Post by: Diana on September 19, 2003, 03:01:33 PM
Since the beginning of this week, a serious issue has developed. It is rather technical, so to make it short, Verisign, the company that maintains the Root DNS servers for the whole internet, has created a "wildcard" entry that makes it seem that every possible domain actually exists. Domains that are not registered yet now resolve to a Verisign website. In essence, they have hijacked a large part Internet for their own purposes.
Previous to this action, mistyping a domain name or inadvertantly putting one in that doesn't exist used to return a proper error page...or at least one you had control over through your browser. This is no longer the case.
An even worse thing has happened on the insides of the Internet though, one that most people will be unaware of. By creating this wildcard, all DNS reverse lookups now find a "valid" domain. Many mail servers use this reverse lookup function to determine the validity of the e-mail. See, spammers often use non-existent domains in their e-mail headers to hide their origins. Now, when a reverse lookup is performed, the domain will resolve and the mail gets through the SPAM filters. Network admins and software writers are banding together to fight this at the software level, but more needs to be done.
The benefits to Verisign are HUGE. They will make money off of this "hijacking". They are supposed to be the overseers of the .com and .net domains and as such, they shouldn't mis-use their powers..but they have.
I'm asking all who care to take a moment and sign one or two petitions. Both are at petitionsonline.com but they were started by different people
First: This one here
and: The Second here
Here is a Discussion of the issues
or even more Here at Slashdot
I realize that online petitions probably don't do much if any good, but this is an important issue. I would also ask that anyone who has an 800 number to their ISP, call them and let them know that you are aware of the issues, even if you don't completely understand them. With a loud enough outcry, we may be able to get Verisign to back down. As a good news entry here, Verisign was sued in an Orlando, Florida this morning. I'm keeping my fingers crossed that the judge will see how important this is to the welfare of the Internet and its free nature.
Thanks for reading. (I really need a soapbox smiley...snuffysbluff...I need you..
)see ya,
edited to fix link to second petition. Seems that the second link is actually the most important petition since it's getting the most activity.
Post by: Bruce_F on September 19, 2003, 03:10:59 PM
(I hope signing both doesn't void them)
Post by: george on September 19, 2003, 03:17:54 PM
George
Post by: pendragon on September 19, 2003, 04:12:05 PM
And thanks for explaining the situation. I had read about it in the Washington Post, but did not fully comprehend what I was reading or the consequeces of the action. Folks may now think I know what I'm talking about. Please keep the secret.
Harv
Post by: Highmac on September 19, 2003, 05:03:14 PM
I've got the gist of what's going on, even if I don't fully understand it. However, if it is of concern to a TS member, I'm only too happy to back it up.
Post by: Bill on September 19, 2003, 06:00:07 PM
Post by: kps on September 19, 2003, 06:50:55 PM
My domain registration is due in February, I will not re-register with Verisign. That'll be my small way to make a statement.
[edit] still can't sign the second one. That's the one I really want to sign. VeriSign should lose their registrar status.
Post by: Peter on September 19, 2003, 07:22:52 PM
Post by: kps on September 19, 2003, 07:28:58 PM
HERE's an interesting little thread about how to block it.
I would think it should work just as well with your linux /etc/host file. Check the macwrite link in the second post for OS X instructions.
Post by: kimmer on September 19, 2003, 07:30:42 PM
kimmer
Post by: Bill on September 19, 2003, 07:33:30 PM
Thought it worked. After checking, it didn't.?.
Post by: Gary S on September 19, 2003, 07:53:53 PM
The second petition doesn't seem to want to take my signature. #179......?
Thanks for the heads up Diana.
Post by: Diana on September 19, 2003, 08:44:02 PM
I appreciate this so much..
kps, I hadn't thought of the /etc/hosts file on the server. Upon thinking about it, the server's /etc/host file wouldn't have any effect. I run BIND, but I have an option line that tells the server not to do reverse lookups for any domain it doesn't actually host. This is set in /etc/named.conf. It's a shame that the Internet framework has been abused to such an extent, because it now means I can't participate with my server to its fullest capabities. Just a few weeks ago I discovered that spammers were abusing my server resources by forcing it to do these reverse lookups for the spamming domains, in effect, hiding their ISP's DNS servers, adding another layer of cloaking to their identities/locations. The server is still denying these bogus requests multiple times an hour. At least that is easier on it than doing the lookups. mmmumbble-grumble...bums.
