August 2008 - NA-Discuss - lists.icann.org

Re: [NA-Discuss] [At-Large] Updates to New gTLD Program Implementation andauctioning model.
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

Chris and all, Good point, good argument, and your conclusion is of course spot on. But Chris, some of these folks are dreamers. As such they seek the good nature of capitalists to support their rice/begging bowl of demands or desires. That's of course not how raw Capitalism works, and never has been. ICANN is gluten for more money as having more money equates to more power and influence. Remember, as I am sure you do, influence is always for sale, but rarely for free. This ALAC proposal is so weak as to be pitiful. The IPC and BC will see it in a New York second. Only DOC/NTIA can nix the ICANN new gTLD auction implimentation proposal. IMO and the opinion of our members, they should do so. But I doubt that they will. NameCritic wrote: > I like your thoughts about the funds going into an account to assist those > that cannot afford the high price ICANN wants for the creation of a new TLD. > How would you suggest the playing field be equal in terms of small business > owners vs. large corporations? Auctions favor the larger corporation or > anyone with more money. That has never been an equitable solution. Do you > believe that those who created TLDs in other roots with the intention of > being added to the ICANN root should have no preference given to them? With > domain names, first come, first serve was always the accepted method. The > new ICANN gTLD process ignores those who have already shown their > intentions, many for several years, in favor of whoever can pay the most > money. You really think this is fair? > > Chris McElroy > > ----- Original Message ----- > From: "Alan Greenberg" <alan.greenberg(a)mcgill.ca> > To: <at-large(a)atlarge-lists.icann.org> > Sent: Sunday, August 10, 2008 5:20 PM > Subject: Re: [At-Large] Updates to New gTLD Program Implementation and > auctioning model. > > > Patrick and Hong, I find your comments a strong over-reaction. > > > > The issue that is being discussed is how to handle the situation of > > multiple people applying for the same TLD, and they cannot come to an > > agreement amongst themselves. Classic examples are ".web" and ".mail" > > but there are plenty of other examples. > > > > The paper discusses the various ways of addressing such conflicts, > > and comes to the conclusion that auctions are probably the preferable > > path. If you disagree with this, that is fine. The only seeming > > practical alternative is a subjective analysis of which is the best > > for the overall good of the Internet or the communities or whatever > > (the so-called beauty contest). I find that alternative far too > > fraught with potential problems, but if that is what you favour, it > > would be interesting to hear how you think it can be done properly. > > > > Using an auction to resolve the conflict does indeed mean that .web > > will not likely go to a small not-for-profit organization. If that is > > your concern, then in my mind, you are being somewhat unrealistic. > > > > On the positive side, the possible auctions of these relatively few > > high-profile TLDs will likely bring in a LOT of money. It has > > repeatedly been suggested that this wind-fall profit not be simply > > wrapped into ICANN general funds, or even used to offset the costs of > > offering new gTLDs. But rather it be used to (with appropriate > > caution) make it less expensive and less onerous for not-for-profits, > > cultural communities and developing countries folks to acquire new gTLDs. > > > > Now THAT is something that I think At-Large should make a strong > > statement about. > > > > Alan > > > > > > At 09/08/2008 06:03 PM, Hong Xue wrote: > >>Thanks for drawing our attention on this paper. Given that the new gTLD > >>process embraces the IDN TLDs, the paper presents a very surprising, or > >>shocking view, on allocation of TLDs. If the paper is primarily on the > >>economic consideration, I wonder if the ICANN has any other consideration, > >>such as protecting cultural diversity and bridging digital divide, on > >>selection of new gTLDs (IDN gTLDs). As a governing body of a critical > >>Internet resources, ICANN should envisage the values that are more > >>important > >>and fundamental than the highest bidding amount. I echo what has been > >>precisely stated by Vittorio: > >> > >>Another wrong assumption is that monetary value is the only quantity that > >>counts.In fact, personally I think that the "value" of a TLD is mostly > >>connected to other factors. For example, one is how many final users of > >>the > >>Internet will ever use services located inside that TLD; another one is > >>how > >>strongly these people will feel attached to that TLD, i.e. whether the TLD > >>contributes to build any kind of "community identity" for an online group > >>of > >>people that presently does not have it; a third one is whether the new TLD > >>will spawn innovative uses of the DNS or enable innovative services. None > >>of > >>these is directly connected to monetary value, and it is quite disturbing > >>to > >>me that an organization like ICANN, which is meant to steward scarce > >>global > >>public resources in the interest of the entire community of the Internet, > >>still seems to have such a partial and narrow view of where the value of > >>the > >>Internet itself lies. > >>Hong > >> > >> > >> > >> > >>On Sat, Aug 9, 2008 at 11:14 PM, Patrick Vande Walle > >><patrick(a)vande-walle.eu > >> > wrote: > >> > >> > http://icann.org/en/announcements/announcement-08aug08-en.htm > >> > > >> > ICANN has published a paper from its contractor PowerAuctions LLC, > >> > regarding the use of auctions to award new TLD strings in case of > >> > contention. > >> > > >> > http://icann.org/en/topics/economic-case-auctions-08aug08-en.pdf > >> > > >> > I think it would be important that the At Large speaks up. The model > >> > proposed in the document is a purely capitalistic one. It is based on > >> > the assumption that all gTLDs are created to make as much money as > >> > possible. Smaller, community based TLDs seem quite difficult to launch > >> > in such context. > >> > > >> > The mere possibility of auctions will actually generate contention on > >> > some strings. The little guys wishing to establish a not-for-profit TLD > >> > will be outplayed by the wealthy ones. > >> > > >> > A public forum has been established at > >> > http://forum.icann.org/lists/auction-consultation/. > >> > Comments to auction-consultation(a)icann.org before 8 September 2008. > >> > > >> > -- > >> > Patrick Vande Walle > >> > > >> > > >> > _______________________________________________ > >> > At-Large mailing list > >> > At-Large(a)atlarge-lists.icann.org > >> > > >> > > >> http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > >> > > >> > At-Large Official Site: http://atlarge.icann.org > >> > > >>_______________________________________________ > >>At-Large mailing list > >>At-Large(a)atlarge-lists.icann.org > >>http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > >> > >>At-Large Official Site: http://atlarge.icann.org > > > > > > > > _______________________________________________ > > At-Large mailing list > > At-Large(a)atlarge-lists.icann.org > > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > > > At-Large Official Site: http://atlarge.icann.org > > > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [At-Large] Updates to New gTLD Program Implementation andauctioning model.
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

