Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
The Internet Government The Courts News

VeriSign Sued Over SiteFinder Service 403

dmehus writes "It was only a matter of time, the pundits said, and they were right. Popular Enterprises, LLC., an Orlando, Florida based cybersquatting so-called 'search services' company, has filed a lawsuit in Orlando federal court against VeriSign, Inc. over VeriSign's controversial SiteFinder 'service.' While PopularEnterprises has had a dodgy history of buying up thousands of expired domain names and redirecting them to its commercial "search services" site, the lawsuit is most likely a good thing, as it provides one more avenue to pursue in getting VeriSign to terminate SiteFinder. According to the lawsuit, the company contends alleges antitrust violations, unfair competition and violations of the Deceptive and Unfair Trade Practices Act. It asks the court to order VeriSign to put a halt to the service. VeriSign spokesperson Brian O'Shaughnessy said the company has not yet seen the lawsuit and that it doesn't comment on pending litigation."
This discussion has been archived. No new comments can be posted.

VeriSign Sued Over SiteFinder Service

Comments Filter:
  • Arrrrrr! (Score:4, Funny)

    by Anonymous Coward on Friday September 19, 2003 @12:38AM (#7001166)
    VeriSign be a bunch of land-lubbin' butt pirates, mateys!
  • Nice tactic. (Score:5, Informative)

    by NightSpots ( 682462 ) on Friday September 19, 2003 @12:39AM (#7001168) Homepage
    Anti-trust was one of the very few tactics I didn't hear discussed as possible ways to stop Verisign.

    Arguing that they get for free what other companies must pay for is probably one of the easier arguments for win, since it proves itself nearly by definition.

    I applaud the jackass who pays to abuse typos. At least they've finally proven their worth.
    • by TheSHAD0W ( 258774 ) on Friday September 19, 2003 @01:24AM (#7001372) Homepage
      They get it for free, but they also lose it any time someone wants to take it away, for any specific domain. I personally don't like it, but I don't know if this particular avenue of attack will succeed.
    • Re:Nice tactic. (Score:5, Informative)

      by nocomment ( 239368 ) on Friday September 19, 2003 @03:21AM (#7001712) Homepage Journal
      Don't forget the petition!!! Go sign it. []
    • comparison (Score:5, Funny)

      by Jucius Maximus ( 229128 ) <m4encxb2sw@snkma[ ]com ['il.' in gap]> on Friday September 19, 2003 @03:26AM (#7001725) Journal
      The only thing I can say here is that Verisign seems to be in competiton with SCO for numerous titles:

      - most hated company on the internet
      - most stupid business moves
      - most obvious 'shoot self in foot' maneuvre

      I expect that slashdot would implode if SCO sued Verisign for this maneuvre. Do you cheer because one of them will lose? Or groan because one will win?
    • by TheLink ( 130905 ) on Friday September 19, 2003 @11:30AM (#7004395) Journal
      Verisign doesn't want to NXDOMAIN? Fine then we should all give Verisign what it asks for - traffic to nonexistent domains.

      Y'know those "ribbon" stuff people used to put on their webpages as a sign of protest?

      Well here's my suggestion, every protester should use a "broken ribbon" logo on their webpage that's pointed to a random nonexistent url e.g.

      e.g. img src="" height=1 width=1

      (Leaving the angle brackets out because Slashdot's engine sucks - it's too stupid to treat plain old text as plain old text.)

      You should use a random img url but it doesn't have to change much if at all.

      The height and width should be set to 1 so that if some idiot tries to push an offensive image, it doesn't get seen by the person viewing your webpage.

      You could in theory construct a broken ribbon logo with an html table of different 1x1 imgs (all different URLs). 16 by 16 pixel icon could be 64 requests to nonexistent domains (drawing the ribbon), and the rest point to single background 1x1 image.

      Then if Verisign figures out a cheap way to deal with all the SYN packets heading their direction and still redirect users to a webpage, they'll have solved the "defend against DDOS SYN flood" problem.

      Some people say there's no technical solution to this problem.

      But add enough people and this might work.

