at a hearing in Washington DC this week.
Despite unnecessary diversions into issues such as net neutrality and copyright protection — which I’m sure was not at all due to senators trying to score points with their corporate paymasters — the Commerce Committee hearing was surprising well-informed and not nearly as angry as it could have been.
Senators, mostly Republicans, reiterated their concerns that for the US to give up its role in the IANA functions contract could invite a takeover of ICANN by unfriendly nations such as China and Russia, thereby harming internet freedom.
At one point, Strickling was asked by a senator: “If there’s not a problem, what are we trying to fix here?”
His answer was one the best explanations of the political back-story of the transition that I’ve heard, so I’m going to quote it in full here.

There has been a problem, sir. At the end of 2012 when the world’s governments got together in Dubai for the ITU WCIT — World Conference on International Telecommunications — you had around 80 countries who voted to say the ITU needs to be more involved in internet governance. These were largely countries in the developing world siding with the more authoritarian regimes.
Part of the impetus for this was the continued irritation that many governments have, that has been exploited by authoritarian countries, that the United States with its special role with ICANN is in a position to control the internet in these developing counties and to turn it off in these countries and to otherwise interfere with the ability of countries to manage their own affairs with respect to the internet.
After this [IANA transition] announcement was made the next two large international meetings at which governments came together you saw a major change in position among the developing countries. We didn’t see any change in position from the authoritarian countries — and you’re not, they’re not going to change their views on this. But the key to succeeding in this on the global stage is to bring the rest of the world along with us, and that’s what we saw at the NETmundial conference in Brazil last April where the only countries who spoke out against the multi-stakeholder model of internet governance were Russia and Cuba.
We then flash forward to the ITU plenipotentiary conference in Busan last November and again you had Russia with the same proposals it’s been making for 10 years: that these functions ought to be transferred to the ITU and managed by governments. And that was beaten back by a coalition of developed and developing countries. So we’ve seen immediate results, or significant results, by the basis of our having been able to take this issue off the table for these countries, to get them to look at what’s really best for them without this overhang of a US role that was unique among governments and which was a source of irritation to governments and was being exploited to our detriment by foreign governments.
The fact of the matter is that the role we play with respect of the IANA functions is a clerical role. It’s truly stewardship. As I said before, we don’t provide any oversight of the policy judgments that ICANN and the multi-stakeholder community make. We participate as a government in the Governmental Advisory Committee, and we will continue to do that in future and will be vigorous advocates for a free and open internet.
The special role we play with respect of the IANA functions is totally administrative and clerical, yet it has been exploited by other governments — authoritarian governments — to our detriment. We’ve taken that off to the table by announcing this transition and as we complete it we will continue to see the benefits of that through the continued adoption and support for this model by the developing world.

His views were echoed by ICANN CEO Fadi Chehade more than once during the hearing, talking about how the transition process is designed to bring on board the “middle countries”, rather than already-allied nations or the fringe, minority authoritarian countries.
He cited Brazil as the key example of a government once in favor of more ITU control of the internet that is now, largely due to Chehade’s outreach and its key role in the NETmundial conference, firmly in the multi-stakeholder model camp.
The entire archived hearing can be viewed here.

Google buys .app for over $25 million

The fiercely competed new gTLD .app has sold to Google for a record-breaking $25 million.
The company’s Charleston Road Registry subsidiary beat out 12 other applicants for the string, including Donuts, Amazon, Famous Four Media, Radix and Afilias.
The auction lasted two days and fetched a winning bid of $25,001,000, more than any other new gTLD to date.
The previous high is believed to be .blog, which I estimate sold for less than $20 million.
Because it was an ICANN-run “last resort” auction, all of the money goes into ICANN’s special auction proceeds fund, which previously stood at just shy of $35 million.
Previous ICANN auctions have fetched prices between $600,000 and $6,760,000.
Google originally proposed .app as a closed registry in which only Google and its partners could register names.
However, after the Governmental Advisory Committee pressured ICANN to disallow “closed generics”, Google changed its application to enable anyone to register.

