For that matter why don't they just name entire NANOG! I remember what a reaction there was on the list and 100% of those responding were purely negative of Verisign wildcards.

Hmm, I remember a whole lot of really irrational and really unhelpful replies. Granted, there were some well thought out replies sprinkled in there, but I dunno if I want to be grouped with all of the other posters. :-)

PV> Date: 18 Jun 2004 05:58:00 +0000 PV> From: Paul Vixie PV> Paul Vixie is an existing provider of competitive services for PV> registry operations, including providing TLD domain name hosting PV> services for ccTLDs and gTLDs, and a competitor of VeriSign for PV> new registry operations. [...] I'm missing something. By what stretch of whose imagination does root nameserver operations compete with a registrar? Eddy -- EverQuick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses: davidc@brics.com -*- jfconmaapaq@intc.net -*- sam@everquick.net Sending mail to spambait addresses is a great way to get blocked.

PV> Paul Vixie is an existing provider of competitive services for PV> registry operations, including providing TLD domain name hosting PV> services for ccTLDs and gTLDs, and a competitor of VeriSign for PV> new registry operations. [...]

I'm missing something. By what stretch of whose imagination does root nameserver operations compete with a registrar?

i think they mean ns-ext.isc.org (or its old name, ns-ext.vix.com), which offers "TLD hosting" without fee to about 60 domains: % awk '/^zone/ { print $2 }' slave_tld.zones | sed 's/"//g' | fmt ac ae ao bg br com.br ca cd cl cz cv gov.fj fr hn hr io il ac.il co.il gov.il k12.il muni.il net.il org.il in co.in ernet.in org.in ac.in res.in gov.in mil.in net.in firm.in gen.in ind.in is museum md na com.na nl np com.np edu.np org.np mil.np net.np gov.np nr biz.nr com.nr edu.nr gov.nr info.nr net.nr org.nr pt ro sh tm za si sk co.zw aq pn ug if it's not that, then perhaps they're just smoking crack. (note for TLD folks... we're trying to collect the whole set, we're missing the last 200 or so, give us a call, tsig preferred.) -- Paul Vixie

PV> if it's not that, then perhaps they're just smoking crack.

Still a bit of a stretch. They receive money for registered domains (and attempted to for unregistered domains) in the .COM and .NET namespaces.

my employer was a bidder for .ORG, and gives away EPP software ("ISC OpenReg"), so there's some overlap with the registry/registrar community that verisign might be thinking of. -- Paul Vixie

--On Friday, June 18, 2004 17:25 +0000 Paul Vixie <vixie@vix.com> wrote:

...

PV> if it's not that, then perhaps they're just smoking crack.

Still a bit of a stretch. They receive money for registered domains (and attempted to for unregistered domains) in the .COM and .NET namespaces.

my employer was a bidder for .ORG, and gives away EPP software ("ISC OpenReg"), so there's some overlap with the registry/registrar community that verisign might be thinking of.

Didn't Verisign sell off the Registrar stuff, thus making OpenReg not a competitor? Owen -- If this message was not signed with gpg key 0FE2AA3D, it's probably a forgery.

Hi Alexei, I do not believe there is any technical spec prohibiting this, in fact that DNS can use a wildcard at any level is what enables the facility. I think this is a non-technical argument.. altho it was demonstrated that owing to the age and status of the com/net zones a number of systems are now in operation which make assumptions about the response in the event of the domain not existing... Steve On Sat, 19 Jun 2004, Alexei Roudnev wrote:

(read it only today, so sorry if I repeat something).

The technical roots of the problem are: proposed services VIOLATES internet specification (which is 100% clean - if name do not exist, resolver must receive negative response). So, technically, there is not any ground for SiteFinder - vice versa, now you can add client-level search SiteFinder (MS did it, and it took LOONG to turn off their dumb 'search' redirect) so allowing competition between ISP, browsers and so on.

Anyway, please - those who knows history and can read this 'official' English (little bored) - I am sure, that we can find many inconsistencies in the filing; it may be reasonable to provide a set of independent _technical_ reviews, showing that ICANN plays a role of technical authority, just do not allowing to violate a protocols. For the second case (waiting lists), it is not technical issue, but it is anti-competitional attempt from Verisign as well. I can ask my Russian folks to review it as well (dr. Platonov, Dimitry Burkov) but I am not sure, if it is of any use... Anyway, good review, explaining history and revealing real ICANN role, should be done.

If VeriSign wish to deploy services - they must put thru new RFC first.

PS. I am excited - Vixie as a co-conspirator... Vixie, you can be proud -:).

