kijeda

The security is designed to guard against surreptitious access. Interested members of the public are welcome to attend ceremonies (availability on a first-come first-served basis).

There are multiple redundant sites and backups of the keys, so an attack aimed at destroying a site should not alone be a problem. Even if all all sites and backups were destroyed, there is a window where a new key can be constructed (approximately between 3-6 months worth of operational zone-singing keys are prepared in advance for the root zone).

Out of how many cities? They only present 7.

Worse, they used to support it. They disabled it with the line that "upgrades" to their terminals were the cause. https://consumerist.com/2015/05/05/apple-pay-unavailable-at-...

All unused two letter combinations are reserved for country-code top-level domains. This is to ensure future countries have the ability to have their own TLD. New countries are created perhaps more often than you may think, on average about one per year or two.

This story appears very similar to one done by the Australian edition of 60 Minutes last year:

http://www.9jumpin.com.au/show/60minutes/stories/2015/august...

He sold the majority of Virgin Australia many years ago (back when it was called Virgin Blue).

The IETF has been working on distribution issues and, amongst other documents from the tzdist working group, produced this: https://datatracker.ietf.org/doc/draft-ietf-tzdist-service

I received counsel that I needed to transfer from an E-3 to a H-1B before I could apply for a green card. That is what I did, and I now have a green card.

I also found that E-3s are sufficiently rare, I got conflicting comments from border agents, consular officials etc. Most had never heard of it, or applied understanding they had from other similar visas. (Admittedly, I first obtained mine the first year that category was created.)

Reminds me of building codes for waterless urinals. Here is California the building code requires them to be plumbed with incoming water even though no water is needed, as a sop to the plumbing community.

"Provide water distribution and fixture supply piping, sized as required elsewhere in this code, roughed-in immediately adjacent to each waterless urinal fixture installed."

If you travel enough where seating at the airport is a frequent issue, wouldn't you have complimentary lounge access as a result of your status with the airline?

Under the original policies, .org.au was effectively "miscellaneous", it was expressly for domains that don't fit under other categories. .asn.au was for formally registered associations (e.g. not-for-profits). Similarly, .net.au was just for network operators.

When auDA was created in the late 90's, the policies were harmonized and .com.au and .net.au got the same policies, .org.au and .asn.au got the same policies, etc. It has further evolved since based on policy panels I think they conduct every 5 years.

No, a root server is shorthand for the authoritative name servers that serve the root zone of the DNS. Here is the list: http://www.iana.org/domains/root/servers

Servers configured to be a source of truth are called "authoritative name servers".

There is no technical distinction between "TLDs" and "domains", they are all just domains, they are just different levels of the DNS hierarchy.

This is the correct answer. The monitoring tool is sending the wrong kind of DNS queries to these servers, and these servers are filtering them out. You can argue the servers should at least respond with an error, however they are functioning correctly when you ask them for an authoritative response (i.e. a delegation)

The "keys to the Internet" is a misnomer. He is a "recovery key shareholder", which means he holds a smart card in an m-of-n configuration that allows ICANN to decrypt a backup of the Root Zone Key Signing Key in a disaster recovery scenario should the KSK need to be rebuilt.

The primary roles are the cryptographic officers, these are Internet community members who attend key signing ceremonies to observe use of the KSK.

Here are a list of the trusted community representatives: https://www.iana.org/dnssec/tcrs

WHOIS significantly predates the existence of the web. The notion is if you have a public network resource identifier (IP address, domain name, AS number, etc.) that there be a record of who to contact to report administrative or technical problems to pertaining to that network resource. It is perhaps similar to having a formally registered place of business on record for a company to receive important correspondence.

Obviously the usages of WHOIS have drifted over time to go beyond that.

The Apache2 Ubuntu Default Page is presumably on your localhost?

  $ dig +short fuck.microsoft
  127.0.53.53
  $

It is part of the ICANN-mandated "controlled interruption" phase of launching a new TLD before production usage. https://www.icann.org/resources/pages/name-collision-2013-12...

Incidentally, most browsers support decimal notation as well as dotted quad notation for IPv4 addresses. So http://1249764297/ works to reach Google for example. Once this regression is fixed you should be able to use http://0:*/ rather than http://0.0.0.0:*/

I suspect you need such a carve out to be able to legally block denial-of-service attacks and other such network events that are intended to disrupt regular operation of a service.

The article essentially chronicles surprise that this app would be rejected. What you describe is you believe the terms are unjust. These are two different things.

I may not agree with the speed limit on the freeway, but I am not surprised if I am ticketed for going over it.

Here is ICANN's actual filing: https://www.icann.org/en/system/files/files/ben-haim-motion-...

Who in the industry, whether they are "financially aligned" or not, claims that DNSSEC provides you with privacy or encryption? The DNS data is sent in the clear.

No-one who uses DNSSEC is arguing it keeps your DNS records private. It is a straw man argument to suggest otherwise.

DNSSEC is designed to provide tamper-evidence, not privacy.

It has been for quite some time (at least a year).

https://www.google.com/fonts/specimen/Noto+Sans

Here is the registry: http://www.iana.org/assignments/ipv4-recovered-address-space

It is space that has been surrendered to IANA for re-allocation.

It would be useful to put forward a single credible scenario where "world" governments can use the DNS root private key in any fashion without detection. It is impossible to have a reasoned debate about DNSSEC with straw men like this.

Is the Chinese search part of the Australia-led search effort (i.e. the Chinese vessels are searching areas they are being tasked), or are they doing their own independent search?

The proposition that it has failed due to the passage of 17 years since the first RFC neglects the fact that there were certain key events that inhibited adoption that didn't happen until recently:

1. The DNS Root Zone was not signed until mid-2010. As the anchor of trust for the DNS, deployment prior to this date was basically experimental. This was the commencement of production use.

2. Registries and registrars, as a whole, did not support it until recently. However, ICANN has required them to do so in the last few years so this roadblock is being removed.

The assertion that it is a failure may ultimately prove to be true, but looking at its experimental phase and declaring it as proof positive is not convincing.

Perhaps this is not so surprising. Prior to IDNs, the DNS also did case folding so "a" and "A" would go to the same place.

One of the particular challenges with IDNs is that there are two versions of the specification, a deprecated 2003 version and the current 2008 version. For a few characters they provide subtly different transforms. The 2008 version also ratchets down on a lot of non-sensical characters — they are no longer eligible in domain names. The remaining permissible set is quite conservative to limit some of the issues seen in the original version.

For me, a big concern is propagation delay in the email. It sends a token that is valid for only 5 minutes, but with greylisting performed by the spam-filtering machinations in my email provider, there is a good chance I will not get that email within 5 minutes. Trying to send a second one will probably result in some kind of exponential back off penalty also.

For that reason alone I don't see how only using email verification as a low-friction way to log in makes sense.

What is the threshold where supporting a domain becomes important? It seems awfully arbitrary to say it "works fine as is" when it is disenfranchising millions of registered domains as it stands.