Name Collisions: Unanticipated Effects [Guest Post]

I attended the TLD Security Forum sponsored by Artemis in San Francisco five weeks ago. By happenstance, I became involved in a small group formed after the meeting that dedicated themselves to replicating the Interisle study (“Name Collisions in the DNS”) and carrying on with the next step in the analysis.
The work among competitors that occurred over the next four weeks was collaborative, intensive, and competent: an excellent example of how the multi-stakeholder model can accomplish significant work and publish it to the broad internet community in an effort to resolve an issue. It brought the right people together to accomplish more, faster than any other governance model would achieve.
Their work is easily identifiable among the many comments submitted on the name collision issue. Without offering an opinion on conclusions here, I note that the competence of work shines through and should be carefully considered.
The Interisle study sounded an alarm because it reported a potentially high number of domain name “collisions” that might result from the delegation of new gTLDs. The term “collision” is somewhat of a misnomer and the key issue, I think, is the use of search-list processing by companies in configuring their networks.
The Interisle report published the volumes of NX Domain responses by TLD and described possible harms but did not link harms to specific types of queries nor delve into the data in order to draw firm conclusions or propose mitigations.
There is nothing wrong with this –- the report was competently executed given the time available.
This is where several interested parties, mostly applicants, jumped in. In an impromptu meeting after the conference a half-dozen companies coordinated: the purchase of servers to analyze previously collected root-zone data (the “Day In The Life” or DITL data); acquisition of memberships in OARC, to whom the servers were donated; and the analysis of vast amounts of data.
Considerable time was spent redesigning queries in order to replicate the Interisle results from the DITL data so that the next step in the analysis would be seamless as the work transitioned from Interisle to this collaborative group.
Hypotheses were developed, queries written, data summarized and statistically tested. Every difference between the Interisle data and the newly analyzed data was discussed until the team was satisfied it would withstand public scrutiny.
The team met twice weekly in conference calls and traded numerous emails to flesh out technical details. Data scientists learned about the DNS, DNS experts learned about z-tests and the effects of non-standard distributions.
The team agreed to publish the data, which it has, so that anyone could perform analysis similar to that done by this team.
For me, these technical discussions brought to mind the reaffirmation of the effectiveness of the ICANN model that occurred as a result of this issue. Work continues and will be discussed at the next TLD Security Conference on October 1st in Washington, DC.
This is a guest post written by Kurt Pritz, ICANN’s former chief strategy officer. He is currently an independent consultant working with new gTLD applicants and others.

Crocker to speak at second gTLD collisions summit

ICANN chair Steve Crocker is among a packed line-up of speakers for an event on Tuesday that will address the potential security risks of name collisions in the new gTLD program.
It’s the second TLD Security Forum, which are organized by new gTLD applicants unhappy with ICANN’s proposal to delay hundreds of “uncalculated risk” applied-for gTLDs.
The first event, held in August, was notable for statements playing down the risk from the likes of Google and Digicert.
While Crocker is scheduled to speak on Tuesday, anyone expecting insight into the ICANN board’s thinking on name collisions is likely to be disappointed.
The title of his talk is “The Current State of DNSSEC Deployment”, which isn’t directly relevant to the issue.
Crocker, due to conflicts of interest protections, is also not a member of ICANN’s New gTLD Program Committee, which is tasked with making decisions about the collision problem.
While Crocker’s views may wind up remaining private, we can’t say the same for Amy Mushahwar and Dan Jaffe, representing the Association of National Advertisers, both of whom are also speaking.
The ANA is firmly in the Verisign camp on this issue, claiming that gTLD name collisions create unacceptable security risks for organizations on the internet.
Also on the line-up for Tuesday are Laureen Kapin of the US Federal Trade Commission and Gabriel Rottman of the American Civil Liberties Union, both of whom could bring new perspectives to the debate.
The TLD Security Forum begins at 9am at the Washington Hilton and Heights Meeting Center in Washington, DC. It’s free to attend and will be webcast for those unable to show up in person.

Samsung signs the first dot-brand gTLD contract

Samsung has become the first company to sign a Registry Agreement for a dot-brand gTLD.
As of yesterday, the electronics giant is now officially contracted with ICANN to run .삼성, its name in its native Korean.
It’s surprising that Samsung would be the first; while its application has priority number 18, its application also makes it pretty obvious it’s a primarily defensive move, reading:

The new gTLD proposed by SAMSUNG SDS has purpose in protecting online brand of SAMSUNG Group including SAMSUNG by defending abusive registration by third parties and further raising global awareness by domain usage utilizing company name.

