That's not the point. The point is Verisign has broken the RFC by not returning NXDOMAIN for the lookup of an invalid domain. Which means that all the email systems that use reverse DNS lookup to validate a domain now think every domain in existence is valid. It's fine if the person who owns the site does this, but these are UNREGISTERED domains with non-existent IP addresses. Verisgn is fixing to get bitch-slapped in a hard way, and if we're *really* lucky, they'll be driven out of business. This kind of crap is not in their charter. --John On Friday 19 September 2003 17:31 pm, Patrick Rigney wrote:

I think my earlier message may have not made it through the night's maintenance, so I apologize if I'm repeating myself. I wasn't responding to the NXDOMAIN issue, John. I was responding to the "hype" about the use of a third-party cookie (Overture) and a one-pixel image for tracking. That said... <soapbox> I think the call to your congressperson is more meaningful than the attorney. And if that's your timetable, don't bother waiting. It isn't going to stop. It's clear that VeriSign is contributing to the spam problem by their actions, but what happens when they cease and desist? Everything goes back to the way it was yesterday. Spammers continue to use forged email addresses in legitimate domains, and our mailboxes continue to be choked with an ever-increasing amount of spam. Every day I get bounces for messages never sent from my domain... someone simply hijacked it to send their spam. Checking for the existence of a valid domain name has been a long-standing filter, but it has always been a weak one that spammers have easily worked around, and only the stupid and inexperienced ones bother. IIRC, this whole discussion started with the problem of a mass-mailing worm sending volumes of mail with a large attachment, and got onto this. This problem is also not solved by RFC compliance. A mass-mailing worm typically forges its source identity by using addresses in the infected party's address book, which are generally going to be valid addresses in valid domains, and possibly even people you may know as well. They do this to capitalize on your implicit trust. In any case, VeriSign's actions probably made no contribution to this problem. I'm not trying to defend VeriSign here. They are contributing to a problem, that is clear. I'm trying to point out that the spammers are the real offenders and their activities predate both SiteFinder and VeriSign, so while slapping VeriSign to bring them into compliance with the RFCs may be just, right, and necessary, it is far from solving the problem of spam. VeriSign's actions are offensive and demonstrate that they are poor custodians of the responsibility they carry, so it's easy to focus on it, but it remains only a very small part of the Big Picture. On The Screensavers (a TechTV show), this 17-year old kid called in and argued with Pat and Leo over spam, claiming that anything we do to block it he can work around, and it's worth the effort because he can make $1,000 a day easily sending bulk advertisements for his clients (see link to their show notes at the bottom of this message). With that kind of money and no meaningful consequences, is it any wonder we get this crap in volume? Is it any wonder that today I am defenseless against my future teenage daughter opening her email to see things like "Watch me and my teen slut friends **ck and **ck huge **cks"?!??!? Damage is done on delivery, and God forbid she opens that message and sees the attached picture. I get emails like this every day, lots of them. Don't our congressional representatives as well? Are they awake?!? "Just delete it" isn't an answer. This kind of crap needs to be illegal, meaningfully punishable, and crisply enforced. Congress has done an embarrassingly bad job of addressing the spam issue meangingfully so far--pretty much useless, IMO. They need to be informed, they need to open their minds and really understand the issues, and they need to understand why what they have done so far isn't effective, and that technical solutions alone will not address the problem. And, enforcement and prosecution needs to be handled as a criminal matter, with real interest and urgency on the part of law enforcement, not a civil matter that's so potentially burdensome on the complainant that it's not worth the effort. One more thing to add... I personally do not believe it is appropriate for any for-profit company to be in the role VeriSign is in with respect to domains. I also believe that putting VeriSign out of business at this stage would be very harmful to the 'net economy and the economy in general. For better or worse, VeriSign provides a breadth of services upon which a huge number of businesses relies, and their absence would leave a gaping hole and huge mess to straighten out. The interruption or absence of these services, even temporarily, would drive many businesses under, especially in these delicate, not-quite-recovery-for-everyone times. It is a huge error that VeriSign has ended up in this role with relatively little supervision, and reversing that without making a bigger mess of it and killing a lot of innocent bystanders would take a lot of very delicate, well-planned dismantling. MO. John Postel, you are missed. </soapbox> --Patrick Ref: http://www.techtv.com/screensavers/shownotes/story/0,24330,3425430,00.html Scroll down to bottom of page to find "In defense of spam"

John, We agree. If you're not in California, please come, so I can vote for you for Governor. Patrick