Alan and all, I don't think it has a chance in hell! The ALAC and the NARALO's need to be self funding and should have been long before now. Than they could have argued from a point of strength. Instead as penniless themselves, they go begging. Such is a poor strategy and likely than not, a strategy of mostly failure. Alan Greenberg wrote: > It will not be easy regardless of any goodwill and the best of > intentions. But it seems like a reasonable goal. > > Alan > > At 11/08/2008 06:56 AM, Jacqueline A. Morris wrote: > >Hi Alan > >Coming from the developing world, I like your idea - but am not > >confident that it will happen. I hope ALAC will support such a > >proposal, and work to make it iron-clad, so that it cannot be easily > >circumvented, and so that the fund does not end up assisting > >registrars, registries, IP lawyers, etc. to get cheaper domains. > >Jacqueline > > > >Alan Greenberg wrote: > >> > >>On the positive side, the possible auctions of these relatively few > >>high-profile TLDs will likely bring in a LOT of money. It has > >>repeatedly been suggested that this wind-fall profit not be simply > >>wrapped into ICANN general funds, or even used to offset the costs > >>of offering new gTLDs. But rather it be used to (with appropriate > >>caution) make it less expensive and less onerous for > >>not-for-profits, cultural communities and developing countries > >>folks to acquire new gTLDs. > >> > >>Now THAT is something that I think At-Large should make a strong > >>statement about. > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] were all screwed - the only solution is obvious - smart ids dns
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