Each person who is connected to the internet is most probably using the DNS servers provided by their ISP. I personally use ns1.mindspring.com and ns2.mindspring.com. That is why it's important to contact and support your ISPs on this issue. If their customers are concerned, they may fight harder.
I had thought of the hosts file on my desktops/laptops, but I've resisted implementing it so far because I want to know if we're making progress towards resolution. I called Earthlink today and had a nice talk with a sympathetic network support guy who said he would definitely pass my concerns up the ladder. My logic for this call was that although I'm sure Earthlink doesn't need educating about this issue, I want them to know/think that the general public is aware and concerned. I figure their own system admins are hoppin' mad too, but if the general public starts an uproar, a resolution may come faster. I would highly recommend that everyone implement this host file option. Not going to the verisign page will keep a few pennies out of their pockets anyway. Oh, if you wanna chuckle, read their Terms of Service...the ones you've "agreed" to by landing on their page..the ones you can't avoid if you're prone to mis-spelling or just like to spend time guessing at domain names. PS...get there using this link: http://sitefinder.verisign.com/index.jsp
I send you through that link so that they don't load all the advertising that a "keyword" domain would load..
And I'm with kps on domain registrations. I quit Verisign over two years ago now because of their ethics. I also refuse to buy SSL certificates from them. I've never given any credence to Verisign's ability to "Verify" or be truthful about anything. I deal only with OpenSRS now and have been totally happy. kps, if you support OpenSRS, you're supporting a great Canadian company..
Again people, you've made my day. Thank you so much,
see ya,
Post by: jepinto on September 19, 2003, 08:44:31 PM
How dare they?
Post by: Mrious_be on September 20, 2003, 06:26:38 AM
Tried it a few times, no avail.
Post by: kelly on September 20, 2003, 08:56:30 AM
Verisign sued over Site Finder
http://maccentral.macworld.com/news/2003/0...t=1063985851000
Post by: kelly on September 21, 2003, 12:30:19 PM
Post by: beacher on September 21, 2003, 02:22:18 PM
Post by: themagpie on September 21, 2003, 02:40:11 PM
Margie
Post by: Highmac on September 21, 2003, 03:52:39 PM
. (GaryS.. .note mine is also No 179). Could something - or someone - be blocking it deliberately? Who do we alert to the problem?
Post by: kps on September 21, 2003, 04:17:44 PM
Say bye, bye... VS.
I hope the pressure exhorted with these actions will change their ways...but I doubt it. Maybe if everyone "speaks" with their dollars they'll see the light.
They were in trouble before for unscrupulous business tactics.
Post by: Diana on September 21, 2003, 05:35:18 PM
QUOTE
kps said: VeriSign no longer has my domain name...
Good for you kps..
I was about to write to you and suggest that you make this transition as soon as possible. One of the unscrupulous things that Verisign has been known to do is hold domains hostage as they near their expiration. In the beginning it was a week, then 3 weeks, then it became 60 days. I think they took a lot of heat for that one too, so lately I think they've relented just a little. But, one can never be too early ditching Verisign.. especially since registrars like GoDaddy will honor the time remaining.Thanks again to everyone who has taken an interest in this and signed the petitions. I'm sorry the one is giving people so much trouble, (I too was 179 now that I think about it) so don't waste any time attempting the second one more than once.
see ya,
Post by: Bernie on September 21, 2003, 05:58:15 PM
Your signature on the petition is already complete, and there is no need
to reply to this message.
Your signature number for this petition is 560.
At PetitionOnline.com, we host the petition you've signed, but we didn't
create it. If you would like to comment on the petition, you can contact
the author of the petition by email, at:
I tried but when trying the " second" I couldn't get in?
Post by: Paddy on September 21, 2003, 08:20:25 PM
Post by: Paddy on September 21, 2003, 09:01:32 PM
Hi,
We're not sure what happened -- could be we were Slashdotted?. But, we're
now back, at another server. Folks should now link only to:
http://www.whois.sc/verisign-dns/
Our press release is below, which we also sent to:
http://gnso.icann.org/mailing-lists/archiv...a/msg00399.html
and the letter to ICANN formally presenting the first 10,000 signatures
at:
http://gnso.icann.org/mailing-lists/archiv...a/msg00400.html
Sincerely,
George Kirikos
416-588-0269
www.kirikos.com
P.S. Feel free to forward the info to others seeking the petition.