      Slashdot and a few other popular sites could do this too.
  • Pert Peeve (Score:5, Interesting)

    by QuantumSpritz ( 703080 ) on Friday September 19, 2003 @12:42AM (#7001182)
    Cybersquatting, though one of the great minor evils of the web, is damned hard to stop. I can't think of any way to regulate/legislate it without messing up the domain registration and transfer process for everyone else - though it would be nice to be able to buy domains BACK from these companies - I would imagine quie a few choice domains are in their hands. Nice to see a lawsuit taking on Verisign over this - even if it is a cybersquatter. I wonder if there's an intelligent way to reserve domain names for individuals and organizations which already have use for the name - maybe a form of 'prior branding' only better implemented...
  • The pool (Score:5, Funny)

    by r_glen ( 679664 ) * on Friday September 19, 2003 @12:42AM (#7001183)
    OK guys, who had 3-5 days??
  • "Unfair advantage"? (Score:5, Interesting)

    by tessaiga ( 697968 ) on Friday September 19, 2003 @12:43AM (#7001186)
    According to the lawsuit, Mountain View, California-based VeriSign has been using its position as the keeper of the master list of all Web addresses ending in ".com" and ".net," also called domain names, to unfair advantage.
    So Popular Enterprises' complaint is not that VeriSign is cybersquatting, but that they're doing it more effectively without letting others have a slice of the pie?

    I guess people will figure that the end justifies the means, but the argument still seems a little distasteful.

      • So Popular Enterprises' complaint is not that VeriSign is cybersquatting, but that they're doing it more effectively without letting others have a slice of the pie?

      No, I think their complaint is that Verisign is in charge of baking the pies in the first place... it's hard to develop market share for your product, if users are diverted upstream.

    • by Caled ( 26214 ) on Friday September 19, 2003 @01:14AM (#7001335)
      Verisign has just acquired more domain names than there are atoms in the universe. If Mountain View wanted them they'd have to pay more money than exists, whereas it only cost versign a line in their DNS records.

      This is clearly abuse of monopoly.
      • by tessaiga ( 697968 ) on Friday September 19, 2003 @01:44AM (#7001447)
        Verisign has just acquired more domain names than there are atoms in the universe. If Mountain View wanted them they'd have to pay more money than exists, whereas it only cost versign a line in their DNS records.
        Exactly. Most Slashdotters (myself included) are objecting to the fact that Verisign has essentially hijacked all unused domains. However, Mountain View's objection is that doing the same would cost them money, while it's free for Verisign. The action itself doesn't bother them; it's the uneven costs of doing so that has them annoyed.

        Or, put another way, Mountain View would be perfectly satisfied if the result of the lawsuit was that Verisign allowed other cybersquatters to grab mistyped domains for free also, creating a huge happy cybersquatting family. Somehow I don't think the rest of us would be quite as delighted though.

    • by digital bath ( 650895 ) on Friday September 19, 2003 @01:26AM (#7001380) Homepage
      You know, I wouldn't really have THAT much of a problem if verisign at least served up the page with a 404 status error in the header. However, their sitefinder gives out the normal "200: ok" status on bad domains, which seems to me like a serious problem - I can see this breaking existing apps.
      • by bernywork ( 57298 ) <bstapleton@gmail.cMOSCOWom minus city> on Friday September 19, 2003 @02:21AM (#7001555) Journal
        This actually causes LARGE problems for people operating over VPN connections.

        What normally happens is this:

        People do a request for a site, e.g.

        The external DNS servers fail in that they don't come back with an answer, and then the client continues through its list of DNS servers until it gets to the internal servers where it gets an answer.

        What's happening now is that they ARE getting a good answer from the external servers, and the client is trying to connect to the 64.x.x.x address of Sitesearch. Now in most organisations the client isn't able to connect to that box (because its firewalled or whatever else), so it isn't a problem for VeriSign, however, it is a problem for the organisation, as the clients who are trying to work are getting given IP addresses for internal servers that are incorrect.

        I have had to change dial up settings on a few clients and change others over to using static IPs at the moment until a better solution comes around. Or even better till VeriSign stop doing this.


        • by nocomment ( 239368 ) on Friday September 19, 2003 @03:30AM (#7001744) Homepage Journal
          Don't forget printers. At my work we had a network printer that stopped working. What was happening was that there was an attempted name resolution at the beginning of the print job, when that failed it went with the known IP address. Now that the name resolution always resolves, those print requests went out to the internet. Fixed with a simple block on the firewall.
  • Even though the site is perfectly fine, I CAN'T access it without hitting their stupid "finder" for some reason.
  • by Amsterdam Vallon ( 639622 ) <> on Friday September 19, 2003 @12:44AM (#7001192) Homepage
    *Confirmed*: Adelphia has blocked VeriSign's new "service."

    Please reply to this and list names of fellow anti-VeriSign ISPs if your ISP has blocked this new "feature" as well.