Dr. Joe and all, I don't know if OpenDNS has what your suggesting deployed. But it is slowly becoming far more clear that ICANN is not fully deploying or implementing DNSSEC. I cannot for certain determine as to why, however. I can only suspect that ICANN doesn't have the horses, nor does the IANA any longer, to properly implement DNSSEC. Same for IPSEC, BTW. Further, selling DNSSEC to Registries, Registrars, and Registrants, as well as ISP/IAP's is not going well, nor for that matter is IPv6, thank god. One should also consider or actually recognize that IP registries are far more security vulnerable than the roots, DN registries and registrars, or registrants. But I would like to believe and certainly hope that the GAC recognizes how important DNS security is, and to some degree why it is so. Let's hope that the FCC and DOC/NTIA can hold ICANN properly and fully accountable as well as liable as critical economic health and governmental infrastructure is at stake. Right now though the ignorance of DNS security as a necessity is still wide spread. The touchy-feely social engenerring folks and their associated groups don't see this as a significant danger. When they get bit, maybe than they will. What's needed IMPO is that DNS needs a major re-write, especially Bind. Vixie could do it, Bernstine could do it, I have along with my execellent technical staff, done it, and there are a precious few others that could do it, none are that interested, as it is a significant task. For the Social Engenerring folks not to understand how important this is, is beyond reasonable thinking. ICANN, the IANA, and especially the IETF know better, so ICANN's SSAC not adaquately addressing this is simply not excusable, and they know it! However Dr. Joe, we're not all "screwed", as you so elequently put it, yet. >:) However seems that we are all exposed, as it were. >:( Joe Baptista wrote: > People, were all screwed thanks to this DNS vulnerability. It is > truly a monster in the making and we are being bamboozled into > thinking DNSSEC will save our sorry souls. And the ease of causing > damage to internet infrastructure is enormous. > > Every banking transaction, every communication channel can now be high > jacked by any script kiddie with a network of bots. And we are being > asked to settle for DNSSEC which is clear is not so secure and easily > broken by - guess who - script kiddies. When the kiddies figure out > how to control the DNS through these vulnerabilities were going to be > a mess. > > My main concern are the criminals who will soon also discover how > these flaws can be exploited. Port randomization as has been show > does not work. It just take more time to do. Bernsteins concern with > the year 2015 is very real today. > > I've asked Vixie some questions and gotten some replies. I hate to > say this but the only real way left to guard against this attack is an > intrusion detection system (IDS) to monitor any recursive DNS server > and a good well behaved firewall. > > I addressed the fix for these problems back Jan 2007 in the > Public-Root Name Server Operational Requirements document published by > INAIC. The sections are 4.2.7 to 4.2.9. The reference document is at > the following URL. > > http://www.publicroot.org/technical/root-server-standards.pdf > > In any case thats what now needs to be done to secure DNS ASAP. A > would recommend a smart IDS that not only detects but also based on a > set of rules attempt to find and correct the answer or response to the > DNS server in real time. I expect OpenDNS has this sort of thing > deployed. > > cheers > joe baptista > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] Vixies vixens make big boo boo on successful Russian DNS hack
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

