A Missouri college's decision to sub-let space on its .edu domain is drawing fire:

an online college in Missouri has started renting out blog space on its .edu domain to just about anyone willing to pay $50 a month. And the practice has quickly raised objections from college officials worried that such rentals undermine the .edu designation.

The college, the Pickering Institute, calls its service the "first public EDU blog community," and it touts the marketing value of having an Internet address that appears to be part of a college. "Our blogs allow you to reach an education-minded audience that is difficult to reach with mass-market blogs such as Blogger or Blogspot," says an announcement on the institute's Web site. So far, the blogs with the new .edu addresses include such noneducational offerings as "Handbags in Our Life," "Jewelry in Our Life," and "Get the Scoop." The institute is working with an Internet company called LinkAdage to offer the service.

Educase, the folks who run the .edu domain, say that this doesn't actually violate any rules, but they clearly don't like it and say they are investigating after receiving a complaint.

( Read More... |    )

[S]tarting in August 2006, Earthlink instead intercepts that Non-Existent Domain (NXDOMAIN) response and sends the IP address of ad-partner Barefruit's server as the answer. When the browser visits that page, the user sees a list of suggestions for what site the user might have actually wanted, along with a search box and Yahoo ads. The rub comes when a user is asking for a nonexistent subdomain of a real website, such as http://webmale.google.com, where the subdomain webmale doesn't exist.... In this case, the Earthlink/Barefruit ads appear in the browser....

[S]ubdomains are only as secure as Barefruit's servers, which turned out to be not very secure at all. Barefruit neglected basic web programming techniques, making its servers vulnerable to a malicious JavaScript attack. That meant hackers could have crafted special links to unused subdomains of legitimate websites that, when visited, would serve any content the attacker wanted. The hacker could, for example, send spam e-mails to Earthlink subscribers with a link to a webpage on money.paypal.com. Visiting that link would take the victim to the hacker's site, and it would look as though they were on a real PayPal page.

( Read More... | 4 comments |    )

When civilization takes a step backward, as it did last week, it usually means a period in which the people with the guns make the decisions. Anyone watching the American President on tv in recent days knows that's where we're at. It may be a while before the luxury of debating what constitutes consensus in a terrorist-less society returns.

( Read More... |    )

Sorry for the downtime. Our volunteer nameserver went down; we've switched to zoneedit.com for the time being at least.

Contrary to at least one suggestion emailed in, our down time had nothing whatsoever to do with the wikileaks affair!

Note that for future reference if ICANNWatch.org is not working, you may have luck with ICANNWatch.net. Or not, depending on the nature of the problem...

( Read More... | 1 comment |    )

I have also contacted the Internet Corporation for Assigned Names and Numbers (ICANN), a California non-profit which confers nominal "accreditation" of the NAF to conduct these types of internet dispute resolution services. ICANN has taken no action, as the responsible ICANN official is a former employee of the NAF in charge of the identical dispute resolution service advertised by the NAF.

( Read More... | 1 comment |    )

Domain tasting is tremendously unpopular in domain-name circles, and eliminating it seems uncontroversial. Someone new to this sandbox, though, someone who isn't used to ICANN and the current brand of domain-name politics, might have some questions to ask:

( Read More... | 2256 bytes more |    )

Numerous reports today (e.g. Slashdot, NSI Registers Every Domain Checked), that NSI is "frontrunning" -- registering domains (for the domain tasting period of five days) whenever a customer goes to its site to check on the name's availability but doesn't actually buy it.

One consequence is that the customer is locked in--no other registrar can get the name even though no one has actually taken it. Which seems anti-competitive.

On the GA list, Jonathon Nevett from NSI explains what they think they are doing as follows:

( Read More... | 1228 bytes more | 4 comments |    )

The "GNSO Initial Report on Domain Tasting" has been posted for comment [PDF, 293K].

The comment period will be from 8 January 2008 to 28 January 2008. Comments by email to domain-tasting-2008@icann.org and viewable at http://forum.icann.org/lists/domain-tasting-2008/.

( Read More... |    )

ICANN has published a notice of implementation of the revised ICANN Procedure for Handling WHOIS Conflicts with Privacy Law.