ICANN ditches plan to give governments more power

ICANN has quietly abandoned a plan to make it harder for its board of directors to go against the wishes of national governments.
A proposal to make a board two-thirds super-majority vote a requirement for overruling advice provided by the Governmental Advisory Committee is now “off the table”, ICANN CEO Fadi Chehade told a US Senate committee hearing today.
The threshold, which would replace the existing simple majority requirement, was proposed last August as a result of talks in a board-GAC working group.
At the time, I described the proposal as a “fait accompli” — the board had even said it would use the higher threshold in votes on GAC advice in advance of the required bylaws change.
But now it’s seemingly gone.
The news emerged during a hearing of the Senate Committee on Commerce, Science, and Transportation today in Washington DC, which was looking into the transition of US oversight of ICANN’s IANA functions to a multi-stakeholder process.
Asked by Sen. Deb Fischer whether the threshold change was consistent with ICANN’s promise to limit the power of governments in a post-US-oversight world, Chehade replied:

You are right, this would be incongruent with the stated goals [of the IANA transition]. The board has looked at that matter and has pushed it back. So it’s off the table.

That came as news to me, and to others listening to the hearing.
The original plan to change the bylaws came in a board resolution last July.
If it’s true that the board has since changed its mind, that discussion does not appear to have been documented in any of the published minutes of ICANN board meetings.
If the board has indeed changed its mind, it has done so with the near-unanimous blessing of the rest of the ICANN community (although I doubt the GAC was/will be happy).
The public comment period on the proposal attracted dozens of responses from community members, all quite vigorously opposed to the changes.
The ICANN report on the public comments was due October 2, so it’s currently well over four months late.
UPDATE 1: An ICANN spokesperson just got in touch to say that the board decided to ditch its plan in response to the negative public comments.
UPDATE 2: Another ICANN spokesperson has found a reference to the board’s U-turn in the transcript of a meeting between the ICANN board and GAC at the Los Angeles public meeting last October. A brief exchange between ICANN chair Steve Crocker and Heather Dryden, then chair of the GAC, reads:

DRYDEN: On the issue of the proposed bylaw changes to amend them to a third — two-thirds majority to reject or take a decision not consistent with the GAC’s advice, are there any updates there that the Board would like to — the Board or NGPC? I think it’s a Board matter? Yes?
CROCKER: Yes.
Well, you’ve seen the substantial reaction to the proposal.
The reaction embodies, to some extent, misunderstanding of what the purpose and the context was, but it also is very instructive to all of us that the timing of all this comes in the middle of the broader accountability question.
So it’s — I think it’s in everyone’s interest, GAC’s interest, Board’s interest, and the entire community’s interest, to put this on hold and come back and revisit this in a larger context, and that’s our plan.

So it seems that the ICANN board did tip its hand a few months ago, but not many people, myself included, noticed.

Why you can’t register emojis in gTLDs

The popular “emoji” smiley faces are banned as gTLD domain names for technical reasons, according to ICANN.
Emojis are a form of emoticon that originated on Japanese mobile networks but are now used by 12-year-old girls worldwide due to their support on Android and iPhone operating systems.
It emerged last week that Coca-Cola has registered a bunch of smiley-face domain names under .ws, the Samoan ccTLD, for use in an billboard advertising campaign in Puerto Rico.
.ws was selected because it’s one of only a few TLDs that allow emojis to be registered. Coke is spinning its choice of TLD as an abbreviation for “We Smile”.
This got me thinking: would emojis be something new gTLD registries could start to offer in order to differentiate themselves?
Coke’s emoji domains, it turns out, are just a form of internationalized domain name, like Chinese or Arabic or Greek.
Emoji symbols are in the Unicode standard and could therefore be converted to the ASCII-based, DNS-compatible Punycode under the hood in web browsers and other software.
One of Coke’s (smiley-face).ws domain names is represented as xn--h28h.ws in the DNS.
Unfortunately for gTLD registries, ICANN told DI last night that emojis are not permitted in gTLDs.
“Emoticons cannot be used as IDNs as these code points are DISALLOWED under IDNA2008 protocol,” ICANN said in a statement.
IDNA2008 is the latest version of the IETF standard used to define what Unicode characters can and cannot appear in IDNs.
RFC 5892 specifies what can be included in an IDNA2008 domain name, eliminating thousands of letters and symbols that were permissible under the old IDNA2003 standard.
These characters were ostensibly banned due to the possibility of IDN homograph attacks — when bad guys set up spoof web sites on IDNs that look almost indistinguishable from a domain used by, for example, a bank or e-commerce site.
But Unicode, citing Google data, reckons symbols could only ever be responsible for 0.000016% of such attacks. Most homograph attacks are much simpler, relying on for example the visual similarity of I and l.
Regardless, because IDNA2008 only allows Unicode characters that are actually used in spoken human languages, and because gTLD registries are contractually obliged to adhere to the IDNA2008 technical standards, emojis are not permitted in gTLDs.
All new gTLDs have to provide ICANN with a list of the Unicode code points they plan to support as IDNs when they undergo pre-delegation testing. Asking to support characters incompatible with IDNA2008 would result in a failed test, ICANN tells us.
ICANN does not regulate ccTLDs, of course, so the .ws registry is free to offer whatever domains it wants.
However, ICANN said that emoji domains are only currently supported by software that has not implemented the newer IDN protocol:

