ICANN opens up Pandora's Box of new TLDs

[Jim Popovitch]

Two years ago I posed the question here about the need for TLDs
(http://www.mcabee.org/lists/nanog/May-06/msg00110.html).
I summerizsed that companies IP (Intellectual Property) guidelines
would never allow domain.org to exist if they owned domain.com
(ibm.org vrs ibm.com). I felt that TLDs really represented a
monetary harvesting scheme as every new TLD forced companies to "pay
for yet another domain name" (slowly milking businesses). At that
time several knowledgeable folks commented that TLDs were necessary
in the beginning due to the need to distribute queries. Now it
seems, ICANN has decided to add a new paradigm :-) How will a TLD
like .ibm be handled now, and how is this different than what I
proposed in 2006?

-Jim P.

[Jay R. Ashworth]

Post by Jim Popovitch
Two years ago I posed the question here about the need for TLDs
(http://www.mcabee.org/lists/nanog/May-06/msg00110.html). I
summerizsed that companies IP (Intellectual Property) guidelines
would never allow domain.org to exist if they owned domain.com
(ibm.org vrs ibm.com). I felt that TLDs really represented a monetary
harvesting scheme as every new TLD forced companies to "pay for
yet another domain name" (slowly milking businesses). At that time
several knowledgeable folks commented that TLDs were necessary in the
beginning due to the need to distribute queries. Now it seems, ICANN
has decided to add a new paradigm :-) How will a TLD like .ibm be
handled now, and how is this different than what I proposed in 2006?

Could someone point me to a reference (other than a very poorly written
BBC article) that suggests that .ibm is even a valid possiblity in
light of whatever ICANN actually *is* proposing?

And no, companies *aren't* "forced to pay for another domain name" just
because a new TLD appears -- they aren't doing it *now*, by and large,
and thank ghod: a) it doesn't constitute a violation of Ford Motor's
trademark that the Ford Foundation has ford.org or a Mustang club has
ford.net and b) it's horrible DNS hygiene to do that in the first
place; it re-flattens the TLD namespace. I certainly advise my clients
not to do things that foolish. I'm sure Randy encourages me in this.

Cheers,
-- jra

[Martin Hannigan]

Post by Jay R. Ashworth
And no, companies *aren't* "forced to pay for another domain name" just
because a new TLD appears -- they aren't doing it *now*, by and large,

The last time I looked there were a few thousand companies protecting their intellectual property by using companies like Mark Monitor to insure that they had defensive registrations in all ccTLD's possible.

-M<

[Owen DeLong]

Post by Martin Hannigan

Post by Jay R. Ashworth
And no, companies *aren't* "forced to pay for another domain name" just
because a new TLD appears -- they aren't doing it *now*, by and large,

The last time I looked there were a few thousand companies
protecting their intellectual property by using companies like Mark
Monitor to insure that they had defensive registrations in all
ccTLD's possible.
-M<

Whether some choose to do that or not, I believe that the point is that:

1. Nobody is FORCING them to do so.

2. Most are _NOT_ doing so.

3. It is somewhat anti-social to do so, but, that has rarely been a
constraint on corporate greed, especially amongst the Intelectual
Property crowd.

Owen

[Ken Simpson]

Has anyone been able to figure out what it will cost to secure a
completely un-contested tld? I haven't been able to find proposed fees
anywhere. I think it will be a practical necessity for all
organizations to secure their own TLD at the outset, lest someone else
secure it for them and leave it up to the court of arbitration.

.. And where, pray-tell, will the mega cash from the TLD auctions be
going? Surely ICANN doesn't need a multi-billion $ annual budget, but
if these TLD auctions go the way of the cellular auctions, there's a
good potential for that kind of an outcome.

[Marshall Eubanks]

Hello;

Post by Ken Simpson
Has anyone been able to figure out what it will cost to secure a
completely un-contested tld? I haven't been able to find proposed
fees anywhere. I think it will be a practical necessity for all
organizations to secure their own TLD at the outset, lest someone
else secure it for them and leave it up to the court of arbitration.
.. And where, pray-tell, will the mega cash from the TLD auctions be
going? Surely ICANN doesn't need a multi-billion $ annual budget,
but if these TLD auctions go the way of the cellular auctions,
there's a good potential for that kind of an outcome.

This gives an (unofficial) estimate :

<http://arstechnica.com/news.ars/post/20080626-confusion-icann-opens-up-pandoras-box-of-new-tlds.html
.confusion: ICANN opens up Pandora's Box of new TLDs
By Jacqui Cheng | Published: June 26, 2008 - 12:11PM CT

<snip>
Not every zany TLD will be immediately available to anyone who want to
register a domain, however. Businesses must apply to register the TLD
first, then go through a review process to ensure that it isn't
offensive and doesn't infringe on anyone's intellectual property. If
approved, registering the TLD will cost anywhere from $100,000 to
$500,000, ICANN says, and the business or organization must prove that
they are either capable of managing the TLD or can reach a deal with a
company that will. This is no small beans—unless you're planning to
fork over up to half a million dollars and put in the labor to manage
everything that appears under the TLD, this task is probably best left
to large organizations and governmental entities. The organization
registering the TLD will also be responsible for determining whether
it will be restricted to certain types of sites or open to the public.
<snip>

Regards
Marshall

[Ken Simpson]

Post by Marshall Eubanks
<http://arstechnica.com/news.ars/post/20080626-confusion-icann-opens-up-pandoras-box-of-new-tlds.html
.confusion: ICANN opens up Pandora's Box of new TLDs
By Jacqui Cheng | Published: June 26, 2008 - 12:11PM CT
<snip>
Not every zany TLD will be immediately available to anyone who want
to register a domain, however. Businesses must apply to register the
TLD first, then go through a review process to ensure that it isn't
offensive and doesn't infringe on anyone's intellectual property. If
approved, registering the TLD will cost anywhere from $100,000 to
$500,000, ICANN says, and the business or organization must prove
that they are either capable of managing the TLD or can reach a deal
with a company that will. This is no small beans—unless you're
planning to fork over up to half a million dollars and put in the
labor to manage everything that appears under the TLD, this task is
probably best left to large organizations and governmental entities.
The organization registering the TLD will also be responsible for
determining whether it will be restricted to certain types of sites
or open to the public.
<snip>

Thanks for the info. Okay, well that kind of pricing will prevent most
of the fraudsters from obtaining TLDs. But of course it doesn't
prevent shady operators from setting up a TLD with lenient abuse
controls - such as .info or .to. Imagine 40 .infos spamming away...

[Marshall Eubanks]

Post by Ken Simpson

Post by Marshall Eubanks
<http://arstechnica.com/news.ars/post/20080626-confusion-icann-opens-up-pandoras-box-of-new-tlds.html
.confusion: ICANN opens up Pandora's Box of new TLDs
By Jacqui Cheng | Published: June 26, 2008 - 12:11PM CT
<snip>
Not every zany TLD will be immediately available to anyone who want
to register a domain, however. Businesses must apply to register
the TLD first, then go through a review process to ensure that it
isn't offensive and doesn't infringe on anyone's intellectual
property. If approved, registering the TLD will cost anywhere from
$100,000 to $500,000, ICANN says, and the business or organization
must prove that they are either capable of managing the TLD or can
reach a deal with a company that will. This is no small beans—
unless you're planning to fork over up to half a million dollars
and put in the labor to manage everything that appears under the
TLD, this task is probably best left to large organizations and
governmental entities. The organization registering the TLD will
also be responsible for determining whether it will be restricted
to certain types of sites or open to the public.
<snip>

Thanks for the info. Okay, well that kind of pricing will prevent
most of the fraudsters from obtaining TLDs. But of course it doesn't
prevent shady operators from setting up a TLD with lenient abuse
controls - such as .info or .to. Imagine 40 .infos spamming away...

What I wonder is what that amount is going to ? Is that a fee, or is it
an estimate of what it would take to set up a registrar ?

If it is the latter, GoDaddy or Network Solutions may start offering
TLDs for a lot less. I don't see much
of an intrinsic reason why it should be more than 1 hour of person
time to evaluate, thus a cost in the $ 100's
of USDs, plus ongoing registry costs. This

https://par.icann.org/files/paris/GNSO-gTLD-Update-Paris22jun08.pdf

makes it look like much of the process could be automated.

Regards
Marshall

[Jeff Shultz]

1. Nobody is FORCING them to do so.
2. Most are _NOT_ doing so.
3. It is somewhat anti-social to do so, but, that has rarely been a
constraint on corporate greed, especially amongst the Intelectual
Property crowd.
Owen

On that note, it will be very interesting to see who manages to register
the *.sucks TLD, and what they do with it.

[Ken Simpson]

Post by Jeff Shultz
On that note, it will be very interesting to see who manages to
register the *.sucks TLD, and what they do with it.

Oooh -- dibs on that one. And .some, so you can register awe.some,
trouble.some, and fear.some. And .ous, which would allow humm.ous,
seri.ous, fabul.ous, etc..

Oh - vomit - this is gonna hurt.

Regards,
Ken

[Chris Adams]

Post by Ken Simpson
Oooh -- dibs on that one. And .some, so you can register awe.some,
trouble.some, and fear.some. And .ous, which would allow humm.ous,
seri.ous, fabul.ous, etc..

Somebody on /. mentioned .dot, so you could tell someone to go to:

eych tee tee pee colon slash slash slash dot dot dot

[Ian Mason]

Post by Chris Adams

Post by Ken Simpson
Oooh -- dibs on that one. And .some, so you can register awe.some,
trouble.some, and fear.some. And .ous, which would allow humm.ous,
seri.ous, fabul.ous, etc..

eych tee tee pee colon slash slash slash dot dot dot

Or .dash ...

[V***@vt.edu]

Post by Ken Simpson

Post by Jeff Shultz
On that note, it will be very interesting to see who manages to
register the *.sucks TLD, and what they do with it.

Oooh -- dibs on that one. And .some, so you can register awe.some,
trouble.some, and fear.some. And .ous, which would allow humm.ous,
seri.ous, fabul.ous, etc..
Oh - vomit - this is gonna hurt.

A cow-orker of mine said:

"How about .dot? I'd like to set up a hostname of dotdot.dashdashdashdot.dot"

[Joe Abley]

Post by V***@vt.edu
"How about .dot? I'd like to set up a hostname of
dotdot.dashdashdashdot.dot"

To my mind, Tony Finch owns you all :-)

http://dotat.at/
***@dotat.at


Joe

[Tony Finch]

Post by Joe Abley
To my mind, Tony Finch owns you all :-)
http://dotat.at/

The Austrians should not have given up on their hierarchial naming scheme.

Tony.

[Jay R. Ashworth]

Post by Joe Abley

Post by V***@vt.edu
"How about .dot? I'd like to set up a hostname of
dotdot.dashdashdashdot.dot"

To my mind, Tony Finch owns you all :-)
http://dotat.at/

Well, I believe the gent whose email is "***@3.am" is tied with him...

Cheers,
-- jra

[Marshall Eubanks]

I see an auction on that one.

