ICANN’s First Test of Accountability | Hacker News Reader

ICANN’s First Test of Accountability

afilias.info

91 pointsayh33 comments

> Competition drives innovation and improves consumer choice through ensuring: (i) market-based pricing; (ii) a widely available variety of unrestricted TLDs; (iii) improved quality of service (e.g. highly available and reliable systems); and (iv) improved customer service.

How did allowing corporations like Google to purchase generic gTLDs like .dev and refuse to allow the public access to any of them ensure these goals, especially (ii)? :/

Restricted gTLDs should have only been for trademarked company names, like .google or .microsoft

> Restricted gTLDs should have only been for trademarked company names, like .google or .microsoft

Unfortunately however, there are a lot of grey areas... To name a few:

* Amazon have been in a long dispute with the Brazilian government, over the right to operate a .amazon TLD - as the Brazilians claim it should instead be related to the rainforest.

* On the other hand, Amazon have secured TLDs such as .prime, which could also be disputed. Apple have won .apple, Sky have won .sky, ... the list goes on.

* Sometimes, the conflicts can even be with foreign languages. For example, Ferrero are now the registry operator for .kinder - but as this is the German word for "children", it's been the cause for similar debate.

Also, with regards to your concern that there is a lack of variety in available unrestricted TLDs - I disagree; if anything, there are far too many (there's hundreds!!).

> Unfortunately however, there are a lot of grey areas...

Certainly. Ideally, I'd have left it as .com, .net, .org.

> the Brazilians claim it should instead be related to the rainforest.

How many TLDs does a rainforest need, anyway? :P

> Apple have won .apple, Sky have won .sky, ... the list goes on.

I'm certainly particularly interested in .dev, because I'd like to have a .dev domain. I think there's a lot more people who are developers that would want a .dev than apples that would want a .apple domain ;)

(I actually use /etc/hosts to map byuu.dev to my VPS' IP when I'm setting up a new box before deploying it to the world.)

> Also, with regards to your concern that there is a lack of variety in available unrestricted TLDs - I disagree; if anything, there are far too many (there's hundreds!!).

Still wishing someone would buy .emu for people to use. Anyone have a few hundred thousand dollars lying around for a good cause? :D

> Certainly. Ideally, I'd have left it as .com, .net, .org.

(And .edu?)

Ideally, we would never have had more than one TLD; even before the new rounds of TLDs showed up, people found it annoying and confusing to have example.org and example.com go to two different places. Why did we need more than one TLD in the first place, other than as a license to mint money in the form of domain registration fees? I don't think it makes much sense as an organizational mechanism.

I suspect if there was a flat gTLD with no suffixes, everyone would have domain names that looked more like AOL screen names (lots of numbers after the names.)

I'm okay with a few TLDs, but the original distinction is kind of vague. There's really no distinguishing characteristics between .com and .net, and even though for some reason .org became popular with open source, a lot of OSS sites (including mine) are not organizations. If not for Google, .dev would have been a great one for developer sites.

What I don't like is the idea of adding an infinite number of gTLDs. It's bound to do nasty things: break a bunch of old URL matching regular expressions, collide with some poor businesses that made bad choices for their internal networks, etc.

> I suspect if there was a flat gTLD with no suffixes, everyone would have domain names that looked more like AOL screen names (lots of numbers after the names.)

I don't tend to see lots of numbers in domain names today, even in popular TLDs like .com.

Because there are alternatives. You can grab foo.(net,org,io,country-code,etc) if foo.com is already taken.

That was the whole point in theory, yes. But in reality, almost all new gTLD registrations are being made as brand protection, and redirecting to the company's existing .com domain. Only a very small minority of websites are trying to build a brand on a new gTLD domain name.

ICANN has made $400 million with new domains. Doesn't include the $135 million for .WEB. Non-profit? BS!

Non-profit has nothing to do with how much money they make, but with how they spend it.

This is the most annoying misconception on the internet.

Technically, there is one single TLD at the top of the tree; the root zone is called empty-string-dot and exists at the end of every DNS name, although resolving software doesn't normally require it. But it's why news.ycombinator.com. works as well as news.ycombinator.com without the trailing dot.

Interesting that it works now. Previously some browsers at least would reject https sites like that for a cert name mismatch.

Why does a rainforest even need a TLD?

Why does there even need to be such thing as a TLD? :P

I'm guessing the idea is similar to .London, .NYC, .Amsterdam, ... i.e. it would be used for a geographic indicator/market.

Yup. Thankfully Google lost .blog, which they intended to use solely for Blogger accounts. Automattic won instead, and made it an open registry that anyone could use.

Is it any different from purchasing a generic second-level domain like cars.com? What makes the top-level so special?