Emoticon domains only work in software that has not implemented the latest IDNA standard. Only the older, deprecated version of the IDNA standard allowed emoticons, more or less by accident. Over time, these domains will increasingly not work correctly as software vendors update their implementations.

So Coke, while winning brownie points for novelty, may have registered a bunch of damp squibs.
ICANN also told us that, regardless of what the technical standards say, you’d never be able to apply for an emoticon as a gTLD due to the “letters only” principle, which already bans numbers in top-level strings.

Crocker caught with his pants down, literally, at ICANN 52

Here’s your daily WTF moment, courtesy of ICANN’s official YouTube account.
If you’ve ever wanted to see ICANN chair Steve Crocker without his trousers — and let’s face it, who hasn’t? — now’s your chance.

Don’t ask. I’m just as baffled as you.

Chehade to face Congressional grilling this week

ICANN CEO Fadi Chehade is heading to Washington DC this week to defend plans to decouple the organization from formal US oversight in front of a potentially hostile committee of Congresspeople.
The Senate Committee on Commerce, Science, and Transportation will meet this Wednesday at 1000 local time to grill Chehade and others on the plan to remove the US government from the current triumvirate responsible for managing changes to the DNS root zone under the IANA arrangements.
He will be joined by Larry Strickling, who as head of the National Telecommunications and Information Administration is the US government’s point person on the transition, and Ambassador David Gross, a top DC lawyer formerly with the Department of State.
All three men are pro-transition, while the Republican-tilted committee is likely to be much more skeptical.
The blurb for the Wednesday hearing reads:

As the U.S. government considers relinquishing control over certain aspects of Internet governance to the private sector, concerns remain that the loss of U.S. involvement over the Internet Assigned Numbers Authority (IANA) could empower foreign powers — acting through intergovernmental institutions or other surrogates — to gain increased control over critical Internet functions.

Republicans and right-leaning media commentators have warned that handing over IANA oversight to a multistakeholder body risks giving too much power to governments the US doesn’t like, such as Russia and China.
Several bills introduced in the House and Senate over the last year would have given Congress much more power to delay or deny the transition.
An amendment to an appropriations bill approved in December prevents the NTIA from spending any taxpayer money on relinquishing its DNS root oversight role until after September 30 this year, the same day that the current IANA contract expires.
This effectively prevents a transition during the current IANA contract’s run. Strickling recently said that the NTIA is complying with this legislation, but noted that it does not prevent the agency participating in the development of the transition proposal.
ICANN community working groups are currently working on plans for ICANN oversight post-NTIA and for addressing ICANN accountability.
These documents are hoped to be ready to sent to the NTIA by July, so the NTIA will have enough time to consider them before September 30.
Strickling recently addressed this date in a speech at the State of the Net conference in Washington, saying:

I want to reiterate again that there is no hard and fast deadline for this transition. September 2015 has been a target date because that is when the base period of our contract with ICANN expires. But this should not be seen as a deadline. If the community needs more time, we have the ability to extend the IANA functions contract for up to four years. It is up to the community to determine a timeline that works best for stakeholders as they develop a proposal that meets NTIA’s conditions, but also works.