Marshall

Post by Jeff Shultz

1. Nobody is FORCING them to do so.
2. Most are _NOT_ doing so.
3. It is somewhat anti-social to do so, but, that has rarely been a
constraint on corporate greed, especially amongst the Intelectual
Property crowd.
Owen

On that note, it will be very interesting to see who manages to
register the *.sucks TLD, and what they do with it.
--
Jeff Shultz

[Tomas L. Byrnes]

Followed by .bites

And .rules and .rules

And so the DNS descends into anarchy, and search engines become more
empowered.

Cacophony merely empowers those who control the amp.

-----Original Message-----
Sent: Thursday, June 26, 2008 5:20 PM
To: Jeff Shultz
Cc: NANOG list
Subject: Re: ICANN opens up Pandora's Box of new TLDs
I see an auction on that one.
Marshall

Post by Jeff Shultz

1. Nobody is FORCING them to do so.
2. Most are _NOT_ doing so.
3. It is somewhat anti-social to do so, but, that has rarely been a
constraint on corporate greed, especially amongst the

Intelectual

Post by Jeff Shultz

Property crowd.
Owen

On that note, it will be very interesting to see who manages to
register the *.sucks TLD, and what they do with it.
--
Jeff Shultz

[Jon Kibler]

Post by Jeff Shultz
On that note, it will be very interesting to see who manages to register
the *.sucks TLD, and what they do with it.

Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using the logic
that .LOCAL is safe because it cannot be resolved by the root name servers.

Who wants to be the first to try to register *.local?

Jon
- --
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC USA
o: 843-849-8214
c: 843-224-2494
s: 843-564-4224

My PGP Fingerprint is:
BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253

[Marshall Eubanks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Post by Jeff Shultz
On that note, it will be very interesting to see who manages to register
the *.sucks TLD, and what they do with it.

Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using the logic
that .LOCAL is safe because it cannot be resolved by the root name servers.
Who wants to be the first to try to register *.local?

They should have been following RFC 2606.

Regards
Marshall

Jon
- --
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC USA
o: 843-849-8214
c: 843-224-2494
s: 843-564-4224
BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkhksPAACgkQUVxQRc85QlMeBACfdWAQcIvJl/CGsi099BDHtFfn
i/cAnAwA/VJoraiGJVgEb+7Xu5ZoHDvr
=h1Jn
-----END PGP SIGNATURE-----

[Jon Kibler]

Post by Jon Kibler

Post by Marshall Eubanks

Post by Jeff Shultz
On that note, it will be very interesting to see who manages to register
the *.sucks TLD, and what they do with it.

Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using the logic
that .LOCAL is safe because it cannot be resolved by the root name servers.
Who wants to be the first to try to register *.local?

Post by Marshall Eubanks
They should have been following RFC 2606.
Regards
Marshall

Thinking about it a little more, what about the common use of
'localhost.localdomain' for 127.0.0.1 in most versions of *nix? I can
just imagine the chaos that registering a *.localdomain TLD will cause.

Methinks it is time to update RFC2606 to reflect common practices before
the new ICANN policies take effect.

Jon
- --
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC USA
o: 843-849-8214
c: 843-224-2494
s: 843-564-4224

My PGP Fingerprint is:
BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253

[Marshall Eubanks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Post by Jon Kibler

Post by Marshall Eubanks

Post by Jeff Shultz
On that note, it will be very interesting to see who manages to register
the *.sucks TLD, and what they do with it.

Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using the logic
that .LOCAL is safe because it cannot be resolved by the root name servers.
Who wants to be the first to try to register *.local?

Post by Marshall Eubanks
They should have been following RFC 2606.
Regards
Marshall

Thinking about it a little more, what about the common use of
'localhost.localdomain' for 127.0.0.1 in most versions of *nix? I can
just imagine the chaos that registering a *.localdomain TLD will cause.

.localhost is already reserved through RFC 2606, so this should not be
a problem. To quote :
The ".localhost" TLD has traditionally been statically defined in host
DNS implementations as having an A record pointing to the loop back IP
address and is reserved for such use. Any other use would conflict
with widely deployed code which assumes this use.

Methinks it is time to update RFC2606 to reflect common practices before
the new ICANN policies take effect.

If you can think of a list, it probably would...

Marshall

Jon
- --
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC USA
o: 843-849-8214
c: 843-224-2494
s: 843-564-4224
BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkhkxHAACgkQUVxQRc85QlPfmgCgiIUv7KYOz/U2vdk2DyA04D/O
8Q4An2wK8vilUCJne06qIn/67erB2rkt
=ih+F
-----END PGP SIGNATURE-----

[Lou Katz]

Post by Marshall Eubanks

Post by Jon Kibler

Post by Jon Kibler
Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using the logic
that .LOCAL is safe because it cannot be resolved by the root name servers.
Who wants to be the first to try to register *.local?

Post by Marshall Eubanks
They should have been following RFC 2606.
Regards
Marshall

Thinking about it a little more, what about the common use of
'localhost.localdomain' for 127.0.0.1 in most versions of *nix? I can
just imagine the chaos that registering a *.localdomain TLD will cause.

.localhost is already reserved through RFC 2606, so this should not be
The ".localhost" TLD has traditionally been statically defined in host
DNS implementations as having an A record pointing to the loop back IP
address and is reserved for such use. Any other use would conflict
with widely deployed code which assumes this use.

Post by Jon Kibler
Methinks it is time to update RFC2606 to reflect common practices before
the new ICANN policies take effect.

If you can think of a list, it probably would...

Having had the need to construct a few TLDs for internal use, I hope that some
new RFC will address this and reserve some (e.g. .internal, .internal# (where # is
any fully numeric string), .local)? I really don't care what they are called,
but I do need more than one.

Post by Marshall Eubanks
Marshall

Post by Jon Kibler
Jon

<snip>

[Marshall Eubanks]

Dear Lou;

Post by Lou Katz

Post by Marshall Eubanks

Post by Jon Kibler

Post by Jon Kibler
Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using the logic
that .LOCAL is safe because it cannot be resolved by the root name servers.
Who wants to be the first to try to register *.local?

Post by Marshall Eubanks
They should have been following RFC 2606.
Regards
Marshall

Thinking about it a little more, what about the common use of
'localhost.localdomain' for 127.0.0.1 in most versions of *nix? I can
just imagine the chaos that registering a *.localdomain TLD will cause.

.localhost is already reserved through RFC 2606, so this should not be
The ".localhost" TLD has traditionally been statically defined in host
DNS implementations as having an A record pointing to the loop back IP
address and is reserved for such use. Any other use would conflict
with widely deployed code which assumes this use.

Post by Jon Kibler
Methinks it is time to update RFC2606 to reflect common practices before
the new ICANN policies take effect.

If you can think of a list, it probably would...

Having had the need to construct a few TLDs for internal use, I hope that some
new RFC will address this and reserve some
(e.g. .internal, .internal# (where # is
any fully numeric string), .local)? I really don't care what they are called,
but I do need more than one.

There are 4 already,
.test .example .invalid .localhost

. I suspect that .local should also be reserved, which would make 5.

It seems that .internal# should just be blocked, not reserved. Before,
the feeling was that
the best blockage was a reservation, but as I read the ICANN
presentation, if .internal
was reserved, .internal# could be blocked too without an explicit
reservation.

Regards
Marshall

Post by Lou Katz

Post by Marshall Eubanks
Marshall

Post by Jon Kibler
Jon

<snip>
--
-=[L]=-
Helping to interpret the lives of the animals.

[Simon Waters]

Post by Marshall Eubanks
.localhost is already reserved through RFC 2606, so this should not be
a problem.

.localdomain shouldn't cause a problem, since most Unix systems that use it
put it in the name resolution before the DNS is invoked (i.e. /etc/hosts).

ICANN have a technical review step in the procedure, which hopefully would
flag a request for ".localdomain", I don't think we want to try to enumerate
possible brokenness.

Probably appropriate for the review step is to ask the root name server
operators if there is substantive traffic for a proposed TLD, as if there is
it may reveal a problem.

That said substantive traffic for a proposed domain need not of itself block a
request, ICANN are tasked with maintaining the stability of the net, not the
stability of every broken piece of software on the net.

Does anyone has a specific operational concerns - otherwise I think this topic
should probably be laid to rest on this list.

[Tony Finch]

Post by Jon Kibler
Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using the logic
that .LOCAL is safe because it cannot be resolved by the root name servers.

.local is also used by MDNS. (Nice interop problem there.)

Tony.

[Tomas L. Byrnes]

If they assign .local, they will break the default for AD, especially
SBS, Apple Rendezvous, anything using mDNS/Zeroconf, and a lot of other
"local significance only" uses of DNS, or, which is more likely, the
domains in .local will find themselves unresolvable from a very large
portion of the Internet.

.local should be reserved.

-----Original Message-----
Sent: Friday, June 27, 2008 12:21 PM
To: Jon Kibler
Cc: NANOG list
Subject: Re: ICANN opens up Pandora's Box of new TLDs

Post by Jon Kibler
Well, I guess this shoots in the foot Microsoft's name server best
practices of setting up your AD domain as foo.LOCAL, using

the logic

Post by Jon Kibler
that .LOCAL is safe because it cannot be resolved by the

root name servers.
.local is also used by MDNS. (Nice interop problem there.)
Tony.
--
MALIN: CYCLONIC BECOMING SOUTHWESTERLY 5 OR 6, OCCASIONALLY 7
AT FIRST. MODERATE OR ROUGH, OCCASIONALLY VERY ROUGH. RAIN OR
THUNDERY SHOWERS.
MODERATE OR GOOD, OCCASIONALLY POOR.

[Phil Regnauld]

Post by Owen DeLong
1. Nobody is FORCING them to do so.

Trademark law is forcing you to - you have to make reasonable attempts
to actively defend your trademark. Of course, no-one forces you
to trademark your name in the first place. Not that I agree with the
practice, either.

Phil

[Jay R. Ashworth]

On Thu, Jun 26, 2008 at 11:07:57PM -0000, Martin Hannigan wrote:
[ quoting me ]

Post by Martin Hannigan

Post by Jay R. Ashworth
And no, companies *aren't* "forced to pay for another domain name" just
because a new TLD appears -- they aren't doing it *now*, by and large,

The last time I looked there were a few thousand companies protecting
their intellectual property by using companies like Mark Monitor to
insure that they had defensive registrations in all ccTLD's possible.

Sure; MarkMonitor has a great sales staff.

But the methods by which you can violate a trademark are *very* clearly
defined, and the mere existence of a domain name doesn't seem to be one
of them. IANAL.

Cheers,
-- jra

[Ken Simpson]

Post by Jim Popovitch
Two years ago I posed the question here about the need for TLDs
(http://www.mcabee.org/lists/nanog/May-06/msg00110.html).
I summerizsed that companies IP (Intellectual Property) guidelines
would never allow domain.org to exist if they owned domain.com
(ibm.org vrs ibm.com). I felt that TLDs really represented a
monetary harvesting scheme as every new TLD forced companies to "pay
for yet another domain name" (slowly milking businesses). At that
time several knowledgeable folks commented that TLDs were necessary
in the beginning due to the need to distribute queries. Now it
seems, ICANN has decided to add a new paradigm :-) How will a TLD
like .ibm be handled now, and how is this different than what I
proposed in 2006?

How will ICANN be allocating these? An auction format? It will be a
blood bath otherwise.. And for abuse and spam, this is a nightmare.

