Slashdot Mirror
ICANN Asks VeriSign To Stop DNS Wildcarding
MrClever writes "In this article over at the Sydney Morning Herald (AU), it looks as though ICANN may actually be doing something about the VeriSign changes to .com and .net TLD's. Apparently, while they have been noticably quiet, they have been reviewing community reaction and analysed data from a technical perspective. Here's hoping ICANN pull the plug on VeriSign's TLD administration rights!" And TALlama writes "RSS.com.com (dear $DIETY, will it ever stop?) is reporting that ICANN has asked VeriSign 'to voluntarily suspend the service' of wildcarding DNS, 'pending further study.' Calling it a 'service' is a little bit of a misnomer. If I punch people in the face, can I call that a service, too?"
Apparently Timothy is a Dork
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
"If I punch people in the face, can I call that a service, too?"
Yes, because so many people need what you are selling.
(ICANN) has asked VeriSign to voluntarily suspend changes it made to domain name service zones that have resulted in most mistyped .com and .net domain names being redirected to its own site.
I predict the most common misspelling of VeriSign.com will be VerySued.comICANN said it is investigating complaints over the wilcard service and asked VeriSign to pull it pending further study. The service effectively replaces the common "404 page not found error" that until now has been the default for absent Web addresses.
404? A HTTP response from a DNS request? Please get your facts straight com.com...
For starters, sitefinder doesn't find the slashdot site!
It isn't nearly as helpful or reliable as google (even if google is censored a bit).
It causes me to download more stuff than I would if they didn't have the diversion abusing my bandwith and data allowances that I have to pay for.
I can turn the msn search in IE off. I turned the sitefinder.verisign.com off by modifying my hosts file but that isn't easy for most of the customers I support.
-- it must be true, it's on the internet.
Wake me up when it escalates to wrist-slapping.
One line blog. I hear that they're called Twitters now.
Okay, in simple terms..
DNS is the method of resolving names to IP addresses, it's what turns 'www.slashdot.org' into 66.35.250.151, or 'www.google.com' into 216.239.59.99
Wildcarding DNS is when instead of saying 'www.slashdot.org is 66.35.250.151' you effectively say 'Everything is 66.35.250.151' and so any domain you're asked to resolve goes to Slashdot's IP address.
What VeriSign have done is to add a final rule to their list, saying 'Anything not in the above is 64.95.110.11' (Or whatever the IP is of their SiteFinder service). This has the result that any DNS request that formerly would have returned an 'Unable to resolve' message now thinks it's resolved correctly to the IP address.
The stink this is causing with spam mail is that a lot of anti-spam measures rely on being able to weed out mail from made up domains simply by checking if the domain resolves correctly.
DNS is actually a *lot* more complex than this, but I think that'll do to explain what's going on here.
404 Not Found: No such file or resource as '.sig'
The IAB has issued a set of guidelines for the us of DNS wildcards.
Essentially, they say it's a very bad idea, but you can do it with the informed consent of all delegates in your zone.
If we all add this command:
;p
iptables -I INPUT -j REJECT 69.94.0.0/15
maybe that will get Verisign's attention
Afterall theres nothing they can do about people blackholing them for a good long while until they say they are sorry. As a penalty they should lower the prices of their domain registration, to something competitive.
Unlike other TLDs, namely several country codes, .com and .net have a number of resellers.
.com and .net, they're unfairly leveraging their position to the exclusion of other registrars. They are in effect conveying the message that they run the web.
TLDs with a monopoly really can't be told what to do, because there's no one competing with them in the first place.
With VeriSign doing this on
The point of standards is that you can rely on them. The internet standards are decided on a lengthy consensus process, and at this point the basic protocols of the internet are only changed very slowly and for very good technical reasons. Thus, once you have implemented a service or component based on a standard protocol such as DNS, you can be happy and count on not needing to maintain the component any more. It would set a horrendous precedent if internet infrastructure could be changed at will for marketing reasons, with no repercussions. Suddenly *every* piece of software relying on internet would need a maintenance team ready to change them at a moment's notice. This costs a lot of money, especially for services that are ready, done and just work.