In June 2004, Yahoo! and a number of other companies got together to announce the Anti-Spam Technical Alliance or ASTA. While it appears to have been largely silent since then, ASTA did at least publish an initial set of best practices the widespread adoption of which could possibly have had some impact on spam... The majority of these are clearly aimed at ISPs and end users, but some are either generally or specifically relevant to email providers such as Yahoo!, Google or Microsoft... The problem: Since February this year, we have been receiving a significant quantity of spam emails from Yahoo!'s servers. In addition to their transport via the Yahoo! network, all originate from email addresses in yahoo.com, yahoo.co.uk and one or two other Yahoo! domains. Every such message bears a Yahoo! DomainKeys signature... more
Last week's tizzy about IDN (Internationalized Domain Name) spoofing was an interesting exercise in watching how people react to the unknown. The nearly-universal response to the problem that had been described in detail many years ago was "turn off IDNs" instead of "assume that the people who created IDNs knew about this, so let's do some research." The following is based on my thoughts this week. For those of you who are not familiar with my earlier work, I'm one of the authors of the IDN standards... more
During ISOI 4 (hosted by Yahoo! in Sunnyvale, California) whenever someone made mention of RBN (the notoriously malicious and illegal bulletproof hosting operation, the Russian Business Network) folks would immediately point out that an operation just as bad was just "next door" (40 miles down the road?), working undisturbed for years. They spoke of Atrivo (also known as Intercage). The American RBN, if you like... more
In 2008 KnujOn published a report indicating that 70 ICANN accredited Registrars had no publicly disclosed business location. The fundamental problem was one of community trust and consumer faith. Registrars extend their legitimacy to their domain customers who then transact and communicate with the public. more
It took three years for ICANN to issue a breach notice to BizCn over the invalid WHOIS record behind RAPETUBE[DOT]ORG. Throughout the history of this absurd case ICANN staff would repeatedly insist the record had been validated and the registrar was compliant, regardless of extensive evidence proving otherwise. Despite a letter sent to ICANN's CEO and an investigation by the Washington Post, the Rape Tube stayed online. more
The past year has brought a rise in so-called "open and chartered" top-level domains (TLDs). Like the traditional open TLDs of .COM, .NET, and .ORG, these namespaces encourage large-scale registrations, but they differ in that they limit who can legitimately register domains. So far, many thousands of their registrations seem to break the stated rules. It's therefore worth thinking through their respective enforcement efforts -- before the situation gets out of control. more
ICANN has released a "living" graphic aimed to provide a high-level view of how the internet is run attuned for those less familiar with the inner workings of the internet infrastructure ecosystem. more
Cyber attackers are very skilled at infiltration. They'd find ways into a house through cracks and holes that the homeowner doesn't know about. Analogically speaking, that's what the new cyber attack group dubbed "Hafnium" did when they identified several zero-day Microsoft Exchange vulnerabilities to get into target networks. With thousands of users for every Microsoft Exchange server, the attack has far-reaching implications. First, it establishes the presence of a new threat actor group in town. What else could they be up to? more
Consider this scenario: you need a domain name for your site so you go to your favorite domain registrar's website and upon a quick search find that your third choice is actually available! You quickly pull your credit card and register the name. Everything is good and you can't wait to have your new domain start pointing to your site and represent your official email address. But not so fast -- some of the recent events are revealing that, these days, when you are registering a domain name there is one more critical thing you need to do: check under the hood! more
The recent hearing conducted by the US Senate Committee on Commerce, Science & Transportation on 'Preserving the Multi-stakeholder Model of Internet Governance' again showed that the Republican-controlled US Congress needs to act decisively to protect the status quo. The Senator Thune-led Committee convened the hearing on 25th February to look into the 'IANA Transition' and assess the level of preparedness of the non-governmental agencies that are handling the Internet Technical Management functions... more
The Canadian Internet Registration Authority (CIRA) has announced its proposed policy to provide all dot-ca domain name holders with increased privacy safeguards, bringing it in line with recently-enacted Canadian privacy laws. more
If you're brave, today you can finally download the Internet Explorer 7 public beta. Why should you be interested? Not because the browser's wonderful. It isn't -- initial reports are that it's not ready for prime-time. But you might be interested to know that as of today, users of IE will be able to use internationalized domain names (IDNs). ...Many other browsers are already IDN-capable, including Firefox, but most people in the world use Explorer. Think China, Japan, India. Think most of the world's population... Think of millions of new Internet users working in their own language, customers for commercial goods and services. But think also about intellectual property nightmares, think about phishing, think about whether there's one interoperable Internet, or several Internets acting very weird. These issues and others will become big news when people start using IDNs massively -- and with support from Internet Explorer, that's about to happen. more
My weekly Law Bytes column (freely available hyperlinked version, Toronto Star version) focuses on the recent Canadian parliamentary discussion on domain name disputes. As discussed about ten days ago, the impetus for governmental interest in domain name disputes and Internet governance is the registration of several domain names bearing the names of sitting Members of Parliament by the Defend Marriage Coalition, an opponent of same-sex marriage legislation. The resulting websites, which include donboudria.ca and davidmcguinty.ca, include MP contact information, photos, and advocacy materials. more
The new MoU, called a Joint Project Agreement (JPA) is a cosmetic response to the comments received by NTIA during its Notice of Inquiry in July 2006. The object seems to be to strengthen the public's perception that ICANN is relatively independent. But the relationship between the USG and ICANN is fundamentally unchanged. In one important respect, the JPA has actually increased direct US intervention. more
The Gogonet Live conference in San Jose witnessed outstanding presentations by several federal administrations including Veteran Affairs, NASA and SPAWAR, sharing their experience and progress towards IPv6 adoption. Furthermore, the NIST compliance report leaves no agency any place to hide. The report card is there for everybody to see. In spite of regular jabs and criticisms, the US Federal Government has done a remarkable job. more
A World-Renowned Source for Internet Developments. Serving Since 2002.