[Zaid Ali]

I hear from my friend's attending ICANN in Paris that there are tons
of business folks who want to scoop up a gTLD. I haven't heard of
anything that will be structured so looks like it will be a blood bath.

Zaid

Post by Ken Simpson

Post by Jim Popovitch
Two years ago I posed the question here about the need for TLDs
(http://www.mcabee.org/lists/nanog/May-06/msg00110.html).
I summerizsed that companies IP (Intellectual Property) guidelines
would never allow domain.org to exist if they owned domain.com
(ibm.org vrs ibm.com). I felt that TLDs really represented a
monetary harvesting scheme as every new TLD forced companies to "pay
for yet another domain name" (slowly milking businesses). At that
time several knowledgeable folks commented that TLDs were necessary
in the beginning due to the need to distribute queries. Now it
seems, ICANN has decided to add a new paradigm :-) How will a TLD
like .ibm be handled now, and how is this different than what I
proposed in 2006?

How will ICANN be allocating these? An auction format? It will be a
blood bath otherwise.. And for abuse and spam, this is a nightmare.

[David Conrad]

Post by Ken Simpson
How will ICANN be allocating these?

https://par.icann.org/files/paris/GNSO-gTLD-Update-Paris22jun08.pdf

Regards,
-drc

[Jeroen Massar]

Post by David Conrad

Post by Ken Simpson
How will ICANN be allocating these?

https://par.icann.org/files/paris/GNSO-gTLD-Update-Paris22jun08.pdf

and
http://www.circleid.com/posts/86262_launch_of_paris_domain_icann/
and
http://www.circleid.com/posts/86269_icann_approves_overhaul_top_level_domains/#4133

and well the rest of CircleID.

Some people are going to get very rich over this. I hope that they drown
in the money just as the Internet will drown in all the crap TLD's, not
even thinking of all the nice security issues which come along (home,
mycomputer and .exe etc anyone ? :) And of course the people who like to
grab typos will also have a field day with this.

Thank you people doing all the ICANN politics for destroying the Internet.

Greets,
Jeroen

[R. Irving]

</lurk>

Post by Jeroen Massar
Thank you people doing all the ICANN politics for destroying the Internet.

You know, last time someone ( Robert Metcalfe
<http://en.wikipedia.org/wiki/Robert_Metcalfe>) prophesied the death of
the Internet, when it didn't
come true... we made him eat his words. You up for a repeat ?

:-P

Post by Jeroen Massar
Greets,
Jeroen

<lurk>

[Jeroen Massar]

Post by R. Irving
</lurk>

Post by Jeroen Massar
Thank you people doing all the ICANN politics for destroying the Internet.

You know, last time someone ( Robert Metcalfe
<http://en.wikipedia.org/wiki/Robert_Metcalfe>) prophesied the death of
the Internet, when it didn't
come true... we made him eat his words. You up for a repeat ?

Wow, you are comparing a nobody like me to a person like Dr. Metcalfe, I
am honored, though I don't even start to think that I even compare to
him in any way, thus why you come up with that comparison? Just amazing.

That said, 'destroying' is not 'death at 11', also I am not so silly to
do bets on things. Nice try, but it doesn't work for me. I guess you
better stick to the lurking.

As for destroying the Internet, it is going to work out that way, as the
.com as we know it won't exist any more, and most people only think
".com" when they think Internet. Then again they also only know WWW and
nothing else, which is why I really don't like this DNS change which is
already solved with search engines.

Greets,
Jeroen

[Tony Finch]

thinking of all the nice security issues which come along (home, mycomputer
and .exe etc anyone ? :)

.exe has the same security properties as .com

Tony.

[Raoul Bhatia [IPAX]]

Post by Tony Finch

thinking of all the nice security issues which come along (home, mycomputer
and .exe etc anyone ? :)

.exe has the same security properties as .com

not exactly, as a lot of users know that there is something like a
.com domain. they will expect something else from .exe

but for automated security, i quite agree.

cheers,
raoul
--
____________________________________________________________________
DI (FH) Raoul Bhatia M.Sc. email. ***@ipax.at
Technischer Leiter

IPAX - Aloy Bhatia Hava OEG web. http://www.ipax.at
Barawitzkagasse 10/2/2/11 email. ***@ipax.at
1190 Wien tel. [phone]
FN 277995t HG Wien fax. [phone]
____________________________________________________________________

[David Conrad]

Post by Raoul Bhatia [IPAX]

Post by Tony Finch

thinking of all the nice security issues which come along (home, mycomputer
and .exe etc anyone ? :)

.exe has the same security properties as .com

not exactly, as a lot of users know that there is something like a
.com domain. they will expect something else from .exe

I'm not sure I understand the security threat here. Is the theory
that someone will click on "foo.exe" and the fact that it is a URL is
somehow worse than if it is an actual executable? If that's not it,
can someone explain (small words, with subtitles -- I'm not a security
geek).

Thanks,
-drc

[Rich Kulawiec]

Post by Ken Simpson
How will ICANN be allocating these? An auction format? It will be a
blood bath otherwise.. And for abuse and spam, this is a nightmare.

There's no doubt this last will happen since it has *already* happened,
as I pointed out in a note to Dave Farber's IP list earlier today.

For example: the .info TLD is completely overrun with spammers, to
the point where many people, including me, have simply blacklisted the
whole thing. It simply became too onerous to maintain a blacklist with
hundreds of thousands of individual domains and hundreds of additions
per day. We never needed a .info TLD and soon its existence will be
moot -- well, except for all the money wasted dealing with squatters
and typosquatters and spammers and phishers and other abusers.

This follows on the heels of .biz, which is so broadly blacklisted that
not even spammers tend to use it much any more.

And so on.

So the outcome of this is inevitable: expense, litigation, hassle,
spam, abuse, and oh-by-the-way massive profits for registrars, which
had nothing at all to do with ICANN's decision. Of course not.

---Rsk

[Jim Popovitch]

Post by Rich Kulawiec
So the outcome of this is inevitable: expense, litigation, hassle,
spam, abuse, and oh-by-the-way massive profits for registrars, which
had nothing at all to do with ICANN's decision. Of course not.

Perhaps this is straying into OT land... (but I must push the envelope!) ;-)

Is there any "full disclosure" clause in ICANN member contracts such
that gifts from, or stock in, a Registrar would be declared?

-Jim P.

[David Conrad]

Post by Jim Popovitch
Is there any "full disclosure" clause in ICANN member contracts such
that gifts from, or stock in, a Registrar would be declared?

Not sure who an "ICANN member" would be. ICANN as a California
501c(3) has to publish all it's financial details. The ICANN Board of
Trustees (who makes the final decision within ICANN on TLD-related
matters) must abide by a Conflict of Interest Policy (http://www.icann.org/committees/coi/coi-policy-04mar99.htm
).

Regards,
-drc

[Frank Bulk - iNAME]

...which is why it might be a strategy to blacklist all new TLDs (if this
proposal gets through) and whitelist just .com, .net, etc.

Frank

-----Original Message-----
From: Rich Kulawiec [mailto:***@gsp.org]
Sent: Thursday, June 26, 2008 9:50 PM
To: ***@nanog.org
Subject: Re: ICANN opens up Pandora's Box of new TLDs

Post by Ken Simpson
How will ICANN be allocating these? An auction format? It will be a
blood bath otherwise.. And for abuse and spam, this is a nightmare.

There's no doubt this last will happen since it has *already* happened,
as I pointed out in a note to Dave Farber's IP list earlier today.

For example: the .info TLD is completely overrun with spammers, to
the point where many people, including me, have simply blacklisted the
whole thing. It simply became too onerous to maintain a blacklist with
hundreds of thousands of individual domains and hundreds of additions
per day. We never needed a .info TLD and soon its existence will be
moot -- well, except for all the money wasted dealing with squatters
and typosquatters and spammers and phishers and other abusers.

This follows on the heels of .biz, which is so broadly blacklisted that
not even spammers tend to use it much any more.

And so on.

So the outcome of this is inevitable: expense, litigation, hassle,
spam, abuse, and oh-by-the-way massive profits for registrars, which
had nothing at all to do with ICANN's decision. Of course not.

---Rsk

[Jay R. Ashworth]

Post by Rich Kulawiec
For example: the .info TLD is completely overrun with spammers, to
the point where many people, including me, have simply blacklisted the
whole thing.

The irony that MailScanner's domain is mailscanner.info is absolutely
deafening.

Cheers,
-- jra

[Brandon Butterworth]

Post by Jay R. Ashworth
And no, companies *aren't* "forced to pay for another domain name" just
because a new TLD appears -- they aren't doing it *now*

Oh yes we are

brandon

[TJ]

Ah, but some are ... for trademark or brand protection usually.
I know _one_ company that paid $140k just for domain names related to a
rebranding effort.


/TJ

-----Original Message-----
From: Brandon Butterworth [mailto:***@rd.bbc.co.uk]
Sent: Thursday, June 26, 2008 6:59 PM
To: ***@nanog.org
Subject: Re: ICANN opens up Pandora's Box of new TLDs

Post by Jay R. Ashworth
And no, companies *aren't* "forced to pay for another domain name"
just because a new TLD appears -- they aren't doing it *now*

[Jay R. Ashworth]

Post by TJ
Ah, but some are ... for trademark or brand protection usually.

But most trademark holders aren't *entitled* to that much protection:
unless they do business worldwide, *and* have a "famous" mark.

Cheers,
-- jra

[Jason Williams]

3. It is somewhat anti-social to do so, but, that has rarely been a
constraint on corporate greed, especially amongst the Intelectual
Property crowd.

It doesn't seem to me to be "anti-social" behavior to ensure when your
customers mistype your domain as a .net or .de (depending on the customer's
locale) that they still end up at your site. Definitely, wouldn't ascribe it
as corporate greed.

-J

________________________
Jason J. W. Williams
COO/CTO, DigiTar
http://www.digitar.com
Voice: 208.343.8520
Mobile: [phone]
FAX: [phone]
E-mail: ***@digitar.com
XMPP/Jabber: ***@digitar.com

[Owen DeLong]

Post by Jason Williams

3. It is somewhat anti-social to do so, but, that has rarely been a
constraint on corporate greed, especially amongst the Intelectual
Property crowd.

It doesn't seem to me to be "anti-social" behavior to ensure when your
customers mistype your domain as a .net or .de (depending on the customer's
locale) that they still end up at your site. Definitely, wouldn't ascribe it
as corporate greed.

You are welcome to ascribe it to whatever you want. I will note that
very few Non-profit organizations engage in such behavior. Very
few governments do so, either. In fact, absent a corporate profit
motive, this behavior seems very rare.

It is my considered opinion that turning control of the Domain Name
system over to WIPO and allowing them to decide that domains
and trademarks had common namespace to ill-defined levels of
degree with different categorical mappings that also had undefined
translations was one of the biggest mistakes in internet history.