Dr. Joe and all, Well your very welcome indeed! >:) After all what is a meal, if not with the proper spice to enhance properly the savory taste eh? Unless of course that meal is best served cold... Food for thought prhaps? You be the judge. Joe Baptista wrote: > > > On Sun, Aug 10, 2008 at 3:12 AM, Jeffrey A. > Williams <jwkckid1(a)ix.netcom.com> wrote: > > > Dr. Joe and all, > > Thanks for also saving/archiving the original story. > History if > saved in this manner can never be truthfully revised. BTW, > I > and 200 odd other or our members also archived this story > including all metadata for forensics purposes as well if > needed > in the future for legal purposes. I hope SANS will also be > covering it as well as did NetworkWorld. > > > Your a gem Jeff, if not a joy to add flavour to our gatherings. > > cheers > joe baptista > > > > > FWIW, it may be time to keep a closer watch on Circleid, > which I have also written for on occasion. Yellow > journalism > is not a good thing... > > Joe Baptista wrote: > > > > > The news story below was first published on CircleID. It > has since > > been yanked and is no where to be found on CircleID. > Maybe we are > > witnessing a bit of history revision. This makes me sad > because > > CircleID was a publication I once wrote for. In fact I > was one of the > > first paid writer for the organization. Probably the only > one at the > > time. And it is sad to see revision at an organization I > was once > > associated with. > > > > However it is understandable considering Vixie, the sacred > cow of DNS, > > made such a stupid and silly statement in the article. > > > > Basically an internet researcher in Russia was able to > break the Vixie > > patch and poison a servers cache after some 10 hours, > billions of > > connections over a gigabit connection. Vixies response > was "before > > somebody gets all excited about it let's be clear that it > takes two > > billion packets on average to defeat UDP port > randomization, which in > > this case was a fully utilized gigabit Internet connection > for a > > period of ten hours." and proceeded to draw parallels > that the level > > of risk was reasonably low because of this > rationalization. > > > > I think sometime Vixie lives in the dark ages of the net, > when > > everything was low bandwidth and script kiddies were a > novelty. > > Indeed Polyakov, the Russian researcher, should be > congratulated for > > his success in this attack considering the poor russian > was using such > > limited resources. > > > > Unlike script kiddies or real internet criminals Polyakov > did not have > > the resources required, being hundreds of thousands of > computers > > connected through a maze of IRC botnets on hundreds of > thousands of > > both DSL and gigabit connections to conduct a proper > attack. Poor man > > had to do it with one computer and one high speed internet > link. If > > he had better resources - like the kiddies - he could > probably do it > > in much less time - 10 - 20 minutes? > > > > Under these circumstances I'm not surprised the story was > yanked. The > > quote makes Vixie look like an idiot. > > > > In any case - here is the original story no longer > published at > > CircleID. > > > > > > Latest news postings on CircleID > > URL: http://www.circleid.com/news/ > > Updated: 10 hours 46 min ago > > > > Emergency DNS Patch Still Vulnerable, Proves Russian > Physicist > > > > 10 hours 19 min ago > > A Russian physicist has been able to successfully poison > the latest > > BIND patch with fully randomized ports. In other words, > the emergency > > fix put in place to patch the Domain Name System (DNS) > vulnerability > > for BIND, Internet's most popular DNS software, has been > demonstrated > > to be vulnerableand still exploitable by criminals. > > > > Evgeniy Polyakov from Moscow, Russia in a blog post today, > has shown > > how using two fairly powerful computers and a fast > broadband > > connection, one could successfully attack the patched DNS > server in > > less than 10 hours. With a fast connection, "any trojaned > machine can > > poison your DNS during one night" says Polyakov in his > blog post. > > > > As demonstrated by security expert, Dan Kaminsky on > Wednesday at the > > Black Hat security conference, the vulnerability, if > exploited by > > criminal, could be detrimental to the Web as well as > services such as > > email. > > > > Paul Vixie, president of the Internet Systems Consortium > (ISC), the > > organization in charge of maintaining the BIND software > has verified > > that Polyakov's exploit looks real. However "before > somebody gets all > > excited about it," Vixie says, "let's be clear that it > takes two > > billion packets on average to defeat UDP port > randomization, which in > > this case was a fully utilized gigabit Internet connection > for a > > period of ten hours." In other words, the probability of a > successful > > attack is fairly minimal. On the other hand, in the case > of an > > unpatched server, an attack was "narrowed down to six > seconds," Vixie > > noted. > > > > In the long term, Vixie says "we'll go on improving our > forgery > > resilience, as will every recursive DNS implementor, while > we continue > > pushing DNSSEC as the ultimate long term solution to the > entire > > forgery problem including this off-path-attacker problem." > > > > > More under: DNS, DNSSEC, Security > > Categories: Net coverage > > > > -- > > Joe Baptista > > www.publicroot.org > > PublicRoot Consortium > > > ---------------------------------------------------------------- > > > The future of the Internet is Open, Transparent, > Inclusive, > > Representative & Accountable to the Internet community > @large. > > > ---------------------------------------------------------------- > > > Office: +1 (360) 526-6077 (extension 052) > > Fax: +1 (509) 479-0084 > > > > > Regards, > > Spokesman for INEGroup LLA. - (Over 281k > members/stakeholders strong!) > "Obedience of the law is the greatest freedom" - > Abraham Lincoln > > "Credit should go with the performance of duty and not with > what is > very often the accident of glory" - Theodore Roosevelt > > "If the probability be called P; the injury, L; and the > burden, B; > liability depends upon whether B is less than L multiplied > by > P: i.e., whether B is less than PL." > United States v. Carroll Towing (159 F.2d 169 [2d Cir. > 1947] > ===== > ========================================================= > Updated 1/26/04 > CSO/DIR. Internet Network Eng. SR. Eng. Network data > security IDNS. > div. of Information Network Eng. INEG. INC. > ABA member in good standing member ID 01257402 E-Mail > jwkckid1(a)ix.netcom.com > My Phone: 214-244-4827 > > > > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, > > Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) > > "Obedience of the law is the greatest freedom" - > Abraham Lincoln > > "Credit should go with the performance of duty and not with what is > very often the accident of glory" - Theodore Roosevelt > > "If the probability be called P; the injury, L; and the burden, B; > liability depends upon whether B is less than L multiplied by > P: i.e., whether B is less than PL." > United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] > =============================================================== > Updated 1/26/04 > CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. > div. of Information Network Eng. INEG. INC. > ABA member in good standing member ID 01257402 E-Mail > jwkckid1(a)ix.netcom.com > My Phone: 214-244-4827 >