FOR IMMEDIATE RELEASE
Due to the overwhelming public support for the "Stop Verisign DNS Abuse"
petition, it knocked the PetitionOnline.com system for a loop! Signatures
weren't being added for many hours today, and only the first 178 were visible.
However, due to our supporters, it's back online at mirrors around the world.
WHOIS.SC managed to import the first 10,000 signatures and duplicate the
PetitionOnline system on their own servers!
Go to: http://www.whois.sc/verisign-dns/
to add yourself online.
We also recommend:
1) Printing out the petition text and FAX it to ICANN, at: 1.310.823.8649
(some folks don't think our supporters are "real" -- send them a fax, to
let them know you are real).
2) E-mailing a copy of it to: icann@icann.org, twomey@icann.org and
halloran@icann.org.
3) Supporting the ICANN Accountability Act of 2003 by contacting your
government representatives using the links on that site. Visit:
http://www.stopwls.com/legislation.html
The mirrors can be found at the following sites: (site may load slowly, due
to huge support)
1. WHOIS.SC -- PRIMARY SYSTEM (can add your comments online!) --
http://www.whois.sc/verisign-dns/
2. LOFFS.com -- http://www.loffs.com/petition/ (will always have the latest
mirror list)
3. Outboxes.com -- http://www.outboxes.com/petition/
4. TheRock.net -- http://www.therock.net/petition/
5. MMcomputers.com -- http://www.mmcomputers.com/petition/
6. IdealHosting.com -- http://www.idealhosting.com/petition/
7. LewR.com -- http://www.lewr.com/petition/
Please email me at George (at) LOFFS.com to add yourself as a mirror.
We've also sent a HARD-COPY of the first 10,000 signatures (300 pages!) to
ICANN via FedEx, along with a cover letter (below). Watch its progress at:
http://www.fedex.com/cgi-bin/tracking?trac...h&cntry_code=ca
We've asked that ICANN post YOUR input to:
http://www.icann.org/correspondence/
along with their TIMELY response.
Sincerely,
George Kirikos
http://www.kirikos.com/
---- cover letter below ----
34 Burnfield Avenue
Toronto, Canada
M6G 1Y5
Tel: (416) 588-0269
email: George@Kirikos.com
web: http://www.Kirikos.com/
September 19, 2003
BY COURIER AND E-MAIL
Attention: Dr. Paul Twomey and Mr. Daniel E. Halloran
Internet Corporation for Assigned Names and Numbers (ICANN)
4676 Admiralty Way, Suite 330
Marina del Rey, CA 92092 USA
Tel: 310-823-9358
Dear Gentlemen,
On behalf of internet users affected by Verisign's sudden, unilateral and
non-consensus based introduction of its "Sitefinder" system, I would like
to formally submit the Stop Verisign DNS Abuse Petition which has appeared
at the 3rd-party and independently operated URL:
http://www.petitiononline.com/icanndns/
(now mirrored at: http://www.whois.sc/verisign-dns/ and
http://www.loffs.com/petition/)
since 4 pm Eastern time on September 16, 2003. It has already gathered more
than 10,000 signatures from a broad cross-section of internet users
world-wide, including large corporations, small business, hospitals,
individuals, registrars, and internet service providers.
It is well within ICANN's mandate to immediately stop this new detrimental
Sitefinder system, and ICANN should take all necessary measures, including
but not limited to using its emergency powers under its contracts, to force
Verisign to comply. The exact text of the petition follows, as do the
signatures of the first 10,500 individuals and groups that support it (by
the time you receive this, the number of signatures should be even higher).
Please have your Webmaster add this document to the "Correspondences"
section of the ICANN.org website, for public review, along with your timely
response.