Owen

[Brandon Butterworth]

Post by Owen DeLong
1. Nobody is FORCING them to do so.

scammers, squaters and click collectors

Post by Owen DeLong
3. It is somewhat anti-social to do so

So are the abusers. If someone is going to it may as
well be us (marginally less evil)

brandon

[Martin Hannigan]

Post by Brandon Butterworth

1. Nobody is FORCING them to do so.

scammers, squaters and click collectors
3. It is somewhat anti-social to do so
So are the abusers. If someone is going to it may as
well be us (marginally less evil)

There are probably some variations based on the zone, languages, IDN'ability, etc., but it certainly is a good idea to be bankofamerica.* for reasons that I think are obvious to most of us.

-M<

[Jason Williams]

You are welcome to ascribe it to whatever you want. I will note that
very few Non-profit organizations engage in such behavior. Very
few governments do so, either. In fact, absent a corporate profit
motive, this behavior seems very rare.

Given the level of customer service most governmental agencies and non-profits
provide, they¹ve got a lot of other usability holes to fill first before they
start worrying about their ³clients² going to the wrong website. Secondarily,
their clients going to the wrong location isn¹t going to put them out of
existence. So on the level that profit=existence I¹d agree it¹s definitely
profit motivated. But greed is pejorative term.
-J

________________________
Jason J. W. Williams
COO/CTO, DigiTar
http://www.digitar.com
Voice: 208.343.8520
Mobile: [phone]
FAX: [phone]
E-mail: ***@digitar.com
XMPP/Jabber: ***@digitar.com

[Tuc at T-B-O-H.NET]

Post by Jim Popovitch
Two years ago I posed the question here about the need for TLDs
(http://www.mcabee.org/lists/nanog/May-06/msg00110.html).

This all should have been solved by allowing those who
wanted/applied for TLDs to be granted them back in 1995 when
originally requested :

http://www.gtld-mou.org/gtld-discuss/mail-archive/00990.html

There was a procedure, people followed it, and IANA
decided to go other ways with it. Now years later there is
all this red tape restricting things.

And if the "powers that be" decide to go back to
it, you can replace stormking.com with t-b-o-h.net and I
look forward to it! ;)

Tuc / Scott Ellentuch

[Marshall Eubanks]

Post by Tuc at T-B-O-H.NET

Post by Jim Popovitch
Two years ago I posed the question here about the need for TLDs
(http://www.mcabee.org/lists/nanog/May-06/msg00110.html).

This all should have been solved by allowing those who
wanted/applied for TLDs to be granted them back in 1995 when
http://www.gtld-mou.org/gtld-discuss/mail-archive/00990.html

The SNR in the gtld WG was very low, which I think may have been an
influencing factor.

I do have to wonder, however, what Eugene Kashpureff thinks about this.

Regards
Marshall

Post by Tuc at T-B-O-H.NET
There was a procedure, people followed it, and IANA
decided to go other ways with it. Now years later there is
all this red tape restricting things.
And if the "powers that be" decide to go back to
it, you can replace stormking.com with t-b-o-h.net and I
look forward to it! ;)
Tuc / Scott Ellentuch

[Tuc at T-B-O-H.NET]

Post by Chris Adams

Post by Ken Simpson
Oooh -- dibs on that one. And .some, so you can register awe.some,
trouble.some, and fear.some. And .ous, which would allow humm.ous,
seri.ous, fabul.ous, etc..

eych tee tee pee colon slash slash slash dot dot dot

Yea, I thought that was funny when I owned

www . wwwdotnet . net

too....Lost a bit later on trying to explain to people. Then
again TTSG (PPFG? TPSG? TPFG?) and "T dash B dash O dash H" aren't
so fun either.

Tuc

[Jean-François Mezei]

A while ago, there was come debate about the introduction of a .XXX gTLD
with some of the folks objecting to its formation.

Does anyone know how if the new gTLD system will still give some "veto"
power to some people over some domain names that are morally objectable
to some people ?

I am not thinking of only .SEX but perhaps also .GOD .GAY .ALLAH .BI
.CHRISTIAN .LESBIAN .MORMON .JEW .JEWISH .ISLAM etc.

Religions will be interesting especially in cases where there is no
central representative for a religion who can make the official
registration.

And in the case where there would be global conflicts, what happens ?

For instance, in the USA "ABC" is the american broadcasting companies,
but in australia, it is the Australian Broadcasting Corporation.

Is it fair to hand .ABC to either one of the two ? (highest bidder) or
will ICANN "lock" .ABC out so that neither can get to it ? I am sure
there are many such gTLDs around the world that would conflict across
countries.

Finally, will there be any performance impact on DNS servers around the
world (thinking of caching issues) ?

[David Conrad]

Post by Jean-François Mezei
Does anyone know how if the new gTLD system will still give some "veto"
power to some people over some domain names that are morally
objectable
to some people ?

See pages 17 - 20 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf

Post by Jean-François Mezei
Is it fair to hand .ABC to either one of the two ? (highest bidder) or
will ICANN "lock" .ABC out so that neither can get to it ? I am sure
there are many such gTLDs around the world that would conflict across
countries.

See pages 22 - 25 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf

Post by Jean-François Mezei
Finally, will there be any performance impact on DNS servers around the
world (thinking of caching issues) ?

Extremely unlikely (IMHO).

Regards,
-drc

[Randy Bush]

hi drc,

does anyone find it droll that the jr high school like clique of root
server operators is gonna bear the burden of this, while billy et alia
sank the iana usefully signing the root?

randy

[Martin Hannigan]

Post by David Conrad
See pages 17 - 20 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf
See pages 22 - 25 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf

I think that this is a good read as well, especially the comments by Dave Wodeley, Susan Crawford, and Wendy Seltzer.

https://par.icann.org/files/paris/BoardMeeting_26June08.txt


Best,

Martin

[Eric Brunner-Williams]

Martin,

I wasn't that impressed with Dave's remarks, but I heard them rather
than read them, which may have made a difference. I agree with your
views on the substance and spirit of Susan's and Wendy's statements.

This -- the new GTLD process -- was originally scheduled to get to
completion in 2003 and 2004 -- after the initial 2000 round.

Eric

Post by Martin Hannigan

Post by David Conrad
See pages 17 - 20 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf
See pages 22 - 25 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf

I think that this is a good read as well, especially the comments by Dave Wodeley, Susan Crawford, and Wendy Seltzer.
https://par.icann.org/files/paris/BoardMeeting_26June08.txt
Best,
Martin

[WWWhatsup]

I reformatted the pertinent parts to make them more easily readable

http://isoc-ny.org/wiki/ICANN_-_Paris/gTLD_discussion

joly

Post by Martin Hannigan
I think that this is a good read as well, especially the comments by Dave Wodeley, Susan Crawford, and Wendy Seltzer.
https://par.icann.org/files/paris/BoardMeeting_26June08.txt
Best,
Martin

---------------------------------------------------------------
WWWhatsup NYC
http://pinstand.com - http://punkcast.com
---------------------------------------------------------------

[V***@vt.edu]

Post by Jean-François Mezei
Finally, will there be any performance impact on DNS servers around the
world (thinking of caching issues) ?

It should be almost identical to the current performance impact on the second
level DNS servers that have to handle 140M .com entries...

[Jay R. Ashworth]

Post by Jean-François Mezei
Does anyone know how if the new gTLD system will still give some "veto"
power to some people over some domain names that are morally objectable
to some people ?
I am not thinking of only .SEX but perhaps also .GOD .GAY .ALLAH .BI
.CHRISTIAN .LESBIAN .MORMON .JEW .JEWISH .ISLAM etc.

.WOMEN-WITH-VISIBLE-FACES?

Post by Jean-François Mezei
For instance, in the USA "ABC" is the american broadcasting companies,
but in australia, it is the Australian Broadcasting Corporation.
Is it fair to hand .ABC to either one of the two ? (highest bidder) or
will ICANN "lock" .ABC out so that neither can get to it ? I am sure
there are many such gTLDs around the world that would conflict across
countries.

Sure, which is why that's not what should be being *done* with GTLDs.

But engineering issues will be the very least of anyone's concern here.

Cheers,
-- jra

[m***@bt.com]

Post by Jeroen Massar
Some people are going to get very rich over this.

How do you know this? Judging by the past experience of TLDs
there will not be a rush of customers but there will be a rush
of people trying to make a buck. In such a scenario, nobody
makes much money unless they somehow link the TLD product to
something else which is profitable.

--Michael Dillon

[Alexander Harrowell]

Well, at least the new TLDs will promote DNS-based cruft filtration. You can
already safely ignore anything with a .name, .biz, .info, .tv suffix, to
name just the worst. If only there was a way to get the cruft to move over
into the new ones...

Post by m***@bt.com

Post by Jeroen Massar
Some people are going to get very rich over this.

How do you know this? Judging by the past experience of TLDs
there will not be a rush of customers but there will be a rush
of people trying to make a buck.

http://weblog.johnlevine.com/ICANN/travelcroak.html
http://weblog.johnlevine.com/ICANN/travelnotdead.html
http://weblog.johnlevine.com/ICANN/traveldrain.html
http://weblog.johnlevine.com/ICANN/travelstillnotdead.html

[Marshall Eubanks]

Post by Alexander Harrowell
Well, at least the new TLDs will promote DNS-based cruft filtration. You can
already safely ignore anything with a .name, .biz, .info, .tv
suffix, to
name just the worst. If only there was a way to get the cruft to move over
into the new ones...

Hey, please don't ignore .tv. No cruft from me, at least.

Marshall

Post by Alexander Harrowell

Post by m***@bt.com

Post by Jeroen Massar
Some people are going to get very rich over this.

How do you know this? Judging by the past experience of TLDs
there will not be a rush of customers but there will be a rush
of people trying to make a buck.

http://weblog.johnlevine.com/ICANN/travelcroak.html
http://weblog.johnlevine.com/ICANN/travelnotdead.html
http://weblog.johnlevine.com/ICANN/traveldrain.html
http://weblog.johnlevine.com/ICANN/travelstillnotdead.html

[John Levine]

Post by Marshall Eubanks
Hey, please don't ignore .tv. No cruft from me, at least.

The two letter country codes are a swamp all of their own, with no help
from ICANN.

I hear that Tuvalu approximately doubled its GNP the year they sold the
rights to .tv.

R's,
John

[Marshall Eubanks]

.tv is heavily used by the burgeoning Internet TV industry (including
by yours truly).

It may contain cruft, but it is certainly not all cruft.

Regards
Marshall

Post by John Levine

Post by Marshall Eubanks
Hey, please don't ignore .tv. No cruft from me, at least.

The two letter country codes are a swamp all of their own, with no
help from ICANN.
I hear that Tuvalu approximately doubled its GNP the year they sold
the rights to .tv.
R's,
John

[David Conrad]

Hi,

Post by Alexander Harrowell
Well, at least the new TLDs will promote DNS-based cruft filtration. You can
already safely ignore anything with a .name, .biz, .info, .tv
suffix, to
name just the worst.

Does this actually work? The vast majority of spam I receive has an
origin that doesn't reverse map. Of those messages that have origins
(as extracted from the appropriate Received header) that do reverse
map, the majority are in com and net. The mail origins of the top 10
TLDs from the last 30K spam messages I've received):

unknown: 12487
net: 2586
com: 1664
pl: 1093
ru: 917
it: 851
br: 652
de: 479
th: 372
fr: 226

Biz, info, and name don't show up at all. Looking at the 'From'
lines, I get:

com: 13432
de: 8819
net: 1959
org: 1902
uk: 256
it: 246
nl: 240
edu: 229
au: 181
ca: 180

What cruft are you filtering using top-level domains?

