.COM Tried to Stop Tasting?"> Imagine if VeriSign were to impose such a policy for .COM and .NET, which it runs? In Section 3.7 of the ICANN domain tasting report they refer to a May 18, 2007, column I wrote in which I state:If youre interested in the domain tasting issue I recommend reading the report, but dont get excited about the prompt action youd expect it to trigger. Thats not the way ICANN works. After all, theyre the folks who created the mess that allowed domain tasting and ignored it for years. Already theyre spending inordinate amounts of time investigating things everyone knows to be true, effectively protecting the interests of people everyone knows are scammers. If you want to see where they are on the subject you can read the latest draft of the RFI (request for information) document theyre working on (Microsoft Word .DOC format). Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers blog Cheap Hack.
More from Larry Seltzer
VeriSign has it in their power, under their .COM registry agreement with ICANN, to stop domain tasting by imposing a restocking fee for abusers, with the standard for abuse left to them.The authors of the ICANN report say Im wrong. From the report (page 25):
(Note, this is not currently permitted in the .COM registry agreement. To provide this service, VeriSign would have to submit a request to ICANN through the Registry Services Evaluation Policy.)Patrick Jones of ICANN (one of the authors of the report) and I followed up on this some in e-mail, and he brought it to the attention of the domain tasting working group. But despite one inquiry from a member into my claims, Jones insists that its more complicated than I state:
ICANN evaluates requests for new registry services under the Registry Services Evaluation Policy on a registry by registry basis. VeriSign has not submitted a request to implement a restocking fee in .COM or .NET. All requests for new registry services are posted on the ICANN website at http://www.icann.org/registries/rsep/, with opportunities for public comment. We have also improving ICANNs public comment periods with a new page at http://www.icann.org/public_comment/.Ive skimmed the Registry Services Evaluation Policy, and perhaps, in the absence of any specific statements about restocking fees, it would be meaningful, but the fact is that the .COM Registry Agreement does have specific statements on the matter. From Appendix 7, Section 3.1.1 ("Add Grace Period"):
Delete. If a domain is deleted within the Add Grace Period, the sponsoring Registrar at the time of the deletion is credited for the amount of the registration; provided, however, that Registry Operator shall have the right to charge Registrars a fee as may be set forth in its Registry-Registrar Agreement for disproportionate deletes during the Add Grace Period. The domain is deleted from the Registry database and is immediately available for registration by any Registrar. See Section 3.2 for a description of overlapping grace period exceptions.It seems to me this interpretation renders the restocking fee section of the .COM agreement meaningless. Jones disagrees. The bottom line of my read on the subject is that it would be easy to do something about tasting if VeriSign were interested in doing so. Clearly its not. VeriSign obviously thinks that the cost to it of an enormous amount of adds and deletes in the registry is overwhelmed by the registry fees it gets.