The contract has not yet been published in full — expect that over the next few days — so it’s not yet clear whether Samsung has managed to negotiate any special dot-brand-specific amendments.
The base Registry Agreement contains lots of obligations, such as Sunrise periods, that really aren’t applicable to single-registrant spaces.
I understand the new Brand Registry Group is currently trying to negotiate a baseline set of dot-brand amendments with ICANN, so it’s possible that Samsung has jumped the gun by signing so soon.
But it could also mean that .삼성 will be the first-ever dot-brand TLD to go live on the internet, which is likely to benefit from substantial media coverage compared to subsequent delegations.
ICANN has signed 48 new gTLD contracts since July, way behind its originally target of 40 per week.
.삼성 will have its back-end registry managed by .kr ccTLD operator KISA.

newdomains.org ticket compo winners announced

The winners of the recent DI prize draw, with three free tickets for the newdomains.org conference at stake, have been confirmed.
To enter the competition, you simply had to leave a comment on DI completing the sentence “The biggest challenge facing new gTLDs next year will be…”
I read all the submissions and found them all interesting but ultimately the comments were completely irrelevant in determining the winners, which were selected by three random numbers generated by Random.org.
The winners were:

• Colin Campbell of .CLUB Domains.
• Jeffrey Sass of .CLUB Domains.
• Phil Buckingham of DotAdvice.

It definitely looks weird that two people from the same company won tickets. Weird enough that for half a second I wondered whether justice would be better serviced if were to fix a different outcome.
But I didn’t. If it looks unjust, blame randomness. Fate’s a bitch.
Many thanks to all who entered. There were some interesting comments.

Authentic Web wants to be dot-brands’ pocket registrar

Toronto-based start-up Authentic Web launched today with a set of workflow automation tools for dot-brand gTLD registries.
Because ICANN requires all new gTLDs, even the closed ones, to make registrations via accredited registrars, there’s often talk about dot-brands signing up with “pocket” registrars.
That’s what Authentic Web wants to be, according to CEO Peter LaMantia. The company is focused on the dot-brand market.
The company’s new Brand Registry Asset Manager will provide a way for dot-brands to control the registration process workflow so that only approved second-level domains are registered, he said.
For example, a smaller dot-brand might have a single person responsible for registering all domains in the gTLD, while a multinational might have multiple layers of delegated power.
Instead of plonking down a credit card at Go Daddy to buy a .com domain, a marketing manager would place a request into the BRAM system and have it approved up a chain of command before the ultimate Add command was made with the registry.
Authentic Web would usually act as the registrar middleman, but the plan is to also integrate the software with third-party registrars.
The software will also give dot-brands greater visibility over their portfolios, LaMantia said.
Many big brands already have a hard time keeping track of their existing portfolios of domain names in gTLDs they do not control, he said.
“I know a lot of companies that do this on Excel sheets,” he said. “If they own the registry they’re not going to want to do that. That’s the hole in the market.”
BRAM is web-based and hosted by Authentic Web, so it won’t at first integrate with existing enterprise identity systems, though LaMantia said integration tools are on the road-map.
The software will be priced on a monthly subscription basis, with a per-domain component.
LaMantia, who founded Authentic Web last year, previously was president of the registrar Aplus.net.

ICANN to publish new gTLD contract changes

ICANN has decided to start publishing red-lined versions of its new gTLD Registry Agreements, so applicants can see what special terms ICANN is willing to accept.
It’s a reversal of its previous position, and follows complaints from applicants and back-end providers.
So far ICANN has signed almost 50 new gTLD contracts, all of which have been published, but it’s not easy to compare them all to the baseline Registry Agreement found in the Applicant Guidebook.
By publishing versions with the changes highlighted, applicants will be able to go into contract negotiations with a better idea of how far ICANN is willing to bend.
ICANN said today:

Upon further consideration, ICANN has concluded that publishing redlined versions of Registry Agreements would be helpful to the entire ICANN community, and would also support ICANN’s efforts to provide operational transparency.

It added that so far there have been no substantial changes in the contracts it’s signed, apart from gTLD-specific Public Interest Commitments and approved Registry Services.
It will start publishing the redlines next month.

