Still Missing in Action

After wading through the various IANA Notice of Inquiry (NOI) submissions I thought I would take a break and do a secondary review of the recently concluded ICANN regional meeting in San Francisco. In doing this review there were three things that kind of jumped out at me as still missing in action. more

When a UDRP Panel Infers Bad Faith from An Asking Price

In the Converse.co dispute, a three-member UDRP panel unanimously ordered the transfer of the disputed domain name to the Complainants, All Star C.V. and Converse, Inc., owners of the well-known brand CONVERSE for shoes and apparel. The panel drew the inference that the Respondent, by setting of an asking price of around $300,000 after having acquired the domain name for $306, was primarily motivated by a bad faith intent to target the Complaint. more

Enough With Blacklisting Online Pharmacies, Isn’t It Time to Consider White Lists?

Before I go back to the beginning, let me make clear that what follows are my personal observations vis-a-vis how National Association of Boards of Pharmacy (NABP) is managing the .Pharmacy Registry relative to personal experience as founder, President and CEO of Tralliance Corporation, the original manager of the .Travel Registry. My analysis may be a little long, but I promise that if you stay with me, you will be enlightened. more

DDOS Attackers - Who and Why?

Bruce Schneier's recent blog post, "Someone is Learning How to Take Down the Internet", reported that the incidence of DDOS attacks is on the rise. And by this he means that these attacks are on the rise both in the number of attacks and the intensity of each attack. A similar observation was made in the Versign DDOS Trends report for the second quarter of 2015, reporting that DDOS attacks are becoming more sophisticated and persistent in the second quarter of 2016. more

Live Today - “IPv4 Exhaustion and the Path to IPv6” from INET Denver

If you are interested in the current state of IPv4 address exhaustion within North America as well as the current state of IPv6 deployment, there will be a live stream today, April 17, of the sessions happening at INET Denver starting at 1:00pm US Mountain Daylight Time (UTC-6). The event is subtitled "IPv4 Exhaustion and the Path to IPv6" and you can view the live stream at. more

Sharing ICANN Can Be Win-Win for the United States

With the Internet's global reach and importance showing exponential growth, pressure on the United States to share control of ICANN is mounting. A number of experts believe that the question is simply how much the United States should give up and how soon. This essay argues that "giving up" can be a win-win solution; i.e., control sharing is not a zero-sum game. more

The Christmas Goat and IPv6 (Year 3)

As Christmas were getting closer, the third time of load balancing the streaming pictures of the famous Christmas goat in the city of Gävle, Sweden, was on the agenda. My goal with this activity is the same as before, to track the use of IPv6 and DNSSEC validation. The results from the last two years are published on CircleID. more

5G Security Transparency

There is considerable rhetoric propagated today about 5G security. Some of the more blatant assertions border on xenophobia with vague assertions that the 5G vendors from some countries cannot be trusted and wholesale government banning is required. Existing treaty obligations are being summarily abrogated in favour of bilateral trade bullying. These are practices that the late President George H.W. Bush sought to eliminate a quarter century ago through intergovernmental organization initiatives... more

DNS… Wait a SEC

Complete DNSSEC implementation requires that domains are authenticated at the root by the Registry, and that DNS zones and records are authenticated as well. Now before I go any further, let me begin by stating that I fully support the development and deployment of DNSSEC and that the vulnerabilities presented by Cache Poisoning are very real, especially for those websites collecting login credentials or other types of sensitive information. more

“Keep Those Eyebrows Up!” - Cybersecurity at the Global Women’s Forum

News of cyberattacks is slowly becoming a new normal. We are still at a stage where high-profile cases, like the recent attack against the American credit reporting company Equifax, in which 145.5 million users had their personal information compromised, raise eyebrows. But we need those eyebrows to stay up because we should never accept cyber threats as the new normal. more

Why Aren’t We Fixing Route Leaks?

In case you missed it (you probably didn't), the Internet was hit with the Monday blues this week. As operator-focused lists and blogs identified, "at 17:47:05 UTC yesterday (6 November 2017), Level 3 (AS3356) began globally announcing thousands of BGP routes that had been learned from customers and peers and that were intended to stay internal to Level 3. By doing so, internet traffic to large eyeball networks like Comcast and Bell Canada, as well as major content providers like Netflix, was mistakenly sent through Level 3's misconfigured routers." more

“Can IP Be Protected in the Internet Age?” Panel Recap from Russian Economic Development Conference

In June, I attended the St. Petersburg International Economic Forum ("SPIEF"), organized by the Russian government's Ministry of Economic Development. This was a major event drawing thousands of participants to St. Petersburg... I participated on a panel entitled "Can IP Be Protected in the Internet Age?" Right away, I trust many of you find the titling odd... more

Call the Routing Police!

There was a somewhat unfortunate outage for a major communications service provider in Australia, Optus, in mid-November. It appears that one of their peer Border Gateway Protocol (BGP) networks mistakenly advertised a very large route collection to the Optus BGP network, which caused the routers to malfunction in some manner. more

Not Quite Two Factor, or Is Your Phone Number Really Something You Have?

A recent article in the New York Times Dealbook column reported on phone number hijacking, in which a bad guy fraudulently takes over someone's mobile phone number and used it to reset credentials and drain the victim's account. It happens a lot, even to the chief technologist of the FTC. This reminds us that security is hard, and understanding two-factor authentication is harder than it seems. more

Raspberries! Botnet Spam Just Got a Whole Lot More Dangerous

Many have heard of botnets, but for those that aren't certain what they are: Botnets are armies of hacked zombie computers that have malware on them, and send spam email at the command of operators anywhere in the world. They can also be told to deploy denial of service attacks, by all hitting the homepage of a given company, or attacking the DNS server or a service or country. more