Featured Blogs

ICANN’s 9th Status Report: The Goals Are Good

ICANN has made great strides in implementing steps to improve the organization's transparency, accountability, openness - according to their most recent Status Report [PDF]. The report describes the requirements of their MOU with the Department of Commerce and what the organization has done to toward achieving these goals. However, even though the Report makes it sound as if ICANN is on the right track, some troubling issues lay underneath the surface of the Report.  more

Estonian Cyber Security Strategy Document: Translated and Public

The Estonians have a public version of their cyber security strategy translated into English (currently available offline only). The concept of a national strategy for cyber security is one which I am particularly fond of... The following is the Summary section from the document which might be of interest... more

Looking at .Net Bids

ICANN is now seeking public comments regarding the .net bids. Unlike before, I am not going to offend one friend or another by siding with one proposal over another. They are all qualified and experienced registry operators. Instead, I will make some general observations. 1. None of the Revenue and Pricing Model (i.e. Section 4) about the bids are available to public... more

A Study on Public Participation in ICANN

The following is an executive summary from the preliminary study by John Palfrey, Clifford Chen, Sam Hwang, and Noah Eisenkraft at the Berkman Center for Internet & Society at Harvard Law School. This study considers to what extent the Internet Corporation for Assigned Names and Numbers (ICANN) has achieved its stated goal of a "representative" and "open" decision-making process. more

Brand Impersonation Online is a Multidimensional Cybersecurity Threat

Brand impersonation happens much more often than people realize. In CSC's latest Domain Security Report, we found that 75% of domains for the Global 2000 that contained more than six characters from the brand names were not actually owned by the brands themselves. The intent of these fake domain registrations is to leverage the trust placed on the targeted brands to launch phishing attacks, other forms of digital brand abuse, or IP infringement... more

President of Tucows Responds to WLS Issue

I will try and take a different approach with this post. There are two elements of WLS that I think are most material and are not discussed often enough. They are i) the scope of the original NSI-ICANN contract and ii) the use of multiple accreditations.

...Verisign is paid a sum of money to perform a service. They own neither the primary nor the secondary data. I will not bore you with a recitation of various sections of the agreement nor with long-winded legal arguments. They are for another forum. The implication of this conclusion as it relates to WLS is that any re-registration market service is outside the scope of the original contract and should be treated as any new service should. more

A Year of CAN SPAM

The CAN SPAM Act of 2003 went into effect a year ago on Jan 1, 2004. As of that date, spam suddenly stopped, e-mail was once again easy and pleasant to use, and Internet users had one less problem to worry about. Oh, that didn't happen? What went wrong? more

Industry Insights: RDAP Becomes Internet Standard

Earlier this year, the Internet Engineering Task Force’s (IETF’s) Internet Engineering Steering Group (IESG) announced that several Proposed Standards related to the Registration Data Access Protocol (RDAP), including three that I co-authored, were being promoted to the prestigious designation of Internet Standard. Initially accepted as proposed standards six years ago, RFC 7480, RFC 7481, RFC 9082 and RFC 9083 now comprise the new Standard 95. RDAP allows users to access domain registration data and could one day replace its predecessor the WHOIS protocol. more

Mitigating Spoofed Attacks Using IPv6 Address Space

Timothy D. Morgan's recent paper titled, "IPv6 Address Cookies", seeks to apply the fundamental shift in resource availability brought about by the vastly increased Internet address space in IPv6 to develop a novel, lower cost solution to mitigating spoofed attacks. "Spoofed denial of service attacks have plagued the Internet for a number of years, and show no signs of abating. Research into mitigation techniques has apparently not led to a financially viable solution, and new attacks have been discovered in the wild without being widely anticipated". The following provides an introduction to this paper. more

ARF is Now an IETF Standard

When a user of a large mail system such as AOL, Yahoo, or Hotmail reports a message as junk or spam, one of the things the system does is to look at the source of the message and see if the source is one that has a feedback loop (FBL) agreement with the mail system. If so, it sends a copy of the message back to the source, so they can take appropriate action, for some version of appropriate. For several years, ARF, Abuse Reporting Format, has been the de-facto standard form that large mail systems use to exchange FBL reports about user mail complaints. more

Demystifying Premium Domain Names

For the purpose of this article it is not necessary to concentrate too much on defining what a Premium domain name is and what it is useful for: all that we need to know is simple, a premium domain name is often a memorable generic name, short or medium in length and highly valuable due to its relevance in search. However, when it comes to finding out how to register a premium domain name then it becomes much more difficult because you won't necessarily know where to go. more

China Hacks Google, Etc.

Many news sources are reporting on how Google and other corporations were hacked by China. The reports, depending on vendor, blame either PDF files via email as the original perpetrator, or lay most of the blame on an Internet Explorer 0day. more

CIRA Creates Backdoor WHOIS Exceptions for Police and IP Owners

Earlier this year, I wrote glowingly about the new CIRA whois policy, which took effect today and which I described as striking the right balance between access and privacy. The policy was to have provided new privacy protection to individual registrants - hundreds of thousands of Canadians - by removing the public disclosure of their personal contact information... Apparently I spoke too soon. more

ICANN Whois Policies Update

According to an article in the October 15, 2004 INTA Bulletin, several new "Policies Applicable to ICANN-Accredited Registrars" will be implemented by the end of 2004. The new Restored Names Accuracy Policy tales effect November 12 and requires that a domain name that was deleted due to the submission of false contact data or lack of response to a registrar's inquiries...  more

EU to ICANN: Go Back to Drawing Board on Auctions!

The European Commission is not a big fan of the David versus Goliath ICANN new gTLD auction scenario. On December 12 last year, ICANN released a set of revised public auction rules. These auctions are presented as the avenue of last resort for resolving new gTLD contentions. As is ICANN's custom, the rules were put out for public comment. The EU submitted its statement on the very last day of the comment reply period. more