1 0

Re: [NA-Discuss] [At-Large] I do not own it, it belongs to everyone, so let me make money selling it!
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

JFC and all, JFC, surely as a Frenchman you recognize that age old lady of the evening creed: "No money no honey, come back pay day"? Such is and as you should have known long ago, is the unspoken and unwritten creed of ICANN. All to sad, yes, but all too true. JFC Morfin wrote: > How nice this "Internet for the Rich". I love the Anglo-Saxon > practical money inductive reasoning ... There are definitly different > cultures on this list : "I sell", "I do", "I follow", "we wait for > the best opportunity for us", "may be, we could share". > We will see who is the winner. > jfc > > At 23:20 10/08/2008, Alan Greenberg wrote: > >Patrick and Hong, I find your comments a strong over-reaction. > > > >The issue that is being discussed is how to handle the situation of > >multiple people applying for the same TLD, and they cannot come to an > >agreement amongst themselves. Classic examples are ".web" and ".mail" > >but there are plenty of other examples. > > > >The paper discusses the various ways of addressing such conflicts, > >and comes to the conclusion that auctions are probably the preferable > >path. If you disagree with this, that is fine. The only seeming > >practical alternative is a subjective analysis of which is the best > >for the overall good of the Internet or the communities or whatever > >(the so-called beauty contest). I find that alternative far too > >fraught with potential problems, but if that is what you favour, it > >would be interesting to hear how you think it can be done properly. > > > >Using an auction to resolve the conflict does indeed mean that .web > >will not likely go to a small not-for-profit organization. If that is > >your concern, then in my mind, you are being somewhat unrealistic. > > > >On the positive side, the possible auctions of these relatively few > >high-profile TLDs will likely bring in a LOT of money. It has > >repeatedly been suggested that this wind-fall profit not be simply > >wrapped into ICANN general funds, or even used to offset the costs of > >offering new gTLDs. But rather it be used to (with appropriate > >caution) make it less expensive and less onerous for not-for-profits, > >cultural communities and developing countries folks to acquire new gTLDs. > > > >Now THAT is something that I think At-Large should make a strong > >statement about. > > > >Alan > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

The Pirate Bay blocked in Italy
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

All, The Pirate Bay, a BitTorrent site, has been blocked by (some/most ?) Italian ISPs. It seems it was an IP-based block. Thus, it can be circumvented quite easily. I wonder where the NA'S or the ALAC is on this one? Hiding perhaps? Or just disinterested? Under/non-funded to oppose effectively? Score: ALAC and Naralo's 0 IPC and the IP ACTA folks 1 What normally happens is: 1. Comp requests http://thepiratebay.org 2. ISP's DNS server looks up the IP address for http://thepiratebay.org to answer query 3. ISP's DNS server resolves http://thepiratebay.org to be http://83.140.176.200 4. ISP serves http://83.140.176.200 Italian ISPs stepped in at stage 3, and blocked that IP address from being served. Thus, the way to resolve this would be to use some other DNS resolution server (instead of theISP's). OpenDNS <www.opendns.com> provides such a service, with DNS servers 208.67.222.222 and 208.67.220.220 Italians can also continue to access TPB by using http://labaia.org/ ("La Baia" being "The Bay" in Italian.) Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Reminder] At-Large NARALO Conference Call @ Mon 11 Aug 21:00 – 22:00 ()
by Google Calendar Aug. 10, 2008