Sincerely,
George Kirikos
Enclosures: Petition + First 10,500 Signatures
Stop Verisign DNS Abuse
To: ICANN
We internet users, who either own domain names or have an interest in the
domain name system, wish to object to the Verisign Sitefinder system. We
believe that the system:
1. breaks technical standards, by rewriting the expected error codes to
instead point to Verisign's pay-per-click web directory, and threatens the
security and stability of the Internet;
2. breaks technical standards affecting email services, and other internet
systems;
3. is anti-competitive, providing Verisign with 20 million eyeballs per day
for "free", while not paying for the domains they are resolving. All other
market participants pay at least $6 per domain per year (wholesale);
4. violates trademark rights of domain holders, by typosquatting on their
.com and .net domains; and
5. violates the authoritative nature of DNS, turning it instead into a
"best guess" system filled with uncertainty, thereby destroying the
coherence of the DNS for Verisign's own short-term profit.
We hereby demand that ICANN immediately:
a) insist that Verisign cease giving incorrect answers to any query in .com
and .net, and should instead follow the IETF standards;
B) if Verisign refuses, should redelegate the .com and .net zones to
registries that are more willing to follow the DNS standards;
c) for greater certainty for all gTLD registries, pass a resolution stating
that "gTLD Registry operators WILL return NXDOMAIN for ALL DNS queries for
which there is not a REGISTERED domain name"; and
d) that Verisign be reprimanded for their monopolistic abuse of the DNS
system, and return all audited gross revenues from their Sitefinder system
to stakeholders, via a payment to the Generic Names Supporting Organization
(GNSO) of ICANN in the name of the Non-Commercial constituency
[Supporting documentation can be found at the sites below]
http://www.merit.edu/mail.archives/nanog/
http://www.opensrs.org/archives/discuss-li.../0309/date.html
http://slashdot.org/article.pl?sid=03/09/16/0034210
http://gnso.icann.org/mailing-lists/archiv...ves/registrars/
http://gnso.icann.org/mailing-lists/archives/ga/
http://log.does-not-exist.org/
http://www.icann.org/correspondence/lynn-m...iab-06jan03.htm
http://www.icann.org/correspondence/iab-me...ynn-25jan03.htm
http://gnso.icann.org/mailing-lists/archiv...a/msg00336.html
Sincerely,
The Undersigned
Post by: Diana on September 21, 2003, 09:15:42 PM
I've signed the petition at the new link (#11661) and was amazed at the total response so far. I'll fix the link in my post so that new readers won't have to read the whole thread to find the fix to the old errors.
I also checked the first petition..the one that isn't quite so well signed..
and noticed TONS of TS users names. I love it. 
thanks so much to everyone for your efforts, and two thanks to Paddy for keeping this on track.
see ya,
Post by: Bill on September 21, 2003, 09:45:59 PM
Am now! <gr>
Post by: Dreambird on September 21, 2003, 09:55:52 PM
Post by: kps on September 22, 2003, 12:59:58 AM
Paddy, many thanks for your effort, I was now able to sign both.
Post by: dolphin on September 22, 2003, 12:20:36 PM
I signed both...603 on first and 12589 on second. Happy to help on anything like this that threatens our freedoms and our privacy.
Makes me angry too...
Post by: RobW on September 22, 2003, 12:24:28 PM
I signed both as well.-Rob
Post by: themagpie on September 22, 2003, 05:01:37 PM
Margie
Post by: kps on September 22, 2003, 10:43:53 PM
http://maccentral.macworld.com/news/2003/09/22/icann/
::
::
Post by: Paddy on September 23, 2003, 02:56:10 PM
Post by: Mayo on September 23, 2003, 04:13:18 PM
One suggestion to those who are now going to switch from Verisign because of its redirection scheme: how about sending an e-mail to Verisign letting them know why you are leaving the fold. It may not help, but it certainly can't hurt to ley them know that their recent actions are costing them customers.
Post by: kps on September 23, 2003, 06:40:34 PM
Mayo, I plan on doing just that, but reading about VeriSign's antics...such as, holding domain names hostage, I'll wait until GoDaddy is the registrar on record.
Post by: Mayo on September 23, 2003, 07:21:33 PM
Post by: Xairbusdriver on September 23, 2003, 09:22:44 PM
I've spent a lot of effort making navigation easy on the site I maintain but I still created (borrowing from a few that I liked) an error page. At least that page seems to still work, but it is a .org domain ( error page )
Heard something on NPR today, but was not listening close enough to understand what was said. But it may be that the message is getting to somebody with authority!
