Showing posts with label DdoS. Show all posts
Showing posts with label DdoS. Show all posts

2016-12-11

News Review: ICANN's IANA Transition Costs Now Exceed $31 Million

News Review | ©2016 DomainMondo.com
Domain Mondo's weekly review of internet domain news:

 Feature •  ICANN has spent over $31 million in IANA transition costs from inception (July 2014) to October, 2016:


Included as "costs" are the IANA Stewardship Transition Coordination Group (ICG) work, the Cross Community Working Group on Naming Related Stewardship Functions (CWG-Stewardship), the Cross Community Working Group on Enhancing ICANN Accountability (CCWG-Accountability) Work Stream 1 (WS1) and Work Stream 2 (WS2) still underway, and related implementation work.

Cost categories include cost of staff support, travel and meetings costs, professional services (legal advice), and administrative costs. According to ICANN, costs disclosed are exclusively direct costs and do not include any overhead allocation.

IANA Transition Cost Summary Reports – Inception to October 16, 2016:
Legal Advice Costs below are also included in the Costs Summary above, but deal solely with the three legal firms employed: Jones Day; Sidley & Austin; Adler & Colvin. According to ICANN, when monthly invoices have not yet been received, estimates are requested from the legal firms. If no estimates are received from the legal firms, ICANN Finance produces an estimated monthly total cost, mainly based on historical trend.

Other Internet Domain News:

•  ICYMI: IGF 2016, Internet Governance Forum, concluded its meeting in Guadalajara, Mexico, this past week. For more: News Review: IGF 2016, Internet Governance Forum, Guadalajara, Dec. 5-9 and IGF 2016 Video: ICANN New gTLDs Program, Impact & Future Direction.

 •  GDD (ICANN Global Domains Division) Industry Summit Sponsorship Opportunities, Madrid, Spain, May 8-11, 2017 (ICANN.org pdf). Review GDD Industry Summit 2016 here.

•  New gTLDs .XYZ, .CLUB and .VIP have obtained official licenses from the Chinese government, joining legacy gTLDs .COM and .NET, in obtaining approval from the Ministry of Industry and Information Technology ("MIIT"), the domain name regulator in China. More at Overseas TLD Registries Licensed by Chinese Government | CircleID.com.

•  Wonder about that recent explosion in new gTLD .KIWI domain name registrations? Read Using digital fear to get more domain name registrations! | OnlineDomain.com and KIWI managing director Angus Richardson replies to fear tactics and inflated numbers accusations | OnlineDomain.com. One commenter wrote:
"After 2 years nobody wants them, provide them free, and hope for a renewal. The demand is not there, the domains are not needed."
•  So what's that domain name really worth? Investor portfolios of .COM domain names, sold in bulk wholesale? Maybe $500 per domain name, read: GoDaddy Likely Buys Traffic Names LTD Domain Portfolio | dotweekly.com.

•  Stock Ticker Symbols Matter: ‘When you pick out the name of your stock, you need to be really careful.’--Xuejing Xing, co-author of the study--"Stocks benefit from the “likability” and even the pronounceability of a ticker symbol ... A study published in the Journal of Financial Markets finds that the “likability” and even the pronounceability of a ticker symbol are positively related to a stock’s value. In other words, if your stock can’t have the symbol IBM or AAPL, at least pick a clever one ... the study says, is that a likable symbol is associated with greater liquidity, since investors also tend to trade stocks with more-likable symbols at a higher rate. Alternatively, the study suggests, a higher value could be the result of mispricing; investors might unconsciously assign a higher value to a symbol that is easier to pronounce .... Other studies have agreed that companies with easy-to-pronounce names have higher value and liquidity ... Mr. Xing says he is at work on a related paper looking at corporate names and their effect on profitability."--WSJ.com. See also Company Domain Names, IPOs, Simple Rules, Stupid Mistakes | DomainMondo.com (7 Oct 2014).