Opponents of the transition say that because the NTIA is prevented from terminating the IANA contract before October 1, the NTIA will have no choice but to extend it until September 30, 2017.
Given that 2016 is a presidential election year in the US, Barack Obama would be a private citizen again by the time the next opportunity to transition comes around, they say.
Which presidential hopeful — from either party — would not buckle if asked whether he supports a plan to let Iran run the internet? That’s the political logic at work here.
Chehade himself told the AFP news agency earlier this month that the transition would have to happen before the 2016 elections, to avoid political distractions.
I’m not so sure I agree with the premise that, due to the restraints imposed by the appropriation bill, the transition now has to happen under the next president’s administration.
In my layman’s reading of the current IANA contract, the NTIA is able to terminate it for the “convenience of the government” pretty much whenever it wants.
There’s also an option to extend the contract by up to six months. The NTIA exercised this option in March 2012 when it did not approve of ICANN’s first renewal proposals.

Renewals at 55% as first new gTLD junk drop begins

The first new gTLD to go live is seeing its first-year renewals at 55% one year after hitting general availability.
dotShabaka Registry’s شبكة. (or “.shabaka”, the Arabic for “.web”) has also seen its zone file shrink by about 27% over the last two weeks.
The zone peaked at 2,069 domains on February 1, 2015, but today stands at 1,521. Exactly one year ago, it was at 1,561 names.
The zone is smaller today than it was just two weeks after GA began, in other words.
“We can confirm we’re seeing renewal rates for names due in February at around 55%,” Adrian Kinderis, CEO of ARI Registry Services, which runs .shabaka’s back-end, told DI in a statement.
The registry added 1,608 domains in February 2014, 1,400 of those in the first half of the month.
The 55% is the number of domains that were renewed before their February expiry date. The full number for February will not be known until the grace period ends in mid-April.
“We have a handful of cancel renews and all other expired domains are in the auto-renew period,” he said. “It’s too early to examine the numbers for renews post-expiry date, but we expect this will increase the overall tally.”
“Given the market conditions we face in the region, the results align with our forecasts and we expect the numbers to improve for renewals due in the coming weeks and months,” he said.
In gTLDs, domains can enter a Auto Renew Grace Period for up to 45 days after expiration, during which they can still be renewed by their registrant and may or may not appear in the zone file.
It wouldn’t be fair on other new gTLD registries to read to much into these numbers, assuming they do not improve, as شبكة. is a bit of an unusual case.
It’s seen low registration volume, despite the apparently attractive string, largely because it’s restricted to Arabic script at the second level and the Arabic-speaking market is in its infancy.
When شبكة. launched there were no registrars offering an end-to-end Arabic shopping cart, Kinderis said. He added:

The most significant problem still remains demand and consumer awareness…
In regards to demand, the lack of awareness is a direct result of little to no marketing in the region. Apart from our own efforts, there has been little marketing or education programs deployed to increase awareness of new Top-Level Domains and Arabic script domain names.
We have even limited our marketing efforts because we identified early that market readiness is inadequate. Any large investment in marketing from dotShabaka Registry at the moment would be premature and wasteful until supply, demand and universal acceptance issues have been addressed.

He called on ICANN and its recently created Middle East Working Group to focus on ways to increase awareness and demand for domain names in the region. To date, it’s focused too much registrars and technical issues, he said.
شبكة. has its own set of issues and is probably not the best test case for new gTLDs in general.
That’s going to come soon. Donuts’ first batch of gTLDs — .guru, .bike, .holdings, .plumbing, .singles, .ventures and .clothing — had their base-price GA anniversary on February 4, and it appears that domains have already started to drop.
There’s little indication of anything amiss in the .guru zone file so far but the other six are down slightly — by maybe 100 or so names apiece, or less than 1% each — over the last two weeks.
Donuts executives have said they expect first-year renewals to be strong, but we’ve got a few weeks left before anyone will be in a position to know for sure.