Thanks,
-drc

[Randy Bush]

Post by David Conrad

Post by Alexander Harrowell
already safely ignore anything with a .name, .biz, .info, .tv suffix, to
name just the worst.

Does this actually work? The vast majority of spam I receive has an
origin that doesn't reverse map. Of those messages that have origins
(as extracted from the appropriate Received header) that do reverse map,
the majority are in com and net.

this is analogous to the gossip that most spam comes from china, asia,
nigeria, or whomever we like to be xenophobic or racist about this week.
measurement shows the united states to be the largest single source of spam.

randy

[Jim Shankland]

Post by Randy Bush
this is analogous to the gossip that most spam comes from china, asia,
nigeria, or whomever we like to be xenophobic or racist about this week.
measurement shows the united states to be the largest single source of spam.

Because it's Friday, I checked the last few weeks or so of logs from
my personal mail server (located in the US), and broke the list of
unique IP addresses rejected by zen.spamhaus.org up by registry:

49.2% RIPE
22.2% LACNIC
13.8% ARIN
13.5% APNIC
1.3% Afrinic

ARIN's share may be slightly overstated, as it includes most of
the legacy blocks.

For what it's worth ....

Jim Shankland

[Phil Regnauld]

Post by Jim Shankland
Because it's Friday, I checked the last few weeks or so of logs from
my personal mail server (located in the US), and broke the list of

... spam coming from US computers vs. spam coming from botnets which
are being rented by american spammers. There is a distinction.
Don't think that legitimate american businesses aren't the only ones
who've outsourced. A lot of people around the world running XP just
don't know that they're doing the outsourcing :)

P.

[Rich Kulawiec]

Post by Randy Bush
this is analogous to the gossip that most spam comes from china, asia,
nigeria, or whomever we like to be xenophobic or racist about this week.
measurement shows the united states to be the largest single source of spam.

Globally, yes, but anti-spam measures aren't global: they're local.
Everyone's mix is different: for example, during the past week, informal
comparison of the incidence of pump-and-dumps spams revealed that one
correspondent's have dropped to almost nothing, while another's continue
to steadily increase.

Global generalizations about spam trends are interesting, but not of much
use in crafting local policy. The only thing that works for that is log
analysis, in order to identify the composition of traffic and thus craft
a policy (and then presumably implement it) that attempts to minimize the
local FP/FN rates. (Note that FP/FN are always defined locally; there
is no such thing as a general definition.)

That said, global trends can provide some idea of what to look for in
local traffic: for example, given the massive infestation of .info
by spammers, phishers, spyware, adware, trojans, typosquatters, link
farms, drive-by-downloaders, etc., it's very likely that most people
will see a significant reduction in spam by blacklisting the TLD.

---Rsk

[Robert E. Seastrom]

Post by Randy Bush
this is analogous to the gossip that most spam comes from china, asia,
nigeria, or whomever we like to be xenophobic or racist about this week.
measurement shows the united states to be the largest single source of spam.

The US is also the largest single source of email-that-I-want.
Conversely, it's safe to assume that anything encoded in BIG5 format
is something I'm totally uninterested in. There are indeed entire
countries that I could block with a false positive rate of less than
one every five years, which is a lot better than some other antispam
technologies.

Not that I'm doing this though. RBLs, SA, and greylisting with a
carefully crafted list of organizations I've found that don't play
well, works "well enough", and having everything wired up so it runs
at or before the end of the DATA phase means I don't get left holding
the bag for anything.

-r

[Rich Kulawiec]

Post by David Conrad

Post by Alexander Harrowell
Well, at least the new TLDs will promote DNS-based cruft filtration. You can
already safely ignore anything with a .name, .biz, .info, .tv suffix, to
name just the worst.

Does this actually work? The vast majority of spam I receive has an
origin that doesn't reverse map.

Best practice is refuse all mail that comes from any host lacking rDNS,
since that host doesn't meet the minimum requirements for a mail server.

After that, other sanity checks (such as matching forward DNS, valid HELO,
proper wait for SMTP greeting, etc.) also knock out a good chunk of spam.

Yes, some of these also impact non-spamming but broken mail servers,
however, this is usually the only way to get the attention of their
operators and persuade them to effect repairs.

Beyond that, blocking of various gTLDs and ccTLDs and network allocations
works nicely, depending on what your particular mix of inbound spam/not-spam
is. Understanding of your own inbound mail mix is crucial to deciding
which ones are viable for your operation. Locally, I've had .cn and .kr
along with their entire network allocations blacklisted for years, and
this has worked nicely; but clearly it wouldn't work well for, say,
a major US research university.

Locally, .name, .info and .tv are permanently blacklisted, and I recommend
this to others: they're all heavily spammer-infested. .biz is not
blacklisted at the moment, largely because it's been so badly ravaged
that spammers *appear* to be abandoning it.

---Rsk

[Phil Regnauld]

Post by Rich Kulawiec
Best practice is refuse all mail that comes from any host lacking rDNS,
since that host doesn't meet the minimum requirements for a mail server.

No, that's utterly stupid. You're excluding countries which have
poor infrastructure or clueless ISPs (usually legacy telco operators)
who can't be bothered to administrate IN-ADDR.ARPA delegations for
their customers. It doesn't help, and only encourages people in
these countries to go for @{hotmail|yahoo|gmail}. Millions of botnet
PCs have valid reverses.

Post by Rich Kulawiec
Yes, some of these also impact non-spamming but broken mail servers,
however, this is usually the only way to get the attention of their
operators and persuade them to effect repairs.

You're kidding, right ? They don't give a rat's ass.

Post by Rich Kulawiec
Locally, .name, .info and .tv are permanently blacklisted, and I recommend
this to others: they're all heavily spammer-infested. .biz is not
blacklisted at the moment, largely because it's been so badly ravaged
that spammers *appear* to be abandoning it.

"Bomb the bridge, salt the earth" approach ?

[Rich Kulawiec]

Post by Phil Regnauld

Post by Rich Kulawiec
Best practice is refuse all mail that comes from any host lacking rDNS,
since that host doesn't meet the minimum requirements for a mail server.

No, that's utterly stupid. You're excluding countries which have
poor infrastructure or clueless ISPs (usually legacy telco operators)
who can't be bothered to administrate IN-ADDR.ARPA delegations for
their customers.

I don't see a problem with not accepting mail from clueless ISPs or their
customers. The requirement for rDNS has been around for decades.
Anyone who's not aware of it has no business running a mail server.

Post by Phil Regnauld
Millions of botnet PCs have valid reverses.

Yes, I'm well aware of this, especially since I was AFAIK one of the first
people to document the use of botnet PCs to send spam. And of course
That's why this particular measure doesn't work for them, but other
best practices do, e.g., rejecting mail from known-dynamic/generic IP space
or known-dynamic/generic namespace unless it's your own customer or is
being submitted with authentication non-port 25

Post by Phil Regnauld

Post by Rich Kulawiec
Yes, some of these also impact non-spamming but broken mail servers,
however, this is usually the only way to get the attention of their
operators and persuade them to effect repairs.

You're kidding, right ? They don't give a rat's ass.

Then they should not be troubled that their mail is being rejected.

Post by Phil Regnauld

Post by Rich Kulawiec
Locally, .name, .info and .tv are permanently blacklisted, and I recommend
this to others: they're all heavily spammer-infested. .biz is not
blacklisted at the moment, largely because it's been so badly ravaged
that spammers *appear* to be abandoning it.

"Bomb the bridge, salt the earth" approach ?

I'm not the one of the people who thought .info was a good idea (what,
domains in other TLDs don't provide "information"?) I'm not the one
who decided to sell domains in that TLD to spammers by the tens of
thousands, thus effectively devaluing it for everyone else. I'm not
the one responsible for failure to enforce any meaningful requirements
on registrars to control abuse by their customers. And so on.

I suggest laying blame on the people who are responsible for the current
state of affairs, not on the recipients of abuse.

---Rsk

[Phil Regnauld]

Post by Rich Kulawiec
I don't see a problem with not accepting mail from clueless ISPs or their
customers. The requirement for rDNS has been around for decades.
Anyone who's not aware of it has no business running a mail server.

Requirement ? What requirement ? There's no requirement for
reverse DNS for email in any RFC. Not that RFCs are ideal references
for mail operation in general. Rejecting on missing or incorrectly
formatted HELO/EHLO is legitimate, as well as unknown sender or
recipient domain, as these are within the control of the sender,
or the sender's organisation. Reverse DNS is not. It's all subjective
of course.

Post by Rich Kulawiec
people to document the use of botnet PCs to send spam. And of course
That's why this particular measure doesn't work for them, but other
best practices do, e.g., rejecting mail from known-dynamic/generic IP space
or known-dynamic/generic namespace unless it's your own customer or is
being submitted with authentication non-port 25

"known-dynamic" is extremely up to debate. Frankly, blacklisting
entire /16s because individual customer PCs have been hijacked is
absurd, but I guess colateral damage is acceptable. Probably bounces
will be the next thing to disappear.

Post by Rich Kulawiec

Post by Phil Regnauld

Post by Rich Kulawiec
Yes, some of these also impact non-spamming but broken mail servers,
however, this is usually the only way to get the attention of their
operators and persuade them to effect repairs.

You're kidding, right ? They don't give a rat's ass.

Then they should not be troubled that their mail is being rejected.

The operators don't care. The customers do. The customers don't have
a choice, often. So you're right, the operator is not troubled
that their customer's mail is being rejected.

Post by Rich Kulawiec

Post by Phil Regnauld
"Bomb the bridge, salt the earth" approach ?

I'm not the one of the people who thought .info was a good idea (what,
domains in other TLDs don't provide "information"?) I'm not the one
who decided to sell domains in that TLD to spammers by the tens of
thousands, thus effectively devaluing it for everyone else.

Because .org and .com don't do that as well ?

Post by Rich Kulawiec
I suggest laying blame on the people who are responsible for the current
state of affairs, not on the recipients of abuse.

I'm not laying blame here, just pointing out that rejecting mail
from IP addresses for which no PTR delegation exists is unwarranted,
but it's your system, so of course it's up to you. Don't go preaching
it as a best practice, though.

Phil

[Jim Shankland]

Post by Phil Regnauld
Requirement ? What requirement ? There's no requirement for
reverse DNS for email in any RFC.

As a practical matter, I've found that sending out email from a
host without rDNS doesn't work: too many sites bounce the mail.

It will not come as news to anyone on this list that the world
of SMTP is hardly well-defined or well-regulated in practice.
Like Rowlf the dog, we can't live with it, we can't live without
it, but we're stuck until something better comes along:

Jim Shankland

[Phil Regnauld]

http://www.maawg.org/about/MAAWG_Sender_BCP/MAAWG_Senders_BCP_Combine.pdf

Thanks for the pointer. I don't necessarily agree with all of it,
but it's definitely a good reference.

I just get irritated by actions that penalize end users who feel they
don't have other options other than just using some horrible webmail
service, because their operator/ISP is clueless. I do make a
distinction.

On page 5 they do recommend matching reverse DNS and in
Appendix A they go on to state that RFC 1912 states that
all hosts on the Internet should have a valid rDNS entry.