Alexei Roudnev

...

PV> Date: 18 Jun 2004 05:58:00 +0000 PV> From: Paul Vixie

PV> Paul Vixie is an existing provider of competitive services for PV> registry operations, including providing TLD domain name

hosting

...

PV> services for ccTLDs and gTLDs, and a competitor of VeriSign for PV> new registry operations. [...]

I'm missing something. By what stretch of whose imagination does root nameserver operations compete with a registrar?

Eddy -- EverQuick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses: davidc@brics.com -*- jfconmaapaq@intc.net -*- sam@everquick.net Sending mail to spambait addresses is a great way to get blocked.

PS. I am excited - Vixie as a co-conspirator... Vixie, you can be proud -:).

i'm not, though. not proud, and not a co-conspirator. this whole thing makes me want to puke. the worst thing is, the people i know inside verisign seem to wish i wouldn't take it so personally. but if their stock options go up in value as a result of this lawsuit, then it's blood money, and it's on their hands. anyway, today i was given a courtesy copy of verisign's "final ssac response", which i've converted from pdf to a number of other more-greppable formats, and put online. url's are as follows: http://sa.vix.com/~vixie/sitefinder/Final SSAC Response.doc http://sa.vix.com/~vixie/sitefinder/Final SSAC Response.html http://sa.vix.com/~vixie/sitefinder/Final SSAC Response.pdf http://sa.vix.com/~vixie/sitefinder/Final SSAC Response.rtf http://sa.vix.com/~vixie/sitefinder/Final SSAC Response.sxw http://sa.vix.com/~vixie/sitefinder/Final SSAC Response.txt here are some tidbits: Moreover, the Report appears primarily to have been composed and/or contributed to by persons who are opponents of Site Finder and/or competitors of VeriSign, a fact the Report fails to acknowledge. For example, Paul Vixie, a member of the committee who is cited three times as evidentiary support for the Committee¡Çs conclusions, fails to disclose that he is the president of Internet Systems Corporation ("IS C"), which released the BIND software patch discussed in the Report as one of the technical responses to VeriSign¡Çs wildcard implementation, and competes with VeriSign in other relevant respects, including the provision of DNS services and as a potential TLD registry operator. The Report also fails to identify that Suzanne Woolf, an employee of ISC, K.C. Claffy, an associate of Paul Vixie, and Mike StJohns as members of the committee who were added to the committee by SSAC¡Çs committee chair, specifically for the purpose of rendering conclusions about Site Finder. Ms. Woolf an employee of ISC, K.C. Claffy, an associate of Paul Vixie, and Mike StJohns as members of the committee who were added to the committee by SSAC's committee chair, specifically for the purpose of rendering conclusions about Site Finder. Ms. Woolf and Ms. Claffy's association with Mr. Vixie suggests they were added for the purpose of packing the committee with Site Finder opponents. [...] ... For example, the Report relies heavily on the opinion of Paul Vixie, an outspoken critic and competitor of VeriSign, on the issue of Internet stability following the implementation of VeriSign's wildcard. Yet the Report fails to include a conflict of interest statement for Mr. Vixie, even though he is the president of ISC, which released the BIND software patch discussed in the Report as one of the technical responses to VeriSign's wildcard implementation. Ironically, Mr. Vixie's BIND patch was a primary source of the "incoherence" described in the Report. ... On May 19, 2003, Paul Vixie wrote: "speaking for dnssac, [I] don't think we have standing. [D]ns is a distributed, reliable, autonomous, hierarchical database system. The key word for this purpose is `autonomous'. Delegating something to somebody and then telling them what they can and cannot put into it is false (and I might add, offensively so.)" ... As stated above, SSAC was unable to fault Site Finder on security or stability grounds. Indeed, SSAC member Paul Vixie has expressly admitted as much. In response to an email stating that "I think recent events prove pretty well that VeriSign GRS no longer gives a crap about stability. Have we forgotten *.COM so quickly?," Mr. Vixie conceded: [I] was ... publicly critical of *.COM and *.NET, butthat¡Çs a policy problem, not an operational problem. [V]eriSign has a very good record for name server uptime both at the TLD and root level. [Email message posted by Paul Vixie to nanog@merit.edu dated June 17, 2004 (emphasis added). A copy of this email is attached as Exhibit H.] anyway, the whole thing is worth reading, and not just for history buffs. (and if the idea that kc or woolf could be depended upon to parrot somebody else's point of view caused you to laugh so hard you spewed coffee all over your keyboard while reading the above tidbits, then send the repair bill to verisign, not me. i'm just the messenger.)

