​I consider myself a not-unsophistcated user of Internet-access software, to the point that I serve as informal tech support for ​far more people than I'd like.

​The page that Google Chrome provides when it's confused by a certificate instance is as oppressive as​ the Blue Screen of Death. The other browsers are even worse. We're generations away from the level of simplicity that would be needed to eliminate web-based scammers by digitally flagging them as such.

​ICANN has an interesst in accelerating this progress, for the sake of public trust and stability, but it certainly ought not to do this itself. That's what I meant by being part of alliances rather than engage in mission creep.

​

​Ought to, sure, but it's way too late​ for that debate now. ICANN got itself sucked into name protection long ago, and that can't be undone. So now telling the world that coke.foo needs (and has) elaborate protection mechamisms (even going beyond global trademark norms), but that redcross.foo has none of those protections and won't ever get them, is not an exercise in trust-building. And, as a non-treaty organization, ICANN is highly dependent on public trust.

Unfortunately, thanks to choices already made by ICANN, the challenges here have been irreversibly rendered political rather than technical. And "Let them eat SSL" does not make for a winning political strategy.

​- Evan​