Aug. 10, 2008

na-discuss(a)atlarge-lists.icann.org, this is a reminder for Title: At-Large NARALO Conference Call Time: Mon 11 Aug 21:00 – 22:00 (Time zone: Zurich) Where: Teleconference - Adigo Calendar: Description: 1900 UTC Start. Please find the details and participation instructions for this meeting on our meeting page: https://st.icann.org/naralo/index.cgi?meetings_and_events You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=OWdwZjJ1OWh1MG82dG10Mj… You are receiving this courtesy email at the account na-discuss(a)atlarge-lists.icann.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively, you can sign up for a Google account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

Re: [NA-Discuss] [At-Large] Updates to New gTLD Program Implementationand auctioning model.
by Jeffrey A. Williams Aug. 10, 2008

Aug. 10, 2008

Vittorio and all, Your essentially correct, Vittorio IMO. The real problem is in your example of .CAT, that it is already in use. So, first use in commerce would apply under the law. As for .XXX, or for that matter any other "String" as a gTLD, or even a IDN gTLD is that national laws as to use would likely apply. If for instance, .XXX's specifically forbid sexual related registrations of DN's in that name space, I can't see how it would than be a problem per se. However as ICANN's oversight has been poor of it's Registries and Registrars, the problems of accountability and legal liability become the issue. Yet I don't see how any of this has much to do with whether or not auctioning gTLD's is a good implementation method or not. But still all of this still points back to the beginning. Self regulation simply doesn't work. Oversight is necessary. The more the better, and the better that oversight is, the better the "Greater Good" can and will be served. Vittorio Bertola wrote: > Bret Fausett ha scritto: > > On Aug 10, 2008, at 2:20 PM, Alan Greenberg wrote: > >> Using an auction to resolve the conflict does indeed mean that .web > >> will not likely go to a small not-for-profit organization. If that is > >> your concern, then in my mind, you are being somewhat unrealistic. > > > > I was on the Council when this first came up, and the concern I heard > > from the ALAC then was about regionalism, rather than "non-profits" v. > > "for profits." I don't know that we care which among many U.S. > > corporate entities wins the battle for the next big ASCII TLD gold mine. > > > > The ALAC concern, as I understood it, was about whether a foreign > > registry services provider ought to win the bid for the IDN versions > > of COM/NET/ORG over a competitor in the region in which the language > > is spoken. At bottom, it's a debate about free trade v. regional > > protectionism, a subject on which the nations of the world have > > significantly different positions. > > Another case is when the two competing bids have completely different > purposes and "social value". I.e. what happens if Catalonia applies for > .cat to serve its 7-million Catalan speakers, but at the same time > Caterpillar does the same and puts more money on the table, only to use > the TLD for a nicer URL for their one corporate website? > > If I remember well, the last versions of the process presented in Paris > said that auctions would only be used if all applicants were > "non-community", ie generic, while if at least one was a community > applicant then they would have used a beauty contest. But I'm not sure > whether this is still the intention. > > I already said when .xxx was on the table that IMHO there is no way that > you can get out of this mess without making subjective political > judgements on who "deserves better", or whether a string is "against > public policy", etc. In the end, I just hope that these decisions will > be taken by an accountable political entity (e.g. the Board) rather than > by an unaccountable "expert panel", disguised as if they could be objective. > -- > vb. Vittorio Bertola - vb [a] bertola.eu <-------- > --------> finally with a new website at http://bertola.eu/ <-------- > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: [ga] Updates to New gTLD Program Implementation]
by Jeffrey A. Williams Aug. 10, 2008