    Thanks! I will enjoy analyzing this data.
    • by shostiru ( 708862 ) on Friday September 19, 2003 @01:04AM (#7001300)
      We (mid-sized midwestern ISP) had our main nameservers (tinydns and djbdns) patched by 2AM the night this mess started, using the patches we found here. By a few hours later, I'd kludged the BIND source myself on a couple of other machines to return NXDOMAIN for anything in all three of the /24 netblocks in AS30060 (it worked fine, at least until the ISC patch was released). AFAIK our customers never even noticed the wildcarding.

      If you work in an ISP or other network infrastructure company, you know first-hand the degree of astonishment and rage that Verisign's move elicited; the fallout (spam filtration, security, network monitoring, etc.) goes far beyond HTTP. I don't think any of us slept much that night ... it only took a few hours to restore normal DNS behaviour, the remaining ten or so I spent in shock with my jaw scraping the floor.

      I've dealt with Verisign before (try getting decent documentation on the cybercash application library!) and knew they were greedy and stupid, but I wasn't counting on raw, unfettered eeeeeevil.

    • by jms ( 11418 ) on Friday September 19, 2003 @01:08AM (#7001314)
      Speakeasy appears to have blocked the "feature".

    • It's blocked for me. The cable is provided by Time Warner, but the Internet connection by RoadRunner, so I'm assuming that RoadRunner is the one blocking it...
    • OK - I can verify that nifty (a very large provider) here in Japan does not block it. To make it worse, Verisign's page seems to be only available in English (Well, at least not Japanese), so now many people are getting redirected to pages they can't even read. At least Microsoft's version of this was localized.
  • by shostiru ( 708862 ) on Friday September 19, 2003 @12:45AM (#7001197)
    which I just found, draft-main-typo-wcard-02 []. Worth a look, as is the IETF mailing list archive []. They're definitely aware of the problem. I particularly like following paragraph from the Internet-Draft:
    An error response that only works correctly in one situation would be as bad as an SMTP server that ignored its input and always produced a fixed sequence of responses: it would work in the one situation it was designed to expect, but cause chaos whenever presented with any other situation.
    sounds like the Snubby Mail Rejector, hmm?
  • We're on the side of the plaintiff?

    It's a bad sign if you're cheering this on. Yes, VeriSign is completely wrong here, but the other party isn't to be lauded, either.

    It's kinda like Carrot Top fighting Regis Philbin. Although Regis doesn't suddenly appear when I make a wrong turn.

  • by JayBlalock ( 635935 ) on Friday September 19, 2003 @12:46AM (#7001203)
    I was just thinking about this. At this point, pretty much the entire Internet has mobilized to counter their redirection trick. ISPs are getting filters installed, virus software is getting rewritten, ICANN will likely jump into the fray any time now.

    At the rate things are going, in a couple weeks, no one will be able to get to their search engine site at all, whether they want to or not.

    Someone probably deserves recompensation for the hassle, but it's looking like the Internet has proven resilient to even this "high level" attack.

    • by John Paul Jones ( 151355 ) on Friday September 19, 2003 @12:52AM (#7001238)
      Someone probably deserves recompensation for the hassle, but it's looking like the Internet has proven resilient to even this "high level" attack.

      At what cost? Routers are working harder, code has been introduced into core servers that has no technical reason to exist, and an IP address, or possibly a sizeable range of IP addresses are now blacklisted worldwide. Those IPs won't be usable for anything anymore, or at least until we see widespread adoption of IPv6. *cough*

      What the Internet doesn't need is to become even less of an end-to-end transport, less reliable. And we did it to ourselves.

      • by JayBlalock ( 635935 ) on Friday September 19, 2003 @01:00AM (#7001284)
        Oh, I'm not arguing that it doesn't suck and that Verisign didn't do a very, very naughty thing.

        But at the same time, if you take a step back, the rapid mobillization of the response to this is VERY impressive, and the rate at which the Internet is reconfiguring itself to get rid of the trouble is quite amazing.

        Remember, three days ago, people were moaning about how this would be a disaster, DNS would be broken, spam filters would be rendered impotent, etc etc.

        I'm just saying that, objectively, if you look at this sort of like a body repelling a bacterial attack, the rate at which it's been countered is quite amazing, and shows how well the Internet is fundamentally put together.

      • Actually I think the BIND solution, to mark certain zones as "delegation only" is very elegant, and should have been implemented sooner or later anyways. Even without the current abuse it makes sense, and it hardly adds any complexity to the code.

      • At what cost? Routers are working harder, code has been introduced into core servers that has no technical reason to exist, and an IP address, or possibly a sizeable range of IP addresses are now blacklisted worldwide.

