JdeBP> <URL:
http://homepages.tesco.net./~J.deBoynePollard/FGA/verisign-internet-coup.html#Resistance>
JC> I am sorry, but I don't understand why the idea is a poor one.
What about the explanation given on that web page did you not
understand ? I've listed the several flaws in detail, along
with examples.
JC> SimpleDNS Plus has already done it.
That says nothing, apart from that we can count SimpleDNS Plus
users amongst the growing number of people who have just handed
another weapon to Verisign.
Also: Bear in mind that "Someone Else has already done this." is
one of the very arguments that has been put forward in defence
of what Verisign has done. ("Other TLD registries started doing
this years ago [...].") "Someone else has done it." doesn't
necessarily make "it" the right thing to do.
JC> And if Verisign changes the IP address, they have added
JC> the capability to correct for it in the INI file.
Now read the explanation on the web page about why the very
fact that Verisign _can_ change the IP address is a flaw in
the "solution".
JC> To me that is a very good reponse [...]
No. It's a bad response. It's counterproductive in that people
now think "Oh, the DNS software fixes it.", which it doesn't
actually do at all. (All but one of the software fixes that I've
seen so far don't fix the problem at all, and hand Verisign another
weapon. The remaining one simply just doesn't fix the problem.)
This _isn't_ a technical problem with a software fix. It's an
administrative problem with a talking-to-human-beings fix. A
good response would have been to say that the Domain Name System
works by delegation, and that we (all of us) have (individually,
albeit usually indirectly) delegated authority over "com." and
"net." and their subdomains to Verisign. This is the way that the
DNS is designed to work. If someone breaches our trust by abusing
the authority delegated to them, the correct response on our part
is to not delegate authority to them any more (or, at least, to
threaten to). This involves talking to root server organizations
(ICANN, ORSC, PacificRoot, and so forth) and to Verisign. (If
Verisign doesn't comply, we get the root server organizations to
stop delegating their authority to it. If the root server
organizations don't comply, we stop delegating _our_ authority
to _them_.) It doesn't involve changing the source code of DNS
server softwares.
Consider a hypothetical that might help: Posit that you are the
administrator of "yellowhead.com.". You delegate authority for
"
www.yellowhead.com." to Verisign, on the understanding that it
won't abuse this to redirect your HTTP traffic somewhere that
you don't want it to go. Verisign abuses your trust and redirects
your HTTP traffic somewhere else, using the authority that you have
given to it. What do you do ? Do you employ the software-fix
approach of having everyone in the world patch their DNS server
softwares ? Or do you employ the talking-to-human-beings approach of
telling Verisign to get back into line, with the threat that if it
doesn't you'll simply delegate the authority for "
www.yellowhead.com."
and its subdomains to someone else ?