Aug. 10, 2008

All, As an FYI -------- Original Message -------- Subject: [ga] Updates to New gTLD Program Implementation Date: Sun, 10 Aug 2008 07:32:44 -0700 From: Glen de Saint Géry <Glen(a)icann.org> To: "mail=ga(a)gnso.icann.org" <ga(a)gnso.icann.org> [To: council[at]gnso.icann.org; liaison6c[at]gnso.icann.org] [To: ga[at]gnso.icann.org; announce[at]gnso.icann.org] [To: regional-liaisons[at]icann.org] http://www.icann.org/en/announcements/announcement-08aug08-en.htm Updates to New gTLD Program Implementation 8 August 2008 Economic Case for Auctions in New gTLDs Paper Released -- During the ICANN meeting in Paris, France, ICANN staff made a commitment to release a paper describing the economic case for auctions as a tiebreaking mechanism for resolving contention among identical or confusingly similar applications for new gTLDs. ICANN is today making the Economic Case for Auctions in New gTLDs paper available so that the community can provide feedback on this element of the forthcoming implementation plan. The paper [PDF, 52K] was prepared by ICANN's auction design consultant PowerAuctions LLC with support from ICANN staff. The paper notes that auctions as a tiebreaking mechanism accomplish a goal of allocative efficiency through a transparent, objective and scalable process for the resolution of gTLD applications. This paper does not address specific details on how an auction process to resolve string contention may be conducted. These details will be provided as part of the larger information on new gTLD implementation to be presented to the community in the near future. A public forum has been established at at http://forum.icann.org/lists/auction-consultation/. Comments submitted to auction-consultation(a)icann.org will be considered until 7 September 2008 23:59 UTC (8 Aug 2008). -------------------------------------------------------------------------------- String Similarity Algorithm Update -- ICANN staff recently completed a workshop with SWORD, the partner who is assisting ICANN with the creation of an algorithm that will help automate the process for assessing similarity among proposed and existing TLD strings. SWORD's verbal search algorithms are used by various patent and trademark offices throughout the world. SWORD has completed a beta algorithm and reviewed several test cases with ICANN staff. This is being done in order to refine the parameters and discuss how the algorithm could be successfully integrated as a tool to help implement the GNSO's recommendation that new gTLD strings should not result in user confusion with existing TLDs. -------------------------------------------------------------------------------- Backend Registry Certification Not Available in First Round -- On 31 January 2008, ICANN posted an announcement (http://www.icann.org/en/announcements/announcement-2-31jan08.htm) to inform the community that it was exploring a potential initiative for the certification of backend registry operators for new gTLDs. ICANN staff has determined not to proceed with this initiative in the first round of the new gTLD process. The initiative was suggested as a possible means to streamline the application process for new gTLDs and to create a pool of pre-qualified registry operators who could provide assistance in the event of a registry failure. Exploration of the initiative was also prompted by inquiries from community members who expressed the potential positive aspects that creation of the certification might promote. During the exploration of the initiative, ICANN consulted with the community including technical experts and gTLD and ccTLD registries and registry service providers. Potential operational benefits and risks of implementing the initiative were assessed. Ultimately, a decision was made to not proceed with certification as part of the initial new gTLD application round based upon a number of factors. Some of these are: additional assessment as to effects certification might have on the marketplace, e.g., whether the implementation might cause expansion or contraction; additional collaboration with the community as to the terms of such a certification; and weighing the potential post-certification activities including ongoing testing, re-certification and the introduction of new compliance activities. It was also deemed important to be able to assess the positive and negative aspects of the new gTLD implementation without possible crossover effects of this additional certificat! ion. This independence of interactions can be better assured by introducing the certification (if it is deemed appropriate after additional analysis) at a later date. Both ccTLD and gTLD backend registry operators can still offer to provide registry services to new gTLDs. The Request for Proposals for new gTLDs, when published, will detail the minimum technical criteria and pre-delegation check requirements that must be met by every applicant prior to the approval of their TLD for insertion into the root. New gTLD applicants might choose to build their own registry infrastructure and systems, retain the services of an existing gTLD or ccTLD registry services provider, or contract with another technical services provider. Glen de Saint Géry GNSO Secretariat gnso.secretariat(a)gnso.icann.org http://gnso.icann.org