Indeed it does, but rejecting a mail based on a missing PTR
is still arbitrarily useless (and I'm speaking in terms of
volume of spam emanating from hosts with a missing PTR, vs
spam origination from hosts that do have a PTR).

Perhaps the RFC series doesn't have as many gaps as we think.

For mail operations, we're half a galaxy away from "be conservative
in what you send, be liberal in what you accept".

Post by Phil Regnauld
absurd, but I guess colateral damage is acceptable.

If collateral damage is acceptable, then how is this
absurd?

Apologies, I was being sarcastic.

Once you accept that it is better to reject
good email than let bad email through, the game has
changed. It may end up by destroying the business usefulness
of the existing email architecture, but not without a
push from someone who has a better mousetrap.

Yep.

This is quite simply, wrong. It is warranted.

Not agreeing :) But fair enough, any site is allowed to operate
mail the way it wants.

Post by Phil Regnauld
Don't go preaching
it as a best practice, though.

Too late, the MAAWG has already published this as a best practice
for quite some time. If you don't follow the MAAWG best practices
then you are not a serious email operator. If email is mission
critical to your business, then you really should be an MAAWG
member as well.

We work for several customers and operate large mail installations.
We implement quite a few requirements that are fairly strict, but
rejecting based on missing PTR is not one of them.
Neither is blacklisting entire TLDs for that matter, but I digress.
I still feel like a serious mail operator, just because I don't
conclude that I as the receiver should reject mail from a host with
a missing PTR, because the MAAWG *Senders* BCP says that hosts
should have a reverse.

Phil

[Marshall Eubanks]

Post by Rich Kulawiec

Post by David Conrad

Post by Alexander Harrowell
Well, at least the new TLDs will promote DNS-based cruft filtration. You can
already safely ignore anything with a .name, .biz, .info, .tv
suffix,
to
name just the worst.

Does this actually work? The vast majority of spam I receive has an
origin that doesn't reverse map.

Best practice is refuse all mail that comes from any host lacking rDNS,
since that host doesn't meet the minimum requirements for a mail server.
After that, other sanity checks (such as matching forward DNS, valid HELO,
proper wait for SMTP greeting, etc.) also knock out a good chunk of spam.
Yes, some of these also impact non-spamming but broken mail servers,
however, this is usually the only way to get the attention of their
operators and persuade them to effect repairs.
Beyond that, blocking of various gTLDs and ccTLDs and network
allocations
works nicely, depending on what your particular mix of inbound spam/
not-spam
is. Understanding of your own inbound mail mix is crucial to deciding
which ones are viable for your operation. Locally, I've had .cn and .kr
along with their entire network allocations blacklisted for years, and
this has worked nicely; but clearly it wouldn't work well for, say,
a major US research university.
Locally, .name, .info and .tv are permanently blacklisted, and I recommend
this to others: they're all heavily spammer-infested. .biz is not
blacklisted at the moment, largely because it's been so badly ravaged
that spammers *appear* to be abandoning it.

Hmm. Looking at the recent spam collection plus email archive for the
accounts I host for

SPAM (recent messages only)

13864 messages - 57 from .info rate = 0.4 %
13864 messages - 8761 from .com rate = 63.1 %

Non-SPAM (going back ~ two years)

122846 messages - 607 from .info - rate = 0.5 %
122846 messages - 71888 from .com - rate = 58.5 %

I don't see any strong reason to drop .info traffic here.

Note, btw, that at least Joe Abley, Andrew Sullivan and Brian Dickson
post to NANOG repeatedly from .info

Regards
Marshall

Post by Rich Kulawiec
---Rsk

[m***@bt.com]

Post by Brandon Butterworth

Post by Jay R. Ashworth
And no, companies *aren't* "forced to pay for another domain name"
just because a new TLD appears -- they aren't doing it *now*

Oh yes we are

Looking at bbc.org and bbc.tv suggests that you are not.

--Michael Dillon

[m***@bt.com]

Post by Martin Hannigan
There are probably some variations based on the zone,
languages, IDN'ability, etc., but it certainly is a good idea
to be bankofamerica.* for reasons that I think are obvious to
most of us.

To make it hard for your customers to figure out whether a URL
is legitimately owned by the bank? To make it easier for evil guys
to steal from your customers by registering bonkofamerica.*?

Back to language examples. It would be perfectly legitimate for
BBC.ru to be owned by someone other than the well-known broadcaster
because in Russian, BBC is the abbreviation for the air force.
Probably this applies even more to BBC.aero.

IMHO things work better when you have a home TLD and then only use
other TLDs when it relates to your business operations. For instance
example.com is the home TLD, example.net is used by their consumer
broadband division, example.co.uk by their UK sales branch and
example.cn by their manufacturing division in Shanghai.

--Michael Dillon

[Balazs Laszlo]

Post by m***@bt.com

Post by Martin Hannigan
There are probably some variations based on the zone,
languages, IDN'ability, etc., but it certainly is a good idea
to be bankofamerica.* for reasons that I think are obvious to
most of us.

To make it hard for your customers to figure out whether a URL
is legitimately owned by the bank? To make it easier for evil guys
to steal from your customers by registering bonkofamerica.*

Maybe somebody start a trusted service under a new TLD,
and you can block all the others.

Laszlo Balazs

[Jeroen Massar]

Post by Balazs Laszlo

Post by m***@bt.com

Post by Martin Hannigan
There are probably some variations based on the zone, languages,
IDN'ability, etc., but it certainly is a good idea to be
bankofamerica.* for reasons that I think are obvious to most of us.

To make it hard for your customers to figure out whether a URL
is legitimately owned by the bank? To make it easier for evil guys
to steal from your customers by registering bonkofamerica.*

Maybe somebody start a trusted service under a new TLD,
and you can block all the others.

<background sound="Darth Vader Breathing.ogg">

For three seconds I thought it was maybe a nice idea for this DNS thing
to be cleansed, just stick everything under this new 'trusted' TLD, but
then I realized that it can't work, as who is going to decide on what is
'trusted' or not? There is a root (even per TLD and per domain) where
delegations come from, as such, there is a central authority and thus a
couple of people who say 'trusted' and 'untrusted', or actually 'good'
and 'evil'. This was also the whole point of having ccTLDs, so that
every country at least could have their own share of the tree (hoping
that the root had truly trusted people who would not just kick a part of
the tree out (Russia would like to kick out .es now I guess ;)

If you want trust, a trust-metric (eg PGP) could partially work. Still,
that is not true trust, as it is only an attestation that at the point
you said 'good' or 'evil' you found it to be like that. The internet
(un)fortunately has this great dynamics factor, as such, now it might be
good, all of a sudden some Russian hackers own www.ipv6.elmundo.es
(which will then report on Russian winning and Spain loosing) and even
though everybody trusts that site for the purpose of 'good domain' and
maybe 'good reporting' it will actually be evil. Countering this is
going to be extremely difficult, as you need to get everybody who trusts
it to update their opinion. Or how do you get a committee to decide
'that site/side is evil'. Difficult.

Currently people just trust Google and Mozilla and a various of other
vendors to do this for them. This seems to work in some ways, but still
on mostly static lists inside the browser, which only updates once in a
while thus not very quick either. And how good is Google in not doing
evil in just putting all the Russian sites on the list and blocking them
off? You don't know.

Evil is just what one perceives, and what is good for you, might not be
good for others. If you are 'good', it is just because some people you
know like you, while when you are 'evil' it is just because you are on
the 'wrong' side.

Thus no, I don't see '.trusted' actually being trusted, as it simply
will exclude businesses which are not trusted by the other ones who
control .trusted and thus will be very nice for the anti-competition
laws that exist.

Only real solution that I currently see seems to be:
- pick a search engine you think you can trust (to degrees of etc)

- type in what you are looking for, hit search
if the ranking of a site is not high enough then either
the site is not trusted enough because there are no links there
or because tracking software didn't find enough people going there
and all the other factors they use they just fail.

- let the search engine warn you "that site might be evil"

- go to the page. Don't care about the URL though, the search
engine already and all their trust made sure it is a 'good' site.

- Use it.

That of course only covers web, but that is what most general population
folks are using anyway.

Thus DNS is here only used for where it was supposed to, converting a
hostname into an IP address, in the background, with the user not caring
about what the hostname is. As such the only thing what matters about
host/domainnames will be how pretty they look, nothing more, nothing less.

I still don't get why ever movie needs their own domainname, which means
that there have to be a lot of sites actually referring to that new
domain to be actually able to find the movie in the first place, that
while the company that produces it could easily put a subpage on their
website or eek a subdomain, and it will all work like a charm including
keeping ones PageRank intact and local without having to pay any amount
of cash. Then again, domaincapers will register it and get a few hits
for it, because people apparently still trust in typing in URL's...

Greets,
Jeroen

</background>

[Eric Brunner-Williams]

Martin,

You know the phrase "Paris is worth a mass"? Well, we get .paris, as
well as .cat, and other reasonable things, plus chaff and clutter.

Eric

Eric;
The only reason I would have supported rejecting the proposal is the 'morality' language related to offensive TLD's. .
What's your take on that part of the process?
Marty
----- Original Message -----
To: Martin Hannigan
Sent: Fri Jun 27 10:57:15 2008
Subject: Re: ICANN opens up Pandora's Box of new TLDs
Martin,
I wasn't that impressed with Dave's remarks, but I heard them rather
than read them, which may have made a difference. I agree with your
views on the substance and spirit of Susan's and Wendy's statements.
This -- the new GTLD process -- was originally scheduled to get to
completion in 2003 and 2004 -- after the initial 2000 round.
Eric

Post by Martin Hannigan

Post by David Conrad
See pages 17 - 20 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf
See pages 22 - 25 of https://par.icann.org/files/paris/gTLDUpdateParis-23jun08.pdf

I think that this is a good read as well, especially the comments by Dave Wodeley, Susan Crawford, and Wendy Seltzer.
https://par.icann.org/files/paris/BoardMeeting_26June08.txt
Best,
Martin

[Brandon Butterworth]

Post by m***@bt.com

Post by Brandon Butterworth

Post by Jay R. Ashworth
And no, companies *aren't* "forced to pay for another domain name"
just because a new TLD appears -- they aren't doing it *now*

Oh yes we are

Looking at bbc.org and bbc.tv suggests that you are not.

We used not to, bbc.org and others are why we started. We
did have bbc.tv for a while, what you see
now shows why this is a considered a problem.

I tried to stick to just one, I was wrong, legal overuled technical.

Now we have thousands such as
bbcsathalanalatpaxathipataipaxaxonlao.com
but not some obvious ones

brandon

[Roger Marquis]

As business models go, it's a fine example of how to build demand
without really servicing the community.

Of all the ways new tlds could have been implemented this has to be the
most poorly thought out. Security-aware programmers will now be unable to
apply even cursory tests for domain name validity. Phishers and spammers
will have a field day with the inevitable namespace collisions. It is,
however, unfortunately consistent with ICANN's inability to address other
security issues such as fast flush DNS, domain tasting (botnets), and
requiring valid domain contacts.

The core problem seems to be financial, as this is likely the most revenue
generating plan (both over and under the table) ICANN bean-counters could
have dreamed up. It certainly was not the foreseen outcome when non-profit
status was mandated.