Donuts’ trademark block list goes live, pricing revealed

Donuts’ Domain Protected Marks List, which gives trademark owners the ability to defensively block their marks across the company’s whole portfolio of gTLDs, has gone live.
The service goes above and beyond what new gTLD registries are obliged to offer by ICANN.
As a “block” service, in which names will not resolve, it’s reminiscent of the Sunrise B service offered by ICM Registry at .xxx’s launch, which was praised and cursed in equal measure.
But with DPML, trademark owners also have the ability to block “trademark+keyword” names, for example, so Pepsi could block “drinkpepsi” or “pepsisucks”.
It’s not a wildcard, however. Companies would have to pay for each trademark+keyword string they wanted blocking.
DPML covers all of the gTLDs that Donuts plans to launch, which could be as many as 300. It currently has 28 registry agreements with ICANN and 272 applications remaining in various stages of evaluation.
Trademark owners will only be able to sign up to DPML if their marks are registered with the Trademark Clearinghouse under the “use” standard required to participate in Sunrise periods.
Donuts is also excluding an unspecified number of strings it regards as “premium”, so the owners of marks matching those strings will be out of luck, it seems.
Blocks will be available for a minimum of five years an maximum of 10 years. After expiration, they can be renewed with minimum terms of one year.
The company has not disclose its wholesale pricing, but registrars we’ve found listing the service on their web sites so far (101domain and EnCirca) price it between $2,895 and $2,995 for a five-year registration.
It looks pricey, but it’s likely to be extraordinarily good value compared to the alternative of Sunrise periods.
If Donuts winds up with 200 gTLDs in its portfolio, a $3,000 price tag ($600 per year) works out to a defensive registration cost of $3 per domain per gTLD per year.
If it winds up with all 300, the price would be $2.
That’s in line (if we’re assuming non-budget pricing comparisons and registrars’ DPML markup), with Donuts co-founder Richard Tindal’s statement earlier this year: that DPML would be 5% to 10% the cost of a regular registration.
Tindal also spoke then about a way for rival trademark owners to “unblock” matching names, so Apple the record company could unblock a DPML on apple.music obtained by Apple the computer company, for example.
Donuts is encouraging trademark owners to participate before its first gTLDs goes live, which it expects to happen later this year.

CentralNic reports profitable first half

CentralNic today issued its first financial statements since floating on London’s Alternative Investment Market earlier this month.
The company is profitable, reporting profit before tax for the first half of 2013 that almost doubled to $636,000 on revenue that was up 16% at £1,735 million ($2.7 million).
Revenue was down substantially and profit more or less flat sequentially, however. In the second half of 2012, the company took profits of £593,000 on revenue of £2.9 million ($4.6 million).
Seasonality? One-time fees from its new gTLD applicant clients? CentralNic didn’t say.
The H12013 results do not include any revenue from its deal with Go Daddy, which started selling .la domains in July, but it did include revenue from partnerships with two Chinese registrars.
Chairman John Swingewood said in a statement to the market:

The Company is undergoing sustained growth resulting from increased demand for our domain names, establishing new retail channels and securing new inventory. What is more impressive is that these results are yet to include revenues from sales of our pipeline of new Top-Level Domains, which include .college, .bar, .wiki and .xyz, for which the first launch activities are due to start at the end of the year.

The company, which is signed up to provide back-end registry services for 14 uncontested and 39 contested new gTLDs, raised £5 million in its IPO on September 3.

Nine more new gTLD contracts signed

ICANN signed nine more new gTLD Registry Agreements yesterday.
The contracts cover .kiwi, .futbol, .kitchen, .directory, .diamonds, .tips, .today, .enterprises, and .photography.
All but .kiwi, which will be run by Dot Kiwi Ltd, were Donuts’ applications.
ICANN now has Registry Agreements with registries to manage 45 new gTLDs.

One IE pass, one fail this week

ICANN is down to 18 new gTLD applications in Initial Evaluation now, after one pass and one failure this week.
The pass is the dot-brand .lplfinancial, applied for by LPL Financial, a US-based broker. The company already owns the arguably better domain lpl.com.
The failure, which is eligible for Extended Evaluation, is Top Level Domain Holdings’ geographic bid for .roma, a city TLD for Rome, Italy.
The application failed on geographic grounds, meaning TLDH seems to have failed to provide sufficient evidence of government support or non-objection.
It’s TLDH’s final IE result and the only one of its 70 applications to fail to achieve a passing score.