[policy] When Tech Meets Policy...

Tue Aug 21 01:53:23 UTC 2007

>  > On 8/15/07, Barry Shein <bzs at world.std.com> wrote:
>  > >  > I am not sure tasting is criminal or fraud.
...
> Well, not all of us agree that these ad-only pages are particularly a
> problem. They're certainly not necessarily criminal or fraudulent
> except by some stretch.

There are different applications for domain tasting out there, with
different levels of legitimacy.  Some of them will go away if you
reduce the amount of refund they get for returning the name; some
won't.

-- Actual mistakes - probably not many of these, and in a corporate
environment it's ok if a company has to pay $6 for their mistake;
they're going to end up spending more money handling the invoice in
most cases.  As other people have pointed out, for individuals,
getting stuck paying the current $6 fee is a lot less annoying than
the old $35 fee if you've made a mistake, but it's possibly useful to
have some incentive for the user to return the name if they genuinely
made a mistake, such as being one letter away from a popular web site
in a country whose language the user doesn't speak or violating a
trademark they'd never heard before.

-- Ad-banner tasters - They're hoping to make money by littering the
domain name space with content-free material, which is not criminal or
fraudulent, just rude.  Ostensibly you could get rid of them by
requiring web pages to have real content, but not only would that
require enforcement by humans (yeah, right), but it's trivially easy
to generate pages with Not Much Content as opposed to no content at
all, if nothing else by putting a boilerplate wiki page there and
pretending that you've got real users who just haven't shown up yet.
The way to get rid of these guys is to charge money for the pages,
i.e. don't force the registrars to return their entire registration
fee, and possibly have ICANN keep their US$0.20  cut of the funds even
if the customer returns the name.  That won't get rid of all of them -
some will even be willing to pay the whole $6 - but it'll cut down on
most of the ankle-biters.

-- Phishers trying to hide - They're not providing ad-banner-only
pages, they're providing web forms that look very much like
Example-Bank.Com's web site, or are Cyrillic-font variants on Paypal,
etc., and they use domain tasting so they can collect hits from
suckers for a couple of days and then make their records disappear by
returning the name.  Charging a restocking fee is less important here
- if the phisher's succesful they'll make more than enough to pay for
it, unlike the typo-squatters - but there ought to be some requirement
to keep the registration information around in case anybody wants to
investigate it later, even if it turns out to be bogus information
registered from a random zombie's IP address.

-- Fast-flux spammers trying to hide _and_ save money - They're also
playing the game of keeping a domain name up for a short time so that
mail gets delivered and then shutting it down to cover their tracks,
as well as serving the DNS and web page information from a bunch of
different zombies.  (Not all of them do domain tasting - depends on
the state of the anti-spammer arms race - but it does let them save $6
for a name they're only going to need for a couple of days before the
spam filters cut their response rates down.)

According to the Council for Made-Up Statistical Information,
getting rid of free domain tasting will get rid of 90-98% of the
ad-banner domain tasters,
making it easier to track the actual bad guys and laugh at the couple
of people who made legitimate mistakes.

It also makes it a bit easier to provide reliable alternatives to
standard DNS transmission - a back-of-the-envelope estimate I did a
couple of years ago said you could multicast all of the DNS
root/.com/.net/.org information in near-real-time in about 56kbps,
except for the domain tasters, which would make it easy for ISPs and
possibly end users to maintain reliable caching servers even if the
main DNS root servers were under attack.   You'd need a bit more than
that today, but it wouldn't be that hard if you could eliminate the
tasters (I suppose only transmitting information for domains that were
registered for more than a week would do that, and you might need to
limit TLDs to weekly, so sites that wanted to use DNS load-balancers
would need to put them in www.example.tld instead of just
example.tld.)

----
             Thanks;     Bill

Note that this isn't my regular email account - It's still experimental so far.
And Google probably logs and indexes everything you send it.