        Well, not really. Just that no A records can reliably point into those blocks now, since the "quick fix" that tons of people used just blocked a few subnets owned by verisign. Of course, verisign has bunches of subnets where they can point this thing, and that quick fix is going to expire
  • by Anonymous Coward
    • by umofomia ( 639418 ) on Friday September 19, 2003 @03:52AM (#7001793) Journal
      The parent post may be modded as "Funny" but this actually is a pretty serious cross-site scripting bug introduced by Verisign. This and the hard-coded SMTP replies bug show how little thought Verisign put into the ramafications of their changes. Seriously... if you're gonna hijack the Internet, at least do it right!!
  • by hansoloaf ( 668609 ) <hansoloaf@yahoo. c o m> on Friday September 19, 2003 @12:49AM (#7001222)
    VeriSign spokesperson Brian O'Shaughnessy said the company has not yet seen the lawsuit and that it doesn't comment on pending litigation."
    They should just build an ASIMO robot in the mold of a spokesperson. There would be only 2 lines of code for the robot to speak out everytime they are contacted on a story: "The company has not seen the lawsuit." "No comment" Then we can skip the obligatory spokesperson quote in articles in the future as its' pretty much all they say nowdays.
    • Then we can skip the obligatory spokesperson quote in articles in the future as its' pretty much all they say nowdays.

      Unless you are a SCO spokesperson, then the story would go a little like this:

      VeriSign spokesperson Brian O'Shaughnessy said that the company has discovered that ALL internet addresses belong to them and that everyone else is incroaching on their intellectual property. They are currently selling licenses to use their internet addresses for $699 per subdomain. Once the lawsuit begins, the

  • by ApheX ( 6133 ) on Friday September 19, 2003 @12:50AM (#7001224) Homepage Journal
    My browsers - Firebird and IE both keep history for a few days. It used to be that when i accidentally typed something in and the domain could not be found that it wouldn't be in my history since it wouldn't resolve. Now - thanks to URL resolving my history is gradually starting to fill full of crap. So when im in a hurry and select something out of my history i sometimes end up getting a sitefinder page instead of what I was looking for. ARRRGH.

    Verisign Sucks. They always have and always will.
    • Verisign Sucks. They always have and always will.

      Agreed. I realized this when I got a phone call two weeks after I registered my first domain asking if I needed their 'services' for hosting. Of course, the sales pitch made it sound like my domain would not work without their services.

      I realized this again when I got a letter in the mail telling me to renew a domain b/c it was about to expire. What's the big deal, you say? The domain wasn't registered with them, but they made it sound like if I didn't se

  • by dacarr ( 562277 ) on Friday September 19, 2003 @12:53AM (#7001241) Homepage Journal
    This is a classic example of hypocrisy, but maybe this'll pay off.
  • by bigberk ( 547360 ) <> on Friday September 19, 2003 @12:54AM (#7001245)
    Note the various inaccuracies in the article. First, SiteFinder (despite its name) doesn't "search" for domain or anything; it is simply a wildcard that catches all lookups right on the COM and NET root servers. This is exceedingly simple to setup; there's no 'technology' involved.

    Also, users of course do not get a 404 when a domain doesn't exist. The domain freakin' doesn't exist, so the DNS lookup itself fails (should get NXDOMAIN) and the browser reports an error in domain resolution.

    But this is nice; I want to see all these leeches in the cybersquatting and "World Wide Web" enhancement business pitted against each other.

  • by Tyler Eaves ( 344284 ) on Friday September 19, 2003 @12:55AM (#7001251)
    Yes, it's semi-sleazy, but they don't cybersquat.


    1997 or so: I registered, mainly for use in e-mail

    2000: I let the domain lapse, not really using it, and tired of paying $40 a year or so for it (Hey, registering was expensive in '97!)

    200?: Netster becomes the owner of

    2003: I nicely ask for it back.
    2003: I get my domain back. They didn't even charge me the trasnfer fees.

  • by xenoweeno ( 246136 ) on Friday September 19, 2003 @12:55AM (#7001252)
    I sent an email to various VeriSign addresses about their abuse. Somehow one of them got routed to a Network Solutions drone.

    The drone informed me in a form letter that VeriSign's practices were "well within the guidelines" established by the document Domain Name System Wildcards in Top-Level Domain Zones [].

    After deconstructing this, we are left with: VeriSign is within the guidelines of the document VeriSign wrote on the matter.

