Slashdot Mirror

Dear SuperDuG,

Agreed. We'll happily litigate you. Please post your contact information so that our lawyers may get in touch with you.

Sincerely,
The Recording Industry Association of America

http://www.opensrs.org/multilingual.shtml

adam

You may need some technical know-how to get their scripts installed and working to your satisfaction, but Tucows owned OpenSRS is awesome.

You purchase domain "credits" in bulk ($250 for 25 domain-year credits). It's mostly geared towards web hosting companies or developers who register domains for their clients. They are professional, have fast email response time, and cater to the tech-savvy.

They are at www.opensrs.org

I would like the plagurism of AlphaKinetic and Saalim Chowdhury exposed. My work, and the work of others, is the subject of a recent SlashDot article called "Electronic Pricetag Alteration", although we are not attributed. I published an article which was plagurized by Saalim Chowdhury and used as the subject of a press release. An article was subsequently published by TheTelegraph and mentioned by TheRegister. This article was cited by ZDNet, syndicated to Yahoo, then this article was cited by SlashDot.

I published an article called "Flaws In ECommerce Systems" in the Autumn issue of 2600 Magazine. This article is available at http://www.xirium.com/product/mtecs/doc/secure/ and http://www.basketlogic.com/doc/secure/ . This article:

• States how loosely integrated ECommerce sites do not check prices.
• Cites a wine merchant with such a vunerability.
• Cites a domain name re-seller with such a vunerability.
• Explains how to move decimal points to reduce prices and why this action should succeed, but has never been substantiated.

On 25 Jan 2001, TheRegister reported an article in TheTelegraph which:

• Cites an undisclosed "glitch" that allows prices to be modified.
• Cites a domain name re-seller with such a vunerability.
• Cites Saalim Chowdhury as the "chief executive of e-commerce software development company Alphakinetic which discovered the flaw".
• Omits all references to moving

AlphaKinetic press releases 4 and 5:

• State that AlphaKinetic "found this security hole whilst developing our own secure e-commerce system, and our forthcoming e-commerce solutions".
• Cites the purchase of wine by this method.
• AlphaKinetic does not specialise in security.
• "What astonished us was when we contacted our secure payment provider about this they stated that they had be aware about the possibility of this hole existing for the last 5 years".

All attempts to contact all parties have been ignored. This inaccuracy has now been extensively propagated during the last two days. The additional information that was unsubstantiated is now the subject of recent articles and the estimated proportion of vunerable sites has risen from 10%-20% to 40%.

There is circumstantial evidence that Saalim Chowdhury read my work in 2600 Magazine (the source of the information) and this can be verified by checking domain name registrations. 2600 has a pre-occupation with purchasing domains of the form *sucks.com then printing the "cease and desist" "nastygrams" from lawyers. AlphaKinetic (the source of the plagurism) is highly anomalous because they have registered alphakineticsucks.com themselves, although this problem only affects large companies.

Cinonic is the name of the company selling the devices.

psychosis.com is the email address domain of the submitter.

www.cinonic.com and www.psychosis.com have the same IP address.

Whois data for both domains shows the same individual involved with both.

cinonic and you'll have to type psychosis.com

Suspicious or coincidence?

In late August I became a Tucow OpenSRS Registration service provider and accordingly transfered my domains from Network Solutions to Tucows.

One domain transfer was specifically completed on 9/22/00. Part of the transfer process is that the new registrar contacts the old registrar to notify them of the request and asks for their approval. (Is the domain paid for and not caught up in a dispute?) Network Solutions ACKNOWLEDGED this transfer request, allowing it go thorugh.

Now, a full two and a half months later, I get a nasty "FINAL NOTICE" bill from Network Solutions for the same domain that they acknowledged the transfer of. The envelope even has big bold writing on the front "Urgent: Your domain name is vital. Don't lose it." I'm not that stupid, and am not about to give Netsol another dime for a domain they're not even the registrar of, but what about non-techs who don't know any better?

I think whomever's going after Netsol with a class action suit should go after them for this shady billing scheme. I'd be willing to bet that at least 30% of the folks who get one of Netsol's bogus 'FINAL NOTICE' invoices pays it even though they've transfered the domain to a different registrar.

If you're looking for more info on duped out of $35 yourself, a long discussion about Netsol's hoaky billing system has taken place on the OpenSRS mailing lists. See http://www.opensrs.org/archives/mailing.index.shtm l...

-Abe

F-cked Company managed to register a domain with that naughty word in it.

I understand that they registered it with Tucows/OpenSRS.

I know it's not the main focus of the article, but the second page of the article mentioned that the new domains (at least .info and .coop) will be managed by new registry providers (.info: Register.com, Tucows.com, and .coop: CORE). Even thought the new domains aren't nearly as desirable as the old standbys, at least Network Solutions doesn't have a strangle-hold on the registry market anymore.

I must be a moron. I can't get NetSol to change my contact information, delete a domain, or change the technical contact info on a domain.