I'm not a lawyer but I still think businesses have a valid lawsuit against Verisign for whatever the legal term is for using their copyrighted names and likenesses. With SiteFinder it guarantees Verisign 'owns' any domain a particular company may no have yet purchased until such time that they do. And until they do their property gets branded as if it were Verisign's. That's my chief complaint against Verisign. There is also the problem that no one can easily verify non-existence of ANY domain when the SiteFinder is deployed with the Wildcard A record, this is almost certainly detrimental. The BIND source was modified in response to CUSTOMERS REQUESTS. It seems as though Verisign intends to implement it's will by legal maneuvering. It's akin to Microsoft being told by say RedHat that they can't have multiple user logins because Linux does that. Or that Windows can't have a good, useful CLI subsystem even though customers are clamoring for it. I'm not certain what other legal beef Verisign may have with ICANN (and any of the others mentioned in their legal proceedings) but it's certainly not any conspiracy, an option was simply provided at the outcry by a large, well respected, technical community to a change in infrastructure we all rely on that caused problematic effects. It's very regrettable that Verisign's lawyers decided it was necessary to go about this. As part of a a disclaimer: Any various mentioned parties were used above in a purely hypothetical manner and do not represent any companies actual intentions. Any mentioned copyrighted names are the property of their respective copyright or other property holders.

It is not about statistics, it is about DNS system behavior - if domain do not exists, I wish (and I must) to know it. By this, SiteFinder violates all Internet addressing system.

On Tue, 10 Aug 2004, Paul Vixie wrote:

...

(and if the idea that kc or woolf could be depended upon to parrot somebody else's point of view caused you to laugh so hard you spewed coffee all over your keyboard while reading the above tidbits, then send the repair bill to verisign, not me. i'm just the messenger.)

Unfortunately, SiteFinder did not have such a destructive effect as we had all wanted it to have. Statistics in our network showed no significant increase in dns traffic. Especially if you compare it against things like SoBig:

http://www.xtdnet.nl/paul/spam/graphs/versign.png

So even though my own hunch was wrong, I feel I should still publish the data. If you only publish data when it serves your goal, you lose your objectivity and your opinions become worthless as well. So I won't be blaming kc of woolf for not confirming what isn't there but what we really wanted to see.

So while SideFinder was not as destructive as we might have thought or hoped, obviously it is still one of the most stupid ideas that the NetSol/Verisign monstrosity came up with. If they cannot seperate their Registrar from their Registry business, then ICANN should break their contract and find a proper party to host the Registry.

Ofcourse, in my dreams I have the money and all the girls too.......

Paul

On Fri, Jun 18, 2004 at 05:58:00AM +0000, Paul Vixie wrote:

...

...

... i'm not a defendant, just a named co-conspirator.

Hah? Are they also naming individually all the dns operators that installed bind patch and specifically enabled it so that wildcards would not work?

the lawsuit doesn't mention the bind patch. they seem to be upset about my work on the ICANN Security and Stability Advisory Committee. what their "First Amended Complaint" says about me is that:

Paul Vixie is a Site Finder co-conspirator [...].

Paul Vixie is an existing provider of competitive services for registry operations, including providing TLD domain name hosting services for ccTLDs and gTLDs, and a competitor of VeriSign for new registry operations. [...]

(y'know, i'd pay Real Money for Adobe Acrobat Professional for SuSE 9.1/amd64, by which i could scan-convert PDF files instead of typing in stuff by hand -- my win32 laptop has more than 70 days of downtime and i'm going for 3 digits.)

verisign's official position throughout the sitefinder launch was that "users are free to disable it if they want to." they did NOT want this characterized as them shoving their sitefinder service down anybody's unwilling throat. so i don't expect any action to occur against folks who installed a BIND patch.

Um, unless I really missed something during this whole episode, that was the only way TO disable it. --- Wayne Bouchard web@typo.org Network Dude http://www.typo.org/~web/

Patrick W Gilmore wrote:

On Jun 18, 2004, at 2:25 PM, Wayne E. Bouchard wrote: <SNIP>

...

Um, unless I really missed something during this whole episode, that was the only way TO disable it.

Have the roots recurse and put a wildcard in for anything that does not resolve.

Makes Paul a ... well, not a competitor, 'cause that would imply they were in competition. If the roots put in the wild card, the GTLDs cannot compete.

Geee, we block sitefinder's ip both inbound and outbound at our border router... I wonder what that makes us? A competitor? A conspirator? A saboteur? ??? Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.