I have to conclude that ICANN has failed, simply failed, and should be
returned to the US government. Perhaps the DHL would at least solicit for
RFCs from the security community.

Roger Marquis

[David Conrad]

Post by Roger Marquis

As business models go, it's a fine example of how to build demand
without really servicing the community.

Of all the ways new tlds could have been implemented this has to be the
most poorly thought out.

Oh, no. There are plenty of worse thought out approaches. _Plenty_.

Post by Roger Marquis
Security-aware programmers will now be unable to
apply even cursory tests for domain name validity.

I'm not sure how much I'd trust a 'security-aware programmer' that
relies on top-level domain name labels for _anything_, much less
domain name validity. But perhaps I misunderstand your point.

Post by Roger Marquis
Phishers and spammers
will have a field day with the inevitable namespace collisions.

I believe an attempt at limiting this is found in the restriction to
disallow 'confusingly similar' names.

Post by Roger Marquis
It is,
however, unfortunately consistent with ICANN's inability to address other
security issues such as fast flush DNS, domain tasting (botnets), and
requiring valid domain contacts.

I suspect you might not be fully aware of how ICANN works. ICANN is
not the Internet's mommy and it can't make problems go away (even
those it created itself) by waving a magic wand. It works via a
bottom-up policy definition process that involves a large number of
parties, many of which are directly at odds with each other. Efforts
are underway in several of ICANN's constituencies and advisory
councils to propose solutions to all of these (e.g., for domain
tasting see http://www.icann.org/minutes/resolutions-26jun08.htm#_Toc76113173)
, but (as I have discovered painfully) it is exceedingly difficult to
have rapid forward motion in such an environment. If you try, you get
accused of acting in non-open, non-transparent, non-accountable, etc.
ways by all sorts of people. Really.

Post by Roger Marquis
[de rigueur ICANN bashing]

It is easy to criticize (trust me, I do it all the time :-)). It is
more difficult to participate to try and get things fixed.

Regards,
-drc

[Christopher Morrow]

Post by Roger Marquis
apply even cursory tests for domain name validity. Phishers and spammers
will have a field day with the inevitable namespace collisions. It is,
however, unfortunately consistent with ICANN's inability to address other
security issues such as fast flush DNS, domain tasting (botnets), and
requiring valid domain contacts.

Please do not conflate:

1) Fast flux
2) Botnets
3) Domain tasting
4) valid contact info

These are separate and distinct issues... I'd point out that FastFlux
is actually sort of how Akamai does it's job (inconsistent dns
responses), Double-Flux (at least the traditional DF) isn't though
certainly Akamai COULD do something similar to Double-Flux (and
arguably does with some bits their services. The particular form
'Double-Flux' is certainly troublesome, but arguably TOS/AUP info at
Registrars already deals with most of this because #4 in your list
would apply... That or use of the domain for clearly illicit ends.
Also, perhaps just not having Registrar's that solely deal in criminal
activities would make this harder to accomplish...

Botnets clearly are bad... I'm not sure they are related to ICANN in
any real way though, so that seems like a red herring in the
discussion.

Domain tasting has solutions on the table (thanks drc for linkages)
but was a side effect of some customer-satisfaction/buyers-remorse
loopholes placed in the regs... the fact that someone figured out that
computers could be used to take advantage of that loophole on a
massive scale isn't super surprising. In the end though, it's getting
fixed, perhaps slower than we'd all prefer, but still.

Post by Roger Marquis
I have to conclude that ICANN has failed, simply failed, and should be
returned to the US government. Perhaps the DHL would at least solicit for
RFCs from the security community.

I'm not sure a shipping company really is the best place to solicit...
or did you mean DHS? and why on gods green earth would you want them
involved with this?

-chris

[Roger Marquis]

1) Fast flux 2) Botnets 3) Domain tasting 4) valid contact info
These are separate and distinct issues...

They are separate but also linked by being issues that only be addressed at
the registrar level, through TOS. Since some registrars have a financial
incentive not to address these issues, in practice, they can be implemented
only by ICANN policy (mandated much like the domain refund period).

I'd point out that FastFlux is actually sort of how Akamai does
it's job (inconsistent dns responses)

That's not really fast flux. FF uses TTLs of just a few seconds with
dozens of NS. Also, in practice, most FF NS are invalid. Not that FF has
a fixed definition...

Domain tasting has solutions on the table (thanks drc for
linkages) but was a side effect of some
customer-satisfaction/buyers-remorse loopholes placed in the
regs...

The domain tasting policy was, if I recall, intended to address buyers of
one to a few domains, not thousands. Would be a simple matter to fix, in a
functional organization.

I'm not sure a shipping company really is the best place to
solicit... or did you mean DHS? and why on gods green earth
would you want them involved with this?

Yes, sorry, DHS. :-) At least they are sensitive to security matters and
would, in theory, not be as easily influenced by politics as was the NSF.

Roger Marquis

[Gadi Evron]

Post by Roger Marquis

1) Fast flux 2) Botnets 3) Domain tasting 4) valid contact info
These are separate and distinct issues...

They are separate but also linked by being issues that only be addressed at
the registrar level, through TOS. Since some registrars have a financial
incentive not to address these issues, in practice, they can be implemented
only by ICANN policy (mandated much like the domain refund period).

These issues can be addressed, from a defensive standpoint alone, at:
1. The root
2. TLDs (the servers)
3. TLDs (registries)
4. Registrars
5. ISPs NS
6. Home, end-user

The ability, sanity, cost and effectiveness are the main factors deciding
what is to be done. Does anyone want a domain blocked at the TLD server
under even extreme conditions? I do, but the situation would have to be
*really* extreme, which I have only seen few of in the last 10 years.

Registries have a high level of importance to this fight, especially if
they are to make sure their business is not mostly criminally used--if
they care. Registrars are far more closer to the fight, but with less
potential impact--if they care, and we know some do. Others however are
built to begin with as criminal havens.

Post by Roger Marquis

I'd point out that FastFlux is actually sort of how Akamai does
it's job (inconsistent dns responses)

That's not really fast flux. FF uses TTLs of just a few seconds with
dozens of NS. Also, in practice, most FF NS are invalid. Not that FF has
a fixed definition...

You are both right.

FF is a concept. I should know, having been the bastard to expose it to
the public and thus getting it the defensive attention it
needed--and wide(er) exploitation (I am not the one who found out
it exists, that was someone who shall remain anonymous).

The TTL is what is mainly abused. Then it went to the NS level, and I see
no problem with NSs simply returning different answers with every query. I
believe it has in fact been done before by the criminals.

Post by Roger Marquis

Domain tasting has solutions on the table (thanks drc for
linkages) but was a side effect of some
customer-satisfaction/buyers-remorse loopholes placed in the
regs...

The domain tasting policy was, if I recall, intended to address buyers of
one to a few domains, not thousands. Would be a simple matter to fix, in a
functional organization.
From a security standpoint..

But what it actually does is allow a criminal to register a domain, use it
and dump it. Kind of like a jerk picking up a girl at a pub, if an analogy
is easier for us to use. The main difference being domains don't get hurt,
they just get replaced.

The only difference using tasting when replacing domains is that when
bought with a fake credit card (which has no practical effect on how the
criminals do business) the registrars need to handle it, and that costs
money.

The second, far more recongnized abuse, is financial and has to do
with some registrars operational practices, and/or being
somewhere between sound businesses to bastards, which is
beyond the scope of this post.

Post by Roger Marquis

I'm not sure a shipping company really is the best place to
solicit... or did you mean DHS? and why on gods green earth
would you want them involved with this?

Yes, sorry, DHS. :-) At least they are sensitive to security matters and
would, in theory, not be as easily influenced by politics as was the NSF.

You must be joking.

Post by Roger Marquis
Roger Marquis

Gadi.

[Christopher Morrow]

Post by Roger Marquis

I'd point out that FastFlux is actually sort of how Akamai does
it's job (inconsistent dns responses)

That's not really fast flux. FF uses TTLs of just a few seconds with
dozens of NS. Also, in practice, most FF NS are invalid. Not that FF has
a fixed definition...

;; ANSWER SECTION:
www.yahoo.com. 24 IN CNAME www.yahoo-ht3.akadns.net.
www.yahoo-ht3.akadns.net. 57 IN A 69.147.76.15

akamai, 60 second TTL's... most of the FF things I've seen sit around
300seconds for NS and for A records. either way, this is 60 seconds
which is fast enough.

http://en.wikipedia.org/wiki/Fast_flux

that goes fairly well to what I was referencing as FF and Double-Flux.

Post by Roger Marquis

Domain tasting has solutions on the table (thanks drc for
linkages) but was a side effect of some
customer-satisfaction/buyers-remorse loopholes placed in the
regs...

The domain tasting policy was, if I recall, intended to address buyers of
one to a few domains, not thousands. Would be a simple matter to fix, in a
functional organization.

sure, policy by committee I think drc made some references to that
process. It's taking time :(

Post by Roger Marquis
Yes, sorry, DHS. :-) At least they are sensitive to security matters and
would, in theory, not be as easily influenced by politics as was the NSF.

I'm not sure that a us-focused law/regulatory answer serves 'the
tubes' very well. Certainly DHS can help make things useful inside the
US-Govt. they may also be able to help advise, but implementation is
left to the operators and policy folks in ICANN + registries +
registrars.

-Chris

[Gadi Evron]

Post by Christopher Morrow

Post by Roger Marquis

I'd point out that FastFlux is actually sort of how Akamai does
it's job (inconsistent dns responses)

That's not really fast flux. FF uses TTLs of just a few seconds with
dozens of NS. Also, in practice, most FF NS are invalid. Not that FF has
a fixed definition...

www.yahoo.com. 24 IN CNAME www.yahoo-ht3.akadns.net.
www.yahoo-ht3.akadns.net. 57 IN A 69.147.76.15
akamai, 60 second TTL's... most of the FF things I've seen sit around
300seconds for NS and for A records. either way, this is 60 seconds
which is fast enough.

Interesting, I was under the impression anything less than 120 is
effectively as good as 120.

Gadi.

[Christopher Morrow]

Post by Gadi Evron

Post by Christopher Morrow

Post by Roger Marquis

I'd point out that FastFlux is actually sort of how Akamai does
it's job (inconsistent dns responses)

That's not really fast flux. FF uses TTLs of just a few seconds with
dozens of NS. Also, in practice, most FF NS are invalid. Not that FF has
a fixed definition...

www.yahoo.com. 24 IN CNAME www.yahoo-ht3.akadns.net.
www.yahoo-ht3.akadns.net. 57 IN A 69.147.76.15
akamai, 60 second TTL's... most of the FF things I've seen sit around
300seconds for NS and for A records. either way, this is 60 seconds
which is fast enough.

Interesting, I was under the impression anything less than 120 is
effectively as good as 120.

I have not measured... I bet yahoo has though :) and/or Akamai.
There's a reason that these folks are doing this. Would be an
interesting presentation though eh?

-Chris

[Gadi Evron]

Post by Christopher Morrow

Post by Gadi Evron
Interesting, I was under the impression anything less than 120 is
effectively as good as 120.