The procedure is due to be posted for 30 days, and implemented on 17 January 2008. The new draft reflects changes sought by the Governmental Advisory Committee (GAC).

Good news: after all these many years, ICANN is revising its registry/registrar contracts to reflect the fact that the default rule violates privacy law of countries that have decent privacy law.

Bad news: ICANN's default remains the same privacy-busting low it has always been. It is long past due to revise all the contracts to comply with best practices for privacy.

( Read More... |    )

The Internet Governance Project has unearthed a consultancy report to the U.S. Department of Homeland Security (DHS) that makes it clear that the issue of root signing and DNSSEC key management has been recognized as a political issue for long time. The report stated clearly that mistrust of the U.S. government's intentions and the problem of who would own the DNSSEC keys could be barriers to DNSSEC deployment. It also offers some interesting insights into how DHS has approached the politics of DNSSEC and Internet security in its interactions with the US Congress.

( Read More... | 1322 bytes more |    )

ICANNWatch was honored by the ABA Journal as one of the Top 100 top legal blogs.

Thank you!

( Read More... |    )

According to the Nominating Committee Call for Expressions of Interest in Assessment Team, this year's NomCom is planning to employ a search firm to help it find Board candidates.

Whether that's a good thing or a bad thing depends enormously on the implementation. Ominously, the terms of reference include this instruction,

# Provide to the Nom Com a short written qualitative assessment and conclusions formed from each candidate interview, together with a numeric rating of suitability for each position considered on a scale to be jointly agreed upon initially by the organization and the Nom Com.

Based on my two terms on the NomCom, I do think it's a fair criticism that the existing practices don't do as good a job as they should in finding a deep enough pool of highly qualified developing country and non-native-English-speaking candidates from outside Europe. A search firm whose mission was to add some richness to that pool might be a very good thing.

But there are two ways to use a search firm that I think would be very harmful. The first would be to give the search firm any input, even "just" evaluating, candidates who come to the nomcom via other channels. The second, almost as bad, would be to give the search firm anything but the most limited mandate to rate the candidates it finds. There is no question that any mechanistic process to try to score candidates will work to the disadvantage of the sort of untraditional candidates that ICANN needs to be more open to. (It will also tend to favor age -- more demonstrated accomplishment -- over youth, already a perennial problem.)

A critical part of what the nomcom does is slate-making: trying to find a balance of talents. It's not a mechanistic process, and trying to reduce it to scores on some too-rigid pre-determined set of criteria would harm the process. Yet, because of the tight time-limits on which the NomCom works, there's a real danger that candidates with low scores based on whatever system emerges won't get their due. The numbers of files involved has been large but in no way unmanageable in the past; the NomCom shouldn't allow anyone to do its screening for it.

( Read More... | 1 comment |    )

The headline on ICANN's press release says, ICANN and NRO Reach Agreement on Formalization of Relationships.

From that you would think we have a done deal. You would be right and you would be wrong.

First, let's consider the formalities. As the press release itself notes, there's supposed to be public comment before anything is final,

ICANN is opening a public comment period on the formalization of its relationship with the Number Resource Organisation (NRO) and the Regional Internet Registries (RIRs) through an exchange of letters. At the ICANN meeting in Los Angeles, the negotiating teams reached agreement on the documentation of their relations and commitments under the exchange of letters, and agreed to seek approval of the arrangement from their respective Boards in accordance with the approval process of each of the parties.

Comments on the proposed letters may be submitted to nro-letters@icann.org until 23.59 UTC on 7 December 2007, and may be viewed at http://forum.icann.org/lists/nro-letters/.

So, as a formal matter, it's just a tentative deal, although if this comment period runs true to form, there will not be many and they won't matter much.

More to the point is the glaring disjunction between the views expressed in the two letters touted as "Agreement on Formalization of Relationships": The RIRs basically say that they want everything to go on as it is. Their contributions are voluntary and ICANN acknowledges their authority and autonomy. ICANN's letter does that, but qualifies it with this key language:

We seek to further enhance our relationship for the mutual benefit of our organizations and respective communities. For that matter we wish and will seek to establish an appropriate legal arrangement within one (1) year from the date of this letter.

The RIRs are, however, much too smart to make legally binding commitments, either now or in the future. And it's hard to see what leverage ICANN has to make them.

( Read More... |    )