Dumb question: Why do we need generic TLDs at all? Why can't I associate any unique name I want with my IP addresses in my DNS records? Why shouldn't we use "https://ycombinator"?

Is it due only to the legacy of DNS? I suspect I'm missing something obvious, but even a quick search didn't reveal the answer.

How do you decide which nameservers to trust about the "ycombinator" domain? What happens if I advertise a nameserver with that domain?

If Named Data then no need to trust the server, because trust the data. The data is signed. Signed data is trusted and doesn't care what path it takes to go where it's wanted.

https://en.wikipedia.org/wiki/Named_data_networking

The same problem holds; what if multiple people sign data under the same namespace? You need some way of mapping a name to a single public key, so that you can check the signature. That's equivalent to a nameserver.

Use root servers like we do now. I'm not asking about doing away with DNS completely, just TLDs.

Got it. Then ICANN (or whoever) controls all websites, and is responsible for their infrastructure. That may or may not be better than what we have.

Due to the hierarchy of dns you can ask to a root server who handles .com, then to that server who handles google.com, then to that Google server, who handles mail.google.com, and then you can connect to it. If you allow anything to be a TLD the root servers need to know about everything, which isn't really feasible

> If you allow anything to be a TLD the root servers need to know about everything, which isn't really feasible

I wonder about that: The number of TLDs in my scenario would be approximately equal to the number of user-registered[0] domains now.

The .com root servers already need to know a large fraction of all 'user-registered' domains, and will need to scale to a much larger set of data as the number of domains grows.

Therefore, I expect that scaling to all 'user-registered' domains wouldn't exceed the root servers' capacity.

[0] I can't think of the technical term at the moment, but domains such as ycombinator.com, bbc.co.uk, ox.ac.uk, etc. Second-level isn't quite correct (see the .uk examples), and I know parsing the user-registered part is a bit of a challenge; see https://publicsuffix.org.

You can do this easily if you run your own nameserver, e.g., with tinydns.

   1 ycombinator:
   60 bytes, 1+1+1+0 records, response, authoritative, noerror
   query: 1 ycombinator
   answer: ycombinator 1 A 104.20.44.44
   authority: . 259200 NS ns

But the conventional wisdom is that you should let someone else run nameservers and give them your IP address. As such, they get to make the rules. Not to mention they also are often in the business of selling domain name registrations under those TLDs you wish to do without.

Further, assuming you plan to use your domain name in a web browser, browser authors can make a second set of rules about what domain names are "acceptable". They can block your TLD agnostic domain name. No DNS is involved.

You could edit the browser source code to modify any such rules and recompile. But as with nameservers, the conventional wisdom is to let someone else, e.g., a company, write the web browser; users are not meant to edit the source code.

You can do many "unconventional" things with DNS. But maybe your question is not what you can do, but why the third parties who control DNS for the masses do not do these things?

> You can do this easily if you run your own nameserver ...

Thanks; I didn't realize that was technically possible on the public Internet.

> But maybe your question is not what you can do, but why the third parties who control DNS for the masses do not do these things?

Yes.

The owner of .ycombinator tld would own the https://ycombinator/ domain. See http://ai/ for example.

Nothing stopping you from doing this besides the fact that it's kind of expensive and probably not exactly supported.

Traditionally, that refers to the computer named "ycombinator" on your local network, and the domain directed the networking stack to some external network. Eventually, the community recognized that everyone should agree on what name to use for each network, and domain registries were born, along with the traditional TLDs.

Internet upon its creation was subdivided into sections or tld. The ownership of each section was handed to a different entity. The entity managed all of the subnames on its section. And so began the modern tld system.

The management of the subnames on each tld is still given to one entity. For example, verisign manages the .com TLD. So in order to create new TLDs you need managers to step up. That's true for even country level domains.

So your question would evolve to if an entity can apply for and manage it's own tld. Well, icann did open this up and had some heavy requirements for TLD managers.

https://en.wikipedia.org/wiki/.com?wprov=sfla1

I agree with the proposed remedy, but I wouldn't call this a test of accountability. If NTIA oversight of VeriSign didn't prevent this, I don't see how NTIA oversight of ICANN would.

My "deplorable" Trump-voting attorney friend claims that an unaccountable ICANN spells the end of the internet as they supposedly will discriminate against certain users because of their political philosophy, as private organizations are not limited by the First Amendment.

I'm blissfully ignorant of ICANN, etc. Can someone here give me an answer for my paranoid right-wing libertarian friend?

Tell your friend to relax, it's not overly-PC liberals running ICANN, they're just run of the mill money grubbers.

Reply on news.ycombinator.com