I have not measured... I bet yahoo has though :) and/or Akamai.
There's a reason that these folks are doing this. Would be an
interesting presentation though eh?

Yep.

Any takers?

Post by Christopher Morrow
-Chris

[Tomas L. Byrnes]

These issues are not separate and distinct, but rather related.

A graduated level of analysis of membership in any of the sets of:

1: Recently registered domain.

2: Short TTL

3: Appearance in DShield, Shadowserver, Cyber-TA and other sensor lists.

4: Invalid/Non-responsive RP info in Whois

Create a pretty good profile of someone you probably don't want to
accept traffic from.

Conflation is bad, recognizing that each metric has value, and some
correlation of membership in more than one set has even more value, as
indicating a likely criminal node, is good.

YMMV.

I guess, if you have perfect malware signatures, code with no errors,
and vigilance the Marines on the wire @ gitmo would envy, you can accept
traffic from everywhere.

-----Original Message-----
Sent: Friday, June 27, 2008 7:23 PM
To: Roger Marquis
Subject: Re: ICANN opens up Pandora's Box of new TLDs
On Fri, Jun 27, 2008 at 4:32 PM, Roger Marquis

Post by Roger Marquis
apply even cursory tests for domain name validity. Phishers and
spammers will have a field day with the inevitable namespace
collisions. It is, however, unfortunately consistent with ICANN's
inability to address other security issues such as fast flush DNS,
domain tasting (botnets), and requiring valid domain contacts.

1) Fast flux
2) Botnets
3) Domain tasting
4) valid contact info
These are separate and distinct issues... I'd point out that
FastFlux is actually sort of how Akamai does it's job
(inconsistent dns responses), Double-Flux (at least the
traditional DF) isn't though certainly Akamai COULD do
something similar to Double-Flux (and arguably does with some
bits their services. The particular form 'Double-Flux' is
certainly troublesome, but arguably TOS/AUP info at
Registrars already deals with most of this because #4 in your
list would apply... That or use of the domain for clearly
illicit ends.
Also, perhaps just not having Registrar's that solely deal in
criminal activities would make this harder to accomplish...
Botnets clearly are bad... I'm not sure they are related to
ICANN in any real way though, so that seems like a red
herring in the discussion.
Domain tasting has solutions on the table (thanks drc for
linkages) but was a side effect of some
customer-satisfaction/buyers-remorse
loopholes placed in the regs... the fact that someone figured
out that computers could be used to take advantage of that
loophole on a massive scale isn't super surprising. In the
end though, it's getting fixed, perhaps slower than we'd all
prefer, but still.

Post by Roger Marquis
I have to conclude that ICANN has failed, simply failed,

and should be

Post by Roger Marquis
returned to the US government. Perhaps the DHL would at

least solicit

Post by Roger Marquis
for RFCs from the security community.

I'm not sure a shipping company really is the best place to solicit...
or did you mean DHS? and why on gods green earth would you
want them involved with this?
-chris

[Gadi Evron]

Post by Tomas L. Byrnes
These issues are not separate and distinct, but rather related.
1: Recently registered domain.
2: Short TTL
3: Appearance in DShield, Shadowserver, Cyber-TA and other sensor lists.
4: Invalid/Non-responsive RP info in Whois
Create a pretty good profile of someone you probably don't want to
accept traffic from.
Conflation is bad, recognizing that each metric has value, and some
correlation of membership in more than one set has even more value, as
indicating a likely criminal node, is good.
YMMV.
I guess, if you have perfect malware signatures, code with no errors,
traffic from everywhere.

Not quite, because you still won't know who to send the Marines to kill.
The Internet is perfect for plausible deniability.

Gadi.

Post by Tomas L. Byrnes

-----Original Message-----
Sent: Friday, June 27, 2008 7:23 PM
To: Roger Marquis
Subject: Re: ICANN opens up Pandora's Box of new TLDs
On Fri, Jun 27, 2008 at 4:32 PM, Roger Marquis

Post by Roger Marquis
apply even cursory tests for domain name validity. Phishers and
spammers will have a field day with the inevitable namespace
collisions. It is, however, unfortunately consistent with ICANN's
inability to address other security issues such as fast flush DNS,
domain tasting (botnets), and requiring valid domain contacts.

1) Fast flux
2) Botnets
3) Domain tasting
4) valid contact info
These are separate and distinct issues... I'd point out that
FastFlux is actually sort of how Akamai does it's job
(inconsistent dns responses), Double-Flux (at least the
traditional DF) isn't though certainly Akamai COULD do
something similar to Double-Flux (and arguably does with some
bits their services. The particular form 'Double-Flux' is
certainly troublesome, but arguably TOS/AUP info at
Registrars already deals with most of this because #4 in your
list would apply... That or use of the domain for clearly
illicit ends.
Also, perhaps just not having Registrar's that solely deal in
criminal activities would make this harder to accomplish...
Botnets clearly are bad... I'm not sure they are related to
ICANN in any real way though, so that seems like a red
herring in the discussion.
Domain tasting has solutions on the table (thanks drc for
linkages) but was a side effect of some
customer-satisfaction/buyers-remorse
loopholes placed in the regs... the fact that someone figured
out that computers could be used to take advantage of that
loophole on a massive scale isn't super surprising. In the
end though, it's getting fixed, perhaps slower than we'd all
prefer, but still.

Post by Roger Marquis
I have to conclude that ICANN has failed, simply failed,

and should be

Post by Roger Marquis
returned to the US government. Perhaps the DHL would at

least solicit

Post by Roger Marquis
for RFCs from the security community.

I'm not sure a shipping company really is the best place to solicit...
or did you mean DHS? and why on gods green earth would you
want them involved with this?
-chris

[Christopher Morrow]

Post by Tomas L. Byrnes
These issues are not separate and distinct, but rather related.
1: Recently registered domain.

hi, I just registered 'newproduct.com' for my press release, I'm
sending you emails from that domain since you signed up with my
company for new news alerts abotu my great products!

Post by Tomas L. Byrnes
2: Short TTL

I'm anticipating high traffic loads, I'm putting my pressrelease
things on akamai/llnw, I want to shift that away quickly when traffic
levels decrease. I made my ttl's short, for that, plus akamai sets my
ttl's on their responses to 5mins.

Post by Tomas L. Byrnes
3: Appearance in DShield, Shadowserver, Cyber-TA and other sensor lists.

sure, these are fine folks... they get things wring at times :(

Post by Tomas L. Byrnes
4: Invalid/Non-responsive RP info in Whois

oh, whois isn't updated with NS info updates... so for 6-12 hours that
data's not going to reflect 'valid' info while I send out my
notifications.

Post by Tomas L. Byrnes
Create a pretty good profile of someone you probably don't want to
accept traffic from.

I agree that correlation across many forms of intell gathering is
good, and probably the way out for folks on the good side of this
battle. My point was that tossing FUD on top of the 'icann made a
mistake, maybe' isn't helping the argument nor discussion.

There should be some work, and maybe there is work happening on this,
done to bring ICANN policies up to speed with respect to dealing with:
1) domain owners who have invalid (chronically bad) info
2) registrars who seem to solely

Post by Tomas L. Byrnes
Conflation is bad, recognizing that each metric has value, and some
correlation of membership in more than one set has even more value, as
indicating a likely criminal node, is good.
YMMV.
I guess, if you have perfect malware signatures, code with no errors,
traffic from everywhere.

-----Original Message-----
Sent: Friday, June 27, 2008 7:23 PM
To: Roger Marquis
Subject: Re: ICANN opens up Pandora's Box of new TLDs
On Fri, Jun 27, 2008 at 4:32 PM, Roger Marquis

Post by Roger Marquis
apply even cursory tests for domain name validity. Phishers and
spammers will have a field day with the inevitable namespace
collisions. It is, however, unfortunately consistent with ICANN's
inability to address other security issues such as fast flush DNS,
domain tasting (botnets), and requiring valid domain contacts.

1) Fast flux
2) Botnets
3) Domain tasting
4) valid contact info
These are separate and distinct issues... I'd point out that
FastFlux is actually sort of how Akamai does it's job
(inconsistent dns responses), Double-Flux (at least the
traditional DF) isn't though certainly Akamai COULD do
something similar to Double-Flux (and arguably does with some
bits their services. The particular form 'Double-Flux' is
certainly troublesome, but arguably TOS/AUP info at
Registrars already deals with most of this because #4 in your
list would apply... That or use of the domain for clearly
illicit ends.
Also, perhaps just not having Registrar's that solely deal in
criminal activities would make this harder to accomplish...
Botnets clearly are bad... I'm not sure they are related to
ICANN in any real way though, so that seems like a red
herring in the discussion.
Domain tasting has solutions on the table (thanks drc for
linkages) but was a side effect of some
customer-satisfaction/buyers-remorse
loopholes placed in the regs... the fact that someone figured
out that computers could be used to take advantage of that
loophole on a massive scale isn't super surprising. In the
end though, it's getting fixed, perhaps slower than we'd all
prefer, but still.

Post by Roger Marquis
I have to conclude that ICANN has failed, simply failed,

and should be

Post by Roger Marquis
returned to the US government. Perhaps the DHL would at

least solicit

Post by Roger Marquis
for RFCs from the security community.

I'm not sure a shipping company really is the best place to solicit...
or did you mean DHS? and why on gods green earth would you
want them involved with this?
-chris

[Christopher Morrow]

(picking up where I ejected on the email...argh)

On Sat, Jun 28, 2008 at 12:19 AM, Christopher Morrow

Post by Christopher Morrow

Post by Tomas L. Byrnes
These issues are not separate and distinct, but rather related.
1: Recently registered domain.

hi, I just registered 'newproduct.com' for my press release, I'm
sending you emails from that domain since you signed up with my
company for new news alerts abotu my great products!

Post by Tomas L. Byrnes
2: Short TTL

I'm anticipating high traffic loads, I'm putting my pressrelease
things on akamai/llnw, I want to shift that away quickly when traffic
levels decrease. I made my ttl's short, for that, plus akamai sets my
ttl's on their responses to 5mins.

Post by Tomas L. Byrnes
3: Appearance in DShield, Shadowserver, Cyber-TA and other sensor lists.

sure, these are fine folks... they get things wring at times :(

Post by Tomas L. Byrnes
4: Invalid/Non-responsive RP info in Whois

oh, whois isn't updated with NS info updates... so for 6-12 hours that
data's not going to reflect 'valid' info while I send out my
notifications.

Post by Tomas L. Byrnes
Create a pretty good profile of someone you probably don't want to
accept traffic from.

I agree that correlation across many forms of intell gathering is
good, and probably the way out for folks on the good side of this
battle. My point was that tossing FUD on top of the 'icann made a
mistake, maybe' isn't helping the argument nor discussion.
There should be some work, and maybe there is work happening on this,
1) domain owners who have invalid (chronically bad) info
2) registrars who seem to solely

solely registering bad/criminal/abusive domains...

-chris

[Phil Regnauld]

Post by Roger Marquis
I have to conclude that ICANN has failed, simply failed, and should be
returned to the US government. Perhaps the DHL would at least solicit for
RFCs from the security community.

DHS ? Otherwise, yes, you could ship ICANN back to the US gvt. with DHL,
but I don't think they'll give us our money back.