•   Language: China’s tyranny of characters | Economist.com: "... Like Latin, classical written Chinese was a dead language, spoken by no one. A century ago, when language reformers began to introduce a common nationwide spoken tongue of Mandarin, they also abandoned the classical written language and replaced it with one that mirrored the spoken form, thus trying to synchronise their speech and their script. Some revolutionaries, including Mao Zedong, initially wanted to scrap Chinese characters altogether and replace them with an alphabet. They settled instead for a simplification of the characters and a standardisation of how they are pronounced and written in Roman letters, known as pinyin. Yet despite major success in literacy programmes, there are still 400m people in China who do not speak Mandarin, and some 100m who the government says cannot read at all. The actual number is undoubtedly higher ..."

•  How to break the internet: "DNS servers are today’s biggest targets ... when the DNS server is unavailable nothing can work – without the DNS there is no connection, therefore no business – so hackers achieve their ultimate goal of causing downtime for a company.“--TechRadar.com

•  AWS Protection from DDoS attacks: Amazon Web Services (AWS) is trying to help protect its customers with a new service named Shield aimed at mitigating DDoS impacts, and the free entry-level tier is enabled by default for all web applications running on AWS--PCWorld.com.

•   How DNS Works In Six Steps | Verisign.com:
Labels: , , , , , , , , , , , , , , , , , , ,

2016-10-22

Did ICANN Just Break the Internet? No, But It Could Have, and May Yet

ICANN.org: "ICANN's mission is to help ensure a stable, secure and unified global Internet. To reach another person on the Internet, you have to type an address into your computer - a name or a number. That address has to be unique so computers know where to find each other. ICANN helps coordinate and support these unique identifiers across the world. ICANN was formed in 1998 as a not-for-profit public-benefit corporation and a community with participants from all over the world. ICANN and its community help keep the Internet secure, stable and interoperable. It also promotes competition and develops policy for the top-level of the Internet's naming system and facilitates the use of other unique Internet identifiers."
If you live in the U.S., you may have noticed or been affected by the internet outage on Friday caused by a distributed denial-of-service (DDoS) attack:
  • Fusion.net: WTF is happening to the internet today? Internet down after DDOS attack. 
  • Bloomberg.com: Possible Vendetta Behind the East Coast Web Slowdown: "Millions of internet users temporarily lost access to some of the world’s most popular websites Friday, as hackers hammered servers along the U.S. East Coast with phony traffic until they crashed, then moved westward. In what is believed to be a coordinated attack on one particular Domain Name Server provider, the hack took down sites including Twitter, Spotify, Reddit, CNN, Etsy and The New York Times for long stretches of time, from New York to Los Angeles ..."
Coincidentally (or maybe not), this attack came only a day after ICANN, global coordinator of the DNS including the internet Root Zone file (via subsidiary PTI), announced that pursuant to the Obama administration's IANA Stewardship Transition, "Verisign [NASDAQ: VRSN] will now perform the root zone maintainer services for ICANN under the Root Zone Maintainer Service Agreement (RZMA). ICANN and Verisign are in the process of switching to the root zone management systems that do not include NTIA’s [U.S. government] authorization role." 

Unfortunately for internet users around the world, incompetent ICANN has for several years been so obsessed with its new gTLDs program, seeing itself as a 'marketing agency' for new generic top-level domains from .PORN to .SUCKS, to now "over 1000 new gTLDs," that it has been lax in its primary duty of ensuring the security and stability of the domain name system (DNS). See, for example, on DomainMondo.com:

