Why DNS is Broken, in Plain English

At ICANN's meeting in Egypt last week, I had the opportunity to try and explain to various non-technical audiences why the Domain Name System (DNS) is vulnerable to attack, and why that is important, without needing a computer science degree to understand it. Here is the summary. more»

The Harsh Reality of Spam and Online Security… Should I Stay or Should I Go?

Working in the anti-spam and online malware fight can be depressing or at best invoke multiple personality disorder. We all know things are bad on the net, but if you want a dose of stark reality, check out Brian Kreb's fantastic 'Security Fix' blog on the Washington Post site... Speaking to an old friend who asked me what I was doing these days, I recently likened the fight against this relentless onslaught to having one's pinky in a dyke, and there are days when I don't even think we have a dyke! more»

Proposal for Signing the DNSSEC Root

The U.S. National Telecommunications and Information Administration (NTIA) is soliciting comments on signing the DNSSEC root. Ignore the caption on the page: this is not about DNSSEC deployment, which is already happening just fine. It's about who gets to sign the root zone. more»

What's Going on at ICANN in Cairo

Following up on the big decision at the Paris ICANN meeting in June to make new Top-Level Domains available, there's lots of activity at the ICANN conference in Cairo, Egypt this week. A few of the hot topics of discussion that we are following are the applications process for new generic Top-Level Domains (gTLDs), Registry/Registrar Cross Ownership, and restructuring of the ICANN Board. more»

Russian Minister of Telecom and Mass Communications Talks About Cyrillic Domain Names

Igor Schegolev, the Russian Minister of Telecom and Mass Communications spoke at the opening of the InfoCom 2008 exhibition in Moscow. Among other things, which made news (for example, that the Russian government will be implementing a free and open source based operating system on all computers in the Russian schools), he also made the following remarks - translated by me in English. more»

Users Don't Like Forwarded Spam

A message on Dave Farber's Interesting People list complained that Comcast was blocking mail forwarded by DynDNS, a popular provider of DNS and related services for small-scale users... Actually, they're blocking it because a lot of it is spam. This is a problem that every mail forwarder and every mail system encounters; the only unusual thing here is that DynDNS is whining about it. It's yet another way that spammers have broken the mail for the rest of us. more»

Remembering Jon: Looking Beyond the Decade

A decade has passed since Jon Postel left our midst. It seems timely to look back beyond that decade and to look forward beyond a decade hence. It seems ironic that a man who took special joy in natural surroundings, who hiked the Muir Trail and spent precious time in the high Sierras was also deeply involved in that most artificial of enterprises, the Internet. more»

A Secure Recursive Caching DNS Server

Over the last couple of weeks I have spent some time working on a project to develop a DNS cache for Windows that is intended to be reasonably secure against spoof attacks, in particular in situations where NAT firewalls may prevent port randomization. The program is evolving, but currently uses a couple of ideas to attempt to defeat spoof attacks... The source code is intended to be entirely un-encumbered, that is free in all respects. I would welcome any suggestions or comments on the aims of the project, the source code, the functionality of the program or other ideas. more»

Can ICANN Manage the DNS Root Zone by Itself? "No!" Says US Department of Commerce

In a recent letter, the US Department of Commerce NTIA strongly denied being engaged in discussions about a "root zone transition" from VeriSign to ICANN. The community, ICANN President Strategic Committee (PSC), and perhaps ICANN and IANA staff are suddenly informed that no transition of root zone management is going to occur. What happened? With the touted ICANN transparency and accountability principles, why such a shift in (perceived) ICANN strategic directions coming from its overseeing government department? more»

Is This Only Sloppy Wording by ICANN?

So I wrote earlier that I though it was good stuff when ICANN released a paper on DNS Security. Yes, I think it was good this paper was released, and yes it points out correctly how important DNSSEC is. But, now when reading it in detail, I find two things that troubles me. And it has to do with management of .ARPA. A top level domain that is used for infrastructural purposes. Like IP-addresses and E.164 numbers... more»