Featured Blogs

DNSSEC - Let’s Stay the Course!

I don't know about you, but I'm starting to think that DNSSEC being so hot these days is a mixed blessing. Yes, it's wonderful that after so many years there is finally broad consensus for making DNSSEC happen. But being so prominent also means the protocol is taking shots from those who don't want to make the necessary software, hardware and operational modifications needed. And DNSSEC has taken some shots from those who just want to be contrarian. more

Can Big Companies Stop Being Hacked?

The recent huge security breach at Sony caps a bad year for big companies, with breaches at Target, Apple, Home Depot, P.F.Changs, Neiman Marcus, and no doubt other companies who haven't admitted it yet. Is this the new normal? Is there any hope for our private data? I'm not sure, but here are three observations... This week Brian Krebs reported on several thousand Hypercom credit card terminals that all stopped working last Sunday. Had they all been hacked? more

ICANN Must Simultaneously Reveal TLD and Second-Level Registration Rules

I outline two possible drawbacks with the idea of first revealing rules for the new proposed Top-Level Domains (TLDs) and then for second-level registrations. I propose a lottery process to initially allocate second-level domain names. A number of people have voiced concerns about the idea of automatically granting the winner of the TLD a monopoly power over second-level domain registrations. We should also be worried about the financial interest ICANN has in not providing the rules for the two-level registrations simultaneously. more

Ethical Hacking: Turning The Tables to Boost Cyber Security

Hacking remains a huge problem for businesses. As noted by MarketWatch, more than 175 data breaches have already happened this year, and in 2015 approximately 105 million adults in the United States had their personal information stolen. For companies, the stakes are huge: Compromised systems not only damage the bottom line but can severely impact public opinion. more

Identifying Spam: MAAWG’s Latest Documents Improve Accuracy of Reputation Systems

The Messaging Anti-Abuse Working Group (MAAWG), of which Return Path (my employer) is a very active participant, met recently in Heidelberg, Germany. Among other exciting projects, they finished two new best practices documents which have been lauded in the press as a big step towards stopping botnet spam... more

Internet and the Telecommunication Acts of 1900

On his blog Bruce Schneier recently published a post called "Power and the Internet". An article that most people in the western world will agree with. Internet freedom against Internet safety and security, the powerful have a lot of power to wield and the rest is at best ad hoc organised or fairly powerless lobby organisations. So who is likely to win? Vested interests, he warns. more

Asserting but Not Proving Cybersquatting Under the UDRP

Having trademarks (registered or unregistered) is the prerequisite for maintaining a UDRP, but having one is not conclusive of either Respondent’s lack of rights or legitimate interests or that it registered and is using the domain name in bad faith. The cautionary tale in many of these cases, especially for the Complainant who has the burden of proof, is that it has to satisfy each of the elements in the three subsections... more

Unlimited Bandwidth is Disrupting Infrastructure Models

Over the last ten years we have heard a lot about edge-based services. These were needed to enable the operation of applications at the edge of the network, as the lack of available bandwidth capacity made it difficult to do so over the core network. However, with the prospect of limitless bandwidth the design of the network is changing again. more

Use STIX to Block Robocalls

It is one of those oddities that occurs around Washington from time to time. During the same hour today, the Federal Communications Commission (FCC) was meeting at its downtown headquarters trying to stop robocalls, while a large gathering of government and industry cybersecurity experts were meeting a few miles away at Johns Hopkins Applied Physics Lab advancing the principal means for threat information sharing known as STIX. more

“Capacity” - The Hidden Word?

What is so secret about the word, "Capacity"? As I read and talk with people I realize the word, "capacity" is typically missing from the DNS discussion. "Capacity" and "Security" are the two cornerstones to maximizing DNS resilience; both of which are typically missing from the DNS discussion. Have you seen a single DNS node easily process over 863,000 queries per second? Have you seen a network routinely handle over 50Gbits/second in outbound traffic alone without breaking a sweat? more

No Time Bar, No Laches under the UDRP

Two Uniform Domain-Name Dispute-Resolution Policy (UDRP) decisions posted this month involved domain names registered 20 and 21 years ago, David Duchovny v. Alberta Hot Rods c/o Jeff Burgar, 21 years and Commonwealth Bank of Australia v. Registration Private, Domains By Proxy, 20 years. Complainants prevailed in both cases. The domain names stand out as being the oldest to have been found registered in bad faith, and transferred. more

Balancing Rights: Mark Owners, Emergent Businesses, and Investors

Is there any act more primary than naming? It comes before all else and makes possible what follows. For the most part, names are drawn from cultural assets: collections of words, geographic locations, family names, etc. They can be valuable, which is why they are guarded, protected, and hoarded. The balancing of rights among those competing for names is a deliberate feature of the Uniform Domain Name Dispute Resolution Policy (UDRP). more

Senate Report on 5G: Recipe for Disaster

The Democratic Staff Report Prepared for the use of the Committee on Foreign Relations United States Senate, July 21, 2020, entitled "The New Big Brother," is actually all about 5G technology. The report jumps on the runaway anti-China train chaotically flailing around Washington these days to "out-Trump, Trump." It characterizes 5G technology, longstanding international collaboration, and COVID-19 tracking as all part of a global conspiracy for "digital authoritarianism" run out of Beijing. more

The Three-Character Question at the Heart of Single-Character .COMs: W-H-Y?

In the matter relating to O.COM, I've focused on the fact that VeriSign has -- in correspondence to the organization that is counter-party to its .COM and transliterated .COM IDN Registry Agreements, in earnings calls with its investors and financial analysts, and in policy published on its website for every innocent and unsuspecting Tom, Dick, and Harry in the world to be duped by -- stated an unequivocal and unwavering commitment . more

ICANN to Reconsider the .Amazon Domain Applications

Amazon filed applications for the .AMAZON top-level domains in several scripts in 2012. Five years later, ICANN will re-examine the applications after an Independent Review Process (IRP) proceeding. The IRP Panel found that ICANN's Board failed to demonstrate the existence of public policy reasons for denying the applications. more