In the most recent Verisign 10-Q filing with the SEC (Q2 2016), Verisign warns (as it has for several years) under "Risk Factors":
"Under its New gTLD Program, ICANN has recommended delegations into the root zone of a large number of new gTLDs. In view of our role as the Root Zone Maintainer, and as a root server operator, we face increased risks should ICANN’s delegation of these new gTLDs, which represent unprecedented changes to the root zone in volume and frequency, cause security and stability problems within the DNS and/or for parties who rely on the DNS. Such risks include potential instability of the DNS including potential fragmentation of the DNS should ICANN’s delegations create sufficient instability, and potential claims based on our role in the root zone provisioning and delegation process. These risks, alone or in the aggregate, have the potential to cause serious harm to our Registry Services business. Further, our business could also be harmed through security, stability and resiliency degradation if the delegation of new gTLDs into the root zone causes problems to certain components of the DNS ecosystem or other aspects of the global DNS, or other relying parties are negatively impacted as a result of domain name collisions or other new gTLD security issues, such as exposure or other leakage of private or sensitive information."
For a reference to many of the risk factors about which ICANN has been warned, repeatedly, read the attachment included with this letter (pdf), from ICANN Board Chairman Steve Crocker to Patrik Fältström, Chair, ICANN Security and Stability Advisory Committee (SSAC), embedded below (highlighting added):



feedback & comments via twitter @DomainMondo


DISCLAIMER
Labels: , , , , , , , , , , , , , , , , , , ,

2016-02-05

ICANN New gTLD Program Plays Roulette With Internet Root Zone Stability

"CDAR Study cannot predict stability of the Root Server System"--Daniel Karrenberg, Chief Scientist, RIPE NCC, infra
"It [ICANN's CDAR Study Plan] may not be enough to ensure that 'a [new gTLDs] first round did not jeopardize the security and stability of the root zone system.'" --Business Constituency comment, infra
Comments closed 3 Feb 2016 at 23:59 UTC on ICANN's "Continuous Data-driven Analysis of Root Server System Stability (CDAR) Study Plan" --"This study has been commissioned to examine the technical impact of the New gTLD Program on the root server system. As the first step, The Netherlands Organization for Applied Scientific Research (TNO) and its partners SIDN and NLnet Labs are publishing the draft study plan for public comment. Feedback from the larger DNS community is critical to ensure a comprehensive approach to data gathering and analysis. Comments may be incorporated into the final study design." (source: ICANN.org, emphasis added)

For background on how ICANN has jeopardized the stability and security of the Internet Root Zone by launching hundreds of unwanted and unneeded new gTLDs into the internet root read:
Now ICANN, as required by a previous commitment based on advice from ICANN's Governmental Advisory Committee [PDF, 276 KB], has undertaken a study as described at the first link above.

Three comments were received, one of which appears to be a spam comment. Here are excerpts from the other 2 comments, which are illuminating (emphasis added):

 First, from Daniel Karrenberg (pdf), Chief Scientist, RIPE NCC, (not speaking  on behalf of the RIPE NCC)--"CDAR Study Cannot Predict Stability of the Root Server System ... The DNS root name server system is a complex system with hundreds of servers, tens of thousands of clients and millions of users all connected by the open Internet and subject to unpredictable use and abuse. The proposed core methodology of the study is a "quantitative model" based on measurement of past behavior of the DNS root server system. Models of complex systems are by their nature simplifications. Well constructed models may indeed be very useful to predict possible instabilities in the real-world systems. However these models cannot predict the *absence* of instabilities in complex real-world system with any useful level of confidence. In other contexts this is referred to as "past performance is not necessarily indicative of future results". Our main comment and advice to the researchers is to carefully avoid any perception that their results predict the absence of instabilities in the DNS root name server system unless the results solidly support such claims. Our main comment and advice to ICANN is: do not expect the study to predict the absence of instabilities in the DNS root name server system including absence of instabilities that may be wholly or partly caused by root zone expansion. ICANN therefore must make proper contingency plans for the unpredictable cases where root zone expansion causes or contributes to instabilities in the DNS root sever system."

