CircleID

"what does it add, what does it break, and how can we fix anything it breaks?"

Those aren't really the key questions. They draw all attention to the "what"s that are already around. The key questions are

1. "Does it at least maintain and preferably advance sound architectural principles for the future of the Internet (which mostly consists of innovations that we haven't thought of yet)?"

2. "Does it allocate resources that belong to Verisign, or does it take over resources that belong to others?"

The fact that Site Finder was implemented with a wildcard is a red herring. Site Finder configures DNS, a fundamental address resolution service, in a way that serves only the HTTP protocol. Whether or not it breaks other current activities, it skews the simple specification of DNS function in a way that prejudices future development. So the redirection of nonexistent domains to Site Finder fails question 1.

Control of the resolution of domain names is a very valuable power. Verisign is custodian of the second-level domain names under .com and .net, but not the owner of those names. Verisign is allowed by its contract to profit from the assignment of these names under certain general conditions, but it does not have full rights to assign them to itself free of charge. The redirection of formerly nonexistent domain names to Site Finder constitutes a capture of property over which Verisign has no proper authority. So, the redirection is wrong under question 2.

Mike O'Donnell

I have a discussion with Keith on this between his blog and mine.

1. On DNS Innovtion...
2. Responses on SiteFinder
3.On DNS Innovation ... (continue) ...
4. Oh dear!
5. On DNS Innovation ... (again) ...
6. SiteFinder and ICANN

What Berisign did was exactly the opposite of innovation. They simply broke an existing protocol, for their own greedy and shortsighted goals.

While you could say in a narrow technical definition that they are obeying DNS protocol, in fact that is a specious argument. They may be sending well formatted packets but the contents of those packets are lies. They are lying when you ask if a domain exists, and they tell you it does. It is like if I went out into the middle of a busy freeway at night and placed a big "Road Closed, Detour" sign to get people to come to my shopping mall. I would technically be obeying the traffic sign protocol, but I am abusing it by lying about the content, for my own gain.

And by lying about the existence of a domain name, they actually prevent innovation by others; if someone wanted to make their browser give some kind of helpful response to a domain-does-not-exist error message, they cannot now, because Verisign has removed the information about whether a domain actually exists.

You say that this should be the starting point for new innovations; well up until SiteFinder each browser could in fact implement all these nice things, although Microsoft Internet Explorer chose to not bother, and that was the opening that Verisign needed to jump in and grab the family jewels.

So, in summary, I cannot understand your argument. SiteFinder restricts the ability of everyone else to innovate by breaking the protocol at the wrong level, and makes it impossible for anyone else to play. And that is not even touching the issue of all the non-HTTP protocols that are just fucked now. Try debugging your mailer or time server, when Verisign is spoofing any incorrectly configured hostname.  It's that simple.

This "feature" belongs in the browser. End of story.  How could you possibly think it is OK to do this? Do you have any actual experience implementing real network protocols? There is clearly no need for this "service", it was just Verisign's way of trying to grab a slice of the web advertising pie.