1 0

Re: [NA-Discuss] [ga] Vixies vixens make big boo boo on successful Russian DNS hack
by Jeffrey A. Williams Aug. 10, 2008

Aug. 10, 2008

Dr. Joe and all, Thanks for also saving/archiving the original story. History if saved in this manner can never be truthfully revised. BTW, I and 200 odd other or our members also archived this story including all metadata for forensics purposes as well if needed in the future for legal purposes. I hope SANS will also be covering it as well as did NetworkWorld. FWIW, it may be time to keep a closer watch on Circleid, which I have also written for on occasion. Yellow journalism is not a good thing... Joe Baptista wrote: > > The news story below was first published on CircleID. It has since > been yanked and is no where to be found on CircleID. Maybe we are > witnessing a bit of history revision. This makes me sad because > CircleID was a publication I once wrote for. In fact I was one of the > first paid writer for the organization. Probably the only one at the > time. And it is sad to see revision at an organization I was once > associated with. > > However it is understandable considering Vixie, the sacred cow of DNS, > made such a stupid and silly statement in the article. > > Basically an internet researcher in Russia was able to break the Vixie > patch and poison a servers cache after some 10 hours, billions of > connections over a gigabit connection. Vixies response was "before > somebody gets all excited about it let's be clear that it takes two > billion packets on average to defeat UDP port randomization, which in > this case was a fully utilized gigabit Internet connection for a > period of ten hours." and proceeded to draw parallels that the level > of risk was reasonably low because of this rationalization. > > I think sometime Vixie lives in the dark ages of the net, when > everything was low bandwidth and script kiddies were a novelty. > Indeed Polyakov, the Russian researcher, should be congratulated for > his success in this attack considering the poor russian was using such > limited resources. > > Unlike script kiddies or real internet criminals Polyakov did not have > the resources required, being hundreds of thousands of computers > connected through a maze of IRC botnets on hundreds of thousands of > both DSL and gigabit connections to conduct a proper attack. Poor man > had to do it with one computer and one high speed internet link. If > he had better resources - like the kiddies - he could probably do it > in much less time - 10 - 20 minutes? > > Under these circumstances I'm not surprised the story was yanked. The > quote makes Vixie look like an idiot. > > In any case - here is the original story no longer published at > CircleID. > > > Latest news postings on CircleID > URL: http://www.circleid.com/news/ > Updated: 10 hours 46 min ago > > Emergency DNS Patch Still Vulnerable, Proves Russian Physicist > > 10 hours 19 min ago > A Russian physicist has been able to successfully poison the latest > BIND patch with fully randomized ports. In other words, the emergency > fix put in place to patch the Domain Name System (DNS) vulnerability > for BIND, Internet's most popular DNS software, has been demonstrated > to be vulnerableand still exploitable by criminals. > > Evgeniy Polyakov from Moscow, Russia in a blog post today, has shown > how using two fairly powerful computers and a fast broadband > connection, one could successfully attack the patched DNS server in > less than 10 hours. With a fast connection, "any trojaned machine can > poison your DNS during one night" says Polyakov in his blog post. > > As demonstrated by security expert, Dan Kaminsky on Wednesday at the > Black Hat security conference, the vulnerability, if exploited by > criminal, could be detrimental to the Web as well as services such as > email. > > Paul Vixie, president of the Internet Systems Consortium (ISC), the > organization in charge of maintaining the BIND software has verified > that Polyakov's exploit looks real. However "before somebody gets all > excited about it," Vixie says, "let's be clear that it takes two > billion packets on average to defeat UDP port randomization, which in > this case was a fully utilized gigabit Internet connection for a > period of ten hours." In other words, the probability of a successful > attack is fairly minimal. On the other hand, in the case of an > unpatched server, an attack was "narrowed down to six seconds," Vixie > noted. > > In the long term, Vixie says "we'll go on improving our forgery > resilience, as will every recursive DNS implementor, while we continue > pushing DNSSEC as the ultimate long term solution to the entire > forgery problem including this off-path-attacker problem." > > More under: DNS, DNSSEC, Security > Categories: Net coverage > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0