Second, from the ICANN GNSO "Business Constituency" (pdf)--
"1) Page 4, Introduction: Root server scalability and possible impacts on performance attributable to zone file growth due to new gTLDs are of focus of this study. New gTLDs also may impact root server system stability and security in other important ways, such as the ability to successfully mitigate DDoS or other attacks that span a much larger DNS ecosystem, or vulnerabilities that may be introduced by newly deployed systems that interface with root servers. While measuring performance to verify that root server scalability risks have been managed is a good start, it may not be enough to ensure that "a first round did not jeopardize the security and stability of the root zone system." It is therefore important for this entire study plan to more clearly indicate what the study can and cannot accomplish. For example, on page 4, bullet a) should refer specifically to “root system stability” and bullet b) should not include security.
2) Page 5, Objective: The plan states: “The main objective of this project is to assess the impact of the new gTLD program on the security and stability of the DNS root system, up to the current point in time and beyond.” This objective may not be feasible; the limitations of this study should be acknowledged. This study will establish an important baseline against which future measurements can be compared to analyze trends, so it is important that the limitations of effectively measuring past root server system performance (before first application round new gTLD delegation began) be noted.
3) Page 7, Approach: The plan states: “This set of relevant parameters will be validated with the DNS community (ICANN, DNS OARC, etc.).” This validation is critical to ensure that the study focuses on the most relevant parameters to be measured and analyzed. However, it also may be appropriate to seek broader community input on parameter priority, feasibility, and usability so that the study can start with parameters that will have the greatest impact on preserving root system scalability and, importantly, identifying possible risks that must be mitigated to enable additional growth.
4) Page 8, WP-1: In addition to the organizations listed here, it may be appropriate to include measurement and modeling experts within the larger DNS community, including those who use and rely upon the DNS for day-to-day business operations. Notably, many global enterprises have deployed even larger distributed systems and may have valuable contributions to offer here.
5) Page 9, WP-2: The plan states, “…measuring the root security and stability from the new gTLD registry perspective are still an unexplored area.” The BC suggests evaluating the value of examining stability from the new gTLD registry perspective, to determine if this perspective should also be gained. This may be key since registries grow more numerous and diverse as a result of new gTLDs. It appears that only scalability can be analyzed from the measurements identified in WP-2. Please expand on the measurements to ensure that security and stability are adequately addressed.
6) Page 10, Root Stability Parameters: The BC recommends that the parameters be clearly defined with respect to gTLDs, ccTLDs, new gTLDs and other groupings within the DNS, and also geographic boundaries. Questions the study does not yet answer (but should) include: Will this study gather measurements across all TLDs, or only new gTLDs? Will it be able to differentiate between first round new gTLDs and subsequent round new gTLDs? Will it be able to differentiate between gTLDs and ccTLDs? Will it be able to break results down geographically? The BC also recommends soliciting community feedback on the parameters selected prior to implementing the study.
7) Page 11, WP-3: The BC would like to see a list of the questions that the DNS community hopes to answer when reviewing study results. For example, is there a correlation between latency and number of TLDs? If so, why. Also, will the study provide sufficient data to examine potential contributing factors to enable risk mitigation?
8) Page 13, WP-5: Reviewing preliminary results with the community to refine the approach and findings is extremely important. However, we note that additional work packages will likely be needed, following public comment, prior to project completion, to allow for the “more measurements and complementary analysis” mentioned.
9) Page 13, WP-6: The timeline given on page 10, especially the period for draft study report presentation to the community, appears optimistic. WP-1 has not yet begun and timelines for WP2/3/4 may well be too short to permit statistically significant results. We recommend that TNO et al specify a minimum length for WP-3 and WP-4, to allow sufficient time for collection and analysis to yield statistically significant results.
10) Additional note: The BC would like the new gTLD impacts on addresses as well as names to be considered as a topic of study (e.g. growth in reverse DNS queries, resolving IP addresses to new gTLD domain names), if not by this study, then by a future study building on the same methodology. Both identifier systems are potentially impacted by the significant growth attributable to new gTLDs."

 Caveat Emptor!



DISCLAIMER
Labels: , , , , , , , , , , , , , , ,
Subscribe to: Posts (Atom)

Domain Mondo archive