No Such Weblog

Ross Rader on Jeff Neumann: On a day when half of the internet's smartest engineers are pointing out dozens of different applications and processes that have been broken by Verisign's actions, its hard to believe a lawyer that is arguing the opposite.

See also: Tim Ruiz' response.

Bruce Tonkin has posted notes from the WHOIS discussion that was held in Marina del Rey a week ago. The registrars' priorities according to these notes seem to be (in this order) restricting data mining, changing the amount of data that must be displayed to the general public, and further addressing accuracy issues raised by the IP and law enforcement communities.

BIND 9.2.2-p1 now supports tagging zones as "delegation-only". This can be used to filter out "wildcard" or "synthesized" data from NAT boxes or from authoritative name servers whose undelegated (in-zone) data is of no interest.

This effectively means that sitefinder-type records can now be blocked in ISPs' name servers.

ICANN has just announced that its new MoU with the US Department of Commerce will last until September 30, 2006.

Thinking about specific problems with sitefinder, here's a mail loss scenario: A site (a.net) is using a server in a different domain (b.net) as its backup MX. That server's domain expires and goes into the redemption grace period, or does not have any explicit name servers listed in the TLD zone for some other reason.

Image a.net's mail server is unreachable for a short period of time, because of maintenance. In the pre-Sitefinder world, e-mail for a.net would be queued up, since the backup MX can't be found. In the world according to Sitefinder, e-mail to a.net is directed to Verisign's "Snubby Mail Rejector Daemon", and (to the extent that Snubby works as intended) discarded.

Wietse Venema has just announced a new snapshot of his excellent Postfix mail transport agent. One of the two changes: Support to black-list domains by their mail servers or by their name servers. This can also be used to block mail from domains that resolve to Verisign's mail dump for non-existent domains.