Jim C.
Post by: Diana on September 23, 2003, 10:05:19 PM
Yes, this thing Verisign has done only affects .com and .net. But, the organizations that control some of the newer TLDs such as .biz and .museum have been doing this for some time. There wasn't a big outcry because there truly aren't many names registered in that name space. I don't think it should be allowed there either though, so if Verisign has to back down, so should the others.
What you're concerned about though with your personal website is unrelated to what Verisign or anyone has done. The error page you created only kicks into gear if someone asks for a page at your domain that doesn't exist or was moved. Your domain _must_ resolve properly for your error page to work.
The bad thing that Verisign has done would hurt you in this way if you had a .com/.net:
Your domain = airbusdriver.com
Someone types it in by hand or someone somewhere creates a link to your domain, but they don't double check their typing and the surfer ends up at = airbusdrover.com.
Well, airbusdrover.com isn't a valid name so surfers end up at Verisign's page. Say you were an air taxi service and your competitor was airtaxi.com. airtaxi.com pays Verisign to display them prominantly on the sitefinder page. So someone thinking they're going to find your site actually end up at a direct competitor and in essence, a very close "near copy" of your name put them there. What if you had a name-based trademark that would be tainted by mis-spellings? What would Coca Cola think if someone typed in pepsi-vs-coke.com and the only advertising on the page at Verisigns was for Pepsi? Verisign never had to pay to register airbusdrover.com or any other non-existant domain, but they benefit because of a mistake. To prevent that mistake and protect your business, you would have to purchase every possible mis-spelling of your business' domain name, an expense that Verisign never incurs. Sure, you could purchase "keyword" advertising from Verisign, but wouldn't that be like paying protection money to the street bully so he won't take your lunch?
I could go on about the insecurities introduced regarding personal/business privacy because e-mail also relies on DNS to work properly, but my feet are tired of standing on this soapbox anymore tonight...*grin..and my brain hurts.
see ya,
Edit: I forgot to point out that if you were to actually register all the mis-spellings of your own domain name, Verisign benefits then too...to the tune of $6.00 for every domain you register. See, they win coming and going. We lose.
Post by: kimmer on September 24, 2003, 09:27:09 AM
Thank you for a very clear presentation on the why's and how's of this. I've been chatting with a webmaster at a site I visit and he couldn't see what was so wrong with all of this. With your permission, I'd like to share your explanation with him.
kimmer
Post by: Gary S on September 24, 2003, 04:08:19 PM
Post by: Diana on September 24, 2003, 07:10:32 PM
I'm glad I was able to make myself somewhat clear. *grin..I was tired last night when I wrote that so I wasn't sure it would make sense by morning.
Feel free to use whatever part you want. You might also refer him to any of the links in Paddy's post where she includes the message she received from the person who started the petition. The forums at those links are ongoing and very long, so if he isn't really interested or concerned, he may not take the time, but I would encourage him to do so. My explanation was not inclusive by any means, there is so much more to the whole thing that can be explained in one sitting. The main thing that gripes me is the cavalier attitude that Verisign has taken, the attitude that so clearly establishes once and for all that ethics mean very little to the top brass. It leaves one feeling helpless. No amount of reasoning, screaming or ranting will change the ways of unethical people. They just enjoy the disruption they cause.
What all this does do for me though is confirm the emerging importance of our personal responsibilities for security on the Internet. I don't think that the Internet is being "tamed". It's getting wilder and wilder by the day. As the technologies become more secure..(which I believe for the most part they do or I wouldn't do my banking online anymore)..but the human crooks and crazies are benefitting from the anonymity..(anonymity being something I also value). People who would restrain their baser actions in public will drop _all_ pretense of morality and restraint when using the Internet. In my view it seems that these criminally minded people are numbered in far greater numbers than one would imagine.
Hubby and I were talking about the difference between skepticism and cynicism today. I find I cross over to cynicism more and more myself so I will quit here for now..
I sure appreciate this forum. Again I thank each and every one of you for your interest and support.see ya,
Post by: pendragon on September 29, 2003, 08:51:41 AM
Today's Washington Post: http://www.washingtonpost.com/wp-dyn/artic...-2003Sep28.html
Harv
Post by: Diana on September 29, 2003, 10:32:24 AM
Now they have won a contract with a company called Accenture to secure Internet voting procedures as governed by the DoD.