I've had to do updates at "NetSOL" several times, and these people are scary. I swear they purposely make their site and procedures nearly impossible to decipher. For what it's worth, I stopped having excessive trouble with their automated email-verification scripts (this was a while ago) after realizing (after much hair-tearing) that it is extremely important to be sure that the lines are not wrapped by your email client, in the "template" forms that you email back to them. Also, there must be a space between the colon at the end of each record-descriptor, and the content following on that line (if any). Or, is it must not be a space? Geez, emulate whatever is on the other lines, you know?

It's been a while and this may be obsolete, or slightly mangled in exact detail. I've never had to resort to the infamous fax procedure, and can offer no useful advice on that except to keep on hand a bottle of Aleve, or "other" measures to relieve pain and suffering.

I've since snuck out the back way to a more friendly (OpenSRS reseller) registrar with password protection and decent security, not to mention immeasurably more useable automated scripts for Web-access account management.

I must be a moron. I can't get NetSol to change my contact information, delete a domain, or change the technical contact info on a domain.

I've had to do updates at "NetSOL" several times, and these people are scary. I swear they purposely make their site and procedures nearly impossible to decipher. For what it's worth, I stopped having excessive trouble with their automated email-verification scripts (this was a while ago) after realizing (after much hair-tearing) that it is extremely important to be sure that the lines are not wrapped by your email client, in the "template" forms that you email back to them. Also, there must be a space between the colon at the end of each record-descriptor, and the content following on that line (if any). Or, is it must not be a space? Geez, emulate whatever is on the other lines, you know?

It's been a while and this may be obsolete, or slightly mangled in exact detail. I've never had to resort to the infamous fax procedure, and can offer no useful advice on that except to keep on hand a bottle of Aleve, or "other" measures to relieve pain and suffering.

I've since snuck out the back way to a more friendly (OpenSRS reseller) registrar with password protection and decent security, not to mention immeasurably more useable automated scripts for Web-access account management.

Someone above asked for a List of OpenSRS affiliates (i.e. resellers). I have been trying to do the same, but never could get such a list, despite extensive searches.

Note that the Domain Name Buyers Guide does not cover any OpenSRS affiliate yet.

Last week, I decided to ask OpenSRS themselves, and opened a sales ticket and a support ticket. The support guy gave me the usual run around ("Our reseller list is confidential", "we cannot release such info", "try a web search").

The sales person was more helpful and gave me a list of five resellers:

• http://www.nal.qc.ca
• http://www.msnhosting.com
• http://internationalwebhostingservices.c om
• http://www.islelink.com
• http://www.msquaredweb.net

Independantly, I tried searching for such info myself. Here is what I found:

• JumpDomain 14.99$ a year.
• DiscountDomainRegistry 14.99$ a year.
• DomainMonger 17$ a year.
• Processing Innovations 15$ a year. I am not sure if they are OpenSRS or not. Some (see above) have objected to their agreement, since they can terminate the domain, ...etc.
• Domains JH Cloos
• . Again not sure if he is OpenSRS or not. He offers domains for 12.50$. You cannot pay by credit card and need
• e-gold.

In case you are wondering, if your reseller goes out of business (many of them are small operations or a one-man-shows), then OpenSRS will be the registrar. The sales person told me they would help me find another registrar should this happen.

I am willing to maintain a list of OpenSRS resllers that offer cheap (20$ or less per year) domain registrations. If you find more, please let me know. You can contact me via the web site above or via 2bits.com (fill a contact form) or you can e-mail me at khalidATbaheyeldinDOTcom.

As a related issue, I have been looking for a PHP port of the OpenSRS library (Yeah, I am a Perl-Hater!), so I can implement it myself, shell out the 250$ minimum needed for being an Open SRS reseller, then I can provide domain registry for friends, family and clients. However, there is no such port planned by OpenSRS.org, and one reseller (forget which one) has a library that is working in every aspect except the encryption stuff.

I transferred all of my domains from network solutions to opensrs. Every one of them went through, and it took about 10 days. Most of the people who have had problems waited until after their domain had expired before transferring it (or even never had paid for it). If you do it early enough, everything should go through just fine.

Are you joking? Do you really think their terms are better than NetSol? I'd re-read your Registration Agreement. If you would look at the OpenSRS agreement, you would see that it's pretty much exactly like the NetSol's Registration Agreement. From the OpenSRS Registration Agreement (in its Appendix A):

15. REVOCATION. You agree that we may delete your domain name or terminate your right to use other Services if the information that you provided to register or reserver your domain name or register for other Services, or subsequently to modifiy it, contains false or misleading information, or conceals or omits any information we would likely consider material to our decision to register or reserve your domain name. You agree that we may, in our sole discretion, delete or transfer your domain name at any time.

To add further insult, read Section 4:

4. MODIFICATIONS TO AGREEMENT. You agree, during the period of this Agreement,that we may: (1) revise the terms and conditions of this Agreement; and (2) change the services provided under this Agreement. Any such change or revision will be binding and effective immediately on posting of the revised Agremeent or change to the service(s) on our web site . . . . You agree to review our web site, including the Agreement, periodically to be aware of any such revisions.

