|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: ICANNs role [was: Re: On-going ...]
[Top-Posting] Thanks David, of course, as you know, this was not an attack on you. I appreciate you clarifying to me a bitmore on what ICANN does, does not and is not supposed to do. I will contact you off-list for further consultation. Many thanks again for all your help! So, who *is* able to help affect change? Gadi. On Mon, 2 Apr 2007, David Conrad wrote: > Gadi, > > > So you are the guys asleep at the guard post? :) > > Something ICANN is frequently accused of. > > > 1. Allowing registrars to terminate domains based on abuse, rather > > than > > just fake contact details. > > Seems like a reasonable idea to me, but wouldn't that be a > contractual term between the registrar and registrant? > > > 2. Following these incidents as they happen so that YOU, in charge, > > can > > make these suggestion? > > Sorry, who is in charge? > > > 3. For true emergencies threatening the survivability of the system, > > shoudln't we be able to black-list a domain in the core? > > I don't understand this one. What's "the core" in this context? > > > 4. Black lists for providers are not perfect, but perhaps they > > could help > > protect users significantly? > > Perhaps they could. Not sure what ICANN would have to do with this > though (unless you're suggesting ICANN runs a blacklist? If so, I > suspect ICANN's legal counsel would have ... concerns). > > > 5. Enforcing that registrars act in say, not a whitehat fashion, but a > > not blackhat fashion? > > Sorry, what does this mean? > > > 6. Yours here? > > Sorry, haven't really looked into this space, so I don't yet have > suggestions. > > > 1. Rather than terminate on fake details - verify details before a > > domain > > is registered. Not just the credit card, either. > > Isn't this a business practice of the registrars? I gather you're > suggesting ICANN take a much more aggressive role with registrars? > > > 2. Domains are a commodity, ICANN should know, what of putting them > > under > > a wider license on abuse and termination or suspension? > > My observations are that the relationship between ICANN and the > registry/registrar folks is much less dictatorial than you appear to > assume. > > > The whole system is almost completely unregulated, and this is > > money you > > take care of that we speak of here. > > There are many who argue quite forcefully that ICANN is not a regulator. > > > You have a long way to go before claiming to take care of the > > Internet. > > I don't think ICANN has ever claimed this. > > > Please take that route if you believe you can. The Internet > > needs your help. > > You seem to believe ICANN has a much greater role in Internet > management than it has. ICANN can't even make changes to a name > server in the root zone without US government approval. > > > How about some funding for research projects? Getting involved and > > perhaps > > funding Incident response on a global scale? > > I can suggest this, although having a concrete proposal would > probably carry more weight. > > > Why does this have to be in the hands of volunteers, such as myself > > and > > hundreds of others? > > > > Why does Internet security have to be in the hands of those with "good > > will" rather than those who are supposed to take care of it? > > I suspect because the Internet is decentralized. > > > How about adding security to the main agenda along-side with > > the .xxx TLD? > > It is, although there are lots of aspects to security so undoubtedly, > it can't be all things to all people. ICANN has an advisory > committee specifically targeted at "security and stability" that has > some folks who frequently participate on this list (http:// > www.icann.org/committees/security/). > > > I have no problem with ICANN, but there is a long way to go before > > you can > > claim to protect the Internet, infrastructure, users, or what's in the > > middle. > > I don't think ICANN claims this. > > > I'd encourage ICANN to take that road, much like I would encourage > > any person or organization that wants to help. > > > > You were not here before when we needed you, so organizations like > > FIRST, the ISOTF and many good-will based groups were created. You are > > here now, how do we proceed? > > I don't think anyone expected ICANN to take on the role of Internet > security czar. I suspect if ICANN tried to assert this sort of role, > the USG (among other governments) would take strong exception. > ICANN's role (as I understand it) is coordinative, not directive. > Any attempt to go beyond this will result in ICANN getting slapped down. > > > What is ICANNs next step? I will support it, so will others. It's not > > about politics as much as it is about who DOES. Maybe you just need to > > work with the community rather than claim to run it when you don't > > really > > do anything in security quite yet. > > I don't think ICANN has ever claimed to run "the community". > > > Well, if a domain was registered last month, last week, or 2 hours > > ago, > > and is used to send spam, host a phishing site or changes name servers > > that support phishing sites ALONE (nothing legit) in the thousands, or > > support the sending of billions of email messages burdening messaging > > across the board, I'd call it bad. > > As would I. > > > Who "one" is, now that is something to work out. We need help > > setting the > > system in place with guidelines and policies so that the one or > > other can > > start reporting and getting results. > > > > Is ICANN willing to help? > > To be perfectly clear, I don't speak for ICANN, I just run IANA. I'm > happy to forward suggestions to folks in ICANN who don't participate > in NANOG or other forums, but don't expect this to have significantly > more impact than you participating directly in the various ICANN forums. > > Rgds, > -drc > >
|