Delivered-To: dfarber+@xxxxxxxxxxxxxxxxxx
Date: Wed, 17 Sep 2003 12:01:41 -0700 (PDT)
From: Carl Malamud <carl@xxxxxxxxx>
Subject: this is how badly broken SiteFinder is
To: dave@xxxxxxxxxx
I've heard some mumblings that VeriSign's hijack of .com and
.net is simply a business issue. Here's why it is so badly
broken:
bulk% dig a.net
; <<>> DiG 8.3 <<>> a.net
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13
;; QUERY SECTION:
;; a.net, type = A, class = IN
;; ANSWER SECTION:
a.net. 15M IN A 64.94.110.11
a.net is a reserved name. IANA, which administers the names
and protocol parameters that allow the Internet work,
set aside one-letter names and said "these shall not resolve."
The Internet is a cooperative system and it is based largely on
a pact that we shall observe protocools. VeriSign may be
a business, but in the case of the DNS it is a regulated public
utility, and as part of it's contract with ICANN it said it
would observe the IANA rules. ICANN (c|sh)ould scream contract
violation and [threaten to] find another concessionee.
Here's a second example. A colleague of mine sent mail to a
friend in Australia. There was a transient network error. His
mail went to VeriSign and bounced. What SHOULD have happened
was his mail transfer agent would have seen that no DNS answer
was received, and would have requeued the mail and tried again
in five minutes. Not only did the mail not get through to
the intended recipient, VeriSign got the mail. Now, I'm
assuming they didn't have time to read it, but why in
the world should they *ever* get those bits in the first place?
Email is an end-to-end service, not conference call with
VeriSign.
Regards,
Carl