This is enough to make me wretch. You still think OpenSRS is cool? I feel nothing but disgust.

Similarly, Secura GmBH, which is given a 5-star rating by the DomainNameBuyersGuide for its legal agreement, has the following provision in its Registration Agreement:

An SLD holder's willful provision of inaccurate or unreliable information, its willful failure promptly to update information provided to Registrar, or its failure to respond for over fifteen calendar days to inquiries by Registrar concerning the accuracy of contact details associated with the SLD holder's registration can constitute a material breach of the SLD holder-registrar contract and be a basis for cancellation of the SLD registration.

I have a US domain name. You know how much I paid to register it three years ago? $10. You know how much I've paid since then? Zilch. Nothing.

Not bad. I'm paying $10 a year for my nice TLD. OpenSRS rocks!

I think the only conclusion that can be made is that the whole naming system is totally screwed and there really isn't any way to fix it. Everyone wants IPv6 and that will take years (if not decades) to complete. Not everyone will want a new naming system (in fact quite a few people won't): you think that anyone will be able to fix it anytime this century?

Well there are quite a few people who were not happy with NetSol anyway, so I guess that it was a really good thing that the domain name registration system opened up recently.

For those who did not catch on yet, go to http://www.opensrs.org/ for the best alternative to Network Solution.

Now if anybody needed incentive to not use NetSol anymore, I guess there is no need to wait!

http://www.jumpdomain.com/ is only 15$ per year, they use OpenSRS.org (for 8$-12$ per year), so the administration is easy and nice. registration by credit card is immediate. very personal service answering fast.

i know several people that are waiting since weeks for totalnic to fix some domains that are in limbo there. ugly.

kind regards philippe, http://A-Z-Internet.com/dns/

umm, Beta tapes have (had, I dono if new advances in vhs tapes have happened or what) better quality, but the reason they lost out is that they are shorter. You usually had to rent 2 beta tapes for a 2 hour movie vs. one vhs. Consumers are normal people, and therefore, morons. However, standards groups are usually suits, and therefore also morons. Personally, I dont really give a shit who creates the standard, so long as its open. (chk out OpenSRS.org $10 domains, and you have direct access to your corenic account. )

First, a word about register.com. You may want to read through the DNSO archives, the IFWP list, and the DOMAIN-POLICY archives to see what register.com has been up to, particularly regarding the single-letter domains.

You may also want to have a look at their registration agreement, particularly the bit on information ownership. They own all your contact information, and can do whatever they want with it.

Note the section in 6d above where they explicitly say you give them the right to use your information for targeted marketing.

Others aren't any better. BulkRegister has been phone-spamming people with completely automated unsolicited phone calls, in violation of US State and Federal law.

Joker.com and the other current and past CORE registrars have had significant problems in the past, and CORE is losing registrars right and left.

Most of the registrars have had significant and in some cases highly-publicised problems interacting using the SRS -- the Shared Registry System, resulting in things like aol.com's ownership being transferred to an individual (and later changed back), and other domain names not owned by big companies not being so lucky in having their ownership info corrected.

There's a problem with CORE registrars as well...several years ago, when people were once again trying to get new Top-Level Domains (TLDs), CORE managed to have a set of 7 TLD agreed upon. CORE registrars were pre-selling registrations in these 7 TLDs last year. They've now stopped, but should those & go active, it's still unknown whether or not anyone will have a fair shot at registering within them due to these pre-sells.

I'd personally recommend becoming a member of the OpenSRS project, and being your own registrar.

If you can't or won't do that, then do the following: Find and take the time to READ each registrar's Domain Dispute Policy and Registration Agreement, and think of what it means to you if your domain name ownership is challenged. The challenges are mushrooming, and all signs point to corporations getting whatever they want. Go see the resolved UDRP cases to get a feeling for how the wind is currently blowing.

--

$1,000 US ICANN application fee

$5,000 US ICANN annual fee

$70,000 US in working capital

not to mention...

$10,000 US NSI registration fee

$100,000 US performance assurance bond

and even after all that trouble, NSI will take $9 US from every registration I were to put through! It's nice to have a say in who gets to go through, and to perhaps bring NSI back down to earth.

This has brought my conclusion to going through the Tucows OpenSRS system, which is a free registration and free perl based CGI's, through which I can register domains for a simple $10 US per year ($9 of which goes to NSI, $1 going to Tucows for providing us with this great service).

Some more links for those of you ready to become your own registrar:

http://www.iana.org/

http://www.icann.org/

http://www.ietf.org/

http://www.nsiregistry.com/

http://www.internic.net/

Good luck! I hope everyone helps contribute to the OpenSRS project, as it will certainly be the way of the future for small ISP's like myself who can't afford NSI's outrageous costs and bonds.

- EraseMe

• Apache Group
• FSF?
• Or perhaps this slightly appropriate OpenSRS? Coulda been a $15 check.