SERVE project
I dispair, how can even thousands of people fight a multi-billion dollar company that collaborates with other multi-billion dollar companies and our own government?
I'm not giving up though. I'm now on crusade to let Internet shopping sites who use Verisign's SSL certificates know that I'm no longer shopping with them until they get certificates from some other CA...(knowing all the while that even those "other" CAs are ultimately beholden to Verisign since Verisign has bought out some of them). I've personally started with Amazon. They got a letter from me yesterday.
Post by: kelly on October 01, 2003, 10:56:48 AM
http://maccentral.macworld.com/news/2003/1...t=1064998392000
Know anyone who has one?
Post by: Diana on October 01, 2003, 11:40:42 AM
QUOTE(kelly @ Oct 1 2003, 11:56 AM)
Kelly asks
Know anyone who has one?
Know anyone who has one?
Am I tilting at windmills?
Probably..but I'm still mad
*grin..I sent my views to ICANN days ago. I'm still waiting to see my e-mail appear on the Comments Section of the ICANN site.
thanks for the continuing interest...*pulls down face shield and mounts her dancing charger*
Post by: Diana on October 04, 2003, 10:24:09 AM
Some good news on this front. ICANN finally threatened legal action against Verisign and Verisign is "temporarily" backing down.
News article
I'll leave it up to the people with interest to search out more, but I doubt the war is over. I do want to thank everyone here for the support. It seems that Verisign thinks the biggest complaints against them were from a small "close-knit group"..*grin. That tens of thousands can be considered small is just another example of their arrogance, but you can be proud to be part of that close-knit group.
see ya,
Post by: Mrious_be on October 04, 2003, 11:06:06 AM
Post by: jepinto on October 04, 2003, 11:45:10 AM
Thanks for having me. B)
Post by: kps on October 04, 2003, 11:58:10 AM
As I mentioned in previous posts, I transfered my domain from VeriSign to another registrar. Surprisingly, the full transfer took about 48hrs. After completion, I sent VeriSign an email as to why I no longer give them my business.
Here's the text I sent:
I want VeriSign to know that I object strongly to SiteFinder. That is the reason I no longer have my domain registered with your company. Your past business practices have come under much scrutiny before. Please refrain from such objectionable practices in the future, the internet community will not tolerate it. It's in your best interest.
Post by: RHPConsult on October 04, 2003, 11:06:05 PM
Here's the latest
Hot off the Press
Yers truly,
RHP
Post by: Bruce_F on October 04, 2003, 11:26:59 PM
Post by: kps on October 06, 2003, 12:13:46 AM
QUOTE
Dear Karl,
Thank you for contacting Network Solutions.
We apologize for the inconvenience you are experiencing.
Much to our regret, we may not be able to assist you with your concern, as what you are encountering is a system recently applied by the Global Registry.
Site Finder is a new service offered by the VeriSign Global Registry. For more information, please contact VeriSign at sitefinder@verisign-grs.com.
You may also go to the link below.
http://www.verisign.com/nds/naming/sitefinder/faq.html
Please let us know if we could be of further assistance.
Best regards,
Thank you for contacting Network Solutions.
We apologize for the inconvenience you are experiencing.
Much to our regret, we may not be able to assist you with your concern, as what you are encountering is a system recently applied by the Global Registry.
Site Finder is a new service offered by the VeriSign Global Registry. For more information, please contact VeriSign at sitefinder@verisign-grs.com.
You may also go to the link below.
http://www.verisign.com/nds/naming/sitefinder/faq.html
Please let us know if we could be of further assistance.
Best regards,
LOL! I'll skip the sender's name, etc. but atleast someone read my complaint. Since they'll be suspending the so called "service", I'll just hold off on sending another complaint to the other address.
Post by: bellbram on October 06, 2003, 06:41:29 AM
Post by: kelly on October 07, 2003, 09:33:38 AM
VeriSign defends Site Finder service
http://maccentral.macworld.com/news/2003/1...t=1065511869000
Post by: Gary S on October 07, 2003, 10:32:12 AM