  • by ODBOL ( 197239 ) on Friday September 19, 2003 @12:55AM (#7001253) Homepage

    This is a good time to look at Bob Frankston's dotDNS proposal [] for a layer of reliable but meaningless domain names. dotDNS lookups can be made self-verifiable using public-key signatures, but without the costly chain of trust required by DNSSEC methods. The validity of a dotDNS binding can be verified easily by the querier, without relying at all on the server that provided the putative binding.

    dotDNS does not solve the whole problem, since any layer that translates from humanly meaningful names to dotDNS names is still vulnerable to hijacking. But the reliable and verifiable name bindings in dotDNS will make it *much* easier to switch name-resolution services when we are dissatisfied with their policies.

    dotDNS is a cheap and immediately deployable positive step toward fixing the DNS mess, requiring no approval by any central agency. It's time for a visionary sponsor to step forward and just do it.

  • by Pan T. Hose ( 707794 ) on Friday September 19, 2003 @12:56AM (#7001260) Homepage Journal
    Their new ad campaign with naked women [] went too far in my opinion. They were basically asking to be sued. Didn't they think about the children []?
    • by lpontiac ( 173839 ) on Friday September 19, 2003 @01:59AM (#7001487)
      Nice injection attack. Hmm, I wonder if feeding such a URL to a censorware site could get all of in some blacklists?
  • by Anonymous Coward on Friday September 19, 2003 @12:58AM (#7001270)
    The Electronic Communication Privacy Act (ECPA) [] provides that "any person who intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication; . . .shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5).

    wherein, "intercept" means the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device;

    The ECPA also provides that "In a civil action under this section, appropriate relief includes--(1) such preliminary and other equitable or declaratory relief as may be appropriate;(2) damages under subsection (c); and (3) a reasonable attorney's fee and other litigation costs reasonably incurred.

    Damages.--The court may assess as damages in a civil action under this section the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than the sum of $1,000.

    Seems like a good case can be that emails to mistyped addresses are being intercepted by Verisign. Certainly, the emails where not intended to be sent to Verisign, and they appear to be collecting some information from the email (the from address).

  • by dmiller ( 581 ) <> on Friday September 19, 2003 @12:59AM (#7001274) Homepage
    The enemy of your enemy is not necessarily your friend. Domain and typosquatters are the near bottom of the barrel, just a rung above spammers. Just because they are attacking another bottom-feeder does not make them heros.
  • Verisign delusional (Score:5, Interesting)

    by SnowWolf2003 ( 692561 ) on Friday September 19, 2003 @01:00AM (#7001282)
    In this article on on CNET [] O'Shaughnessy said "the service has been embraced by end users. "We've seen nothing but very positive results from the Internet community," he said. "Usage is extraordinary. Both individual users and enterprises are giving very positive feedback."

    So they are attributing a slashdotting, and a lot of media interest to people being positive about the service. I haven't seen one article, comment or anything that was even remotely positive. What are these guys on?

    He also claims they are fully compliant with every RFC. I don't see how this is possible, unless they have found some loophole.
  • by KalvinB ( 205500 ) on Friday September 19, 2003 @01:04AM (#7001302) Homepage
    If putting in

    would list

    as a suggested site. But it doesn't. It lists a number of domains that are off quite a few letters more than 1.

    If it were at least making an intelligent attempt at getting the user where they wanted to go it could be argued that it is at least useful. Microsoft's search that comes up when you get a DNS error on some domain names is excellent about getting you where you actually wanted to go.

    Verisign either gives a half assed attempt at correcting the user or deliberatly ignores domains that aren't registered through them. Despite the fact they get money regardless of who you register through.

    Now we just need a credible plaintiff. Preferably a class action suit to maximize damages.

  • Right... (Score:5, Funny)

    by Anonymous Coward on Friday September 19, 2003 @01:10AM (#7001319)
    So if we're really lucky, just as the guilty verdict is being read, with the upper level management of both companies present...that asteroid that everyone said was going to destroy civilization twelve years from now, will crash in down on the courthouse, ionizing not only the leadership of both companies, but several ragged hordes of killer attack lawyers as well.

    Then when the press questions the astronomers on how their orbital calculations could have been so wrong, the astronomers (being the clever guys they are) will say, "but are calculations were right!" and then erupt in maniacal laughter.

    I for one welcome our new...[looks up at the sky]...never mind, I didn't start to say anything. Nope, nothing at all.
  • by mabu ( 178417 ) on Friday September 19, 2003 @01:17AM (#7001346)
    First off, the idea that Verisign can appropriate unregistered domains represents a huge conflict of interest with its management of the TLDs. Nobody should be able to reassign IPs for non-registered domains. This undermines the whole system, which has facilities to address this situation.

    The fact that ICANN didn't block this move is further evidence than this organization is totally useless and political.

    Along the same vein, I disagree with MS's misleading implementation of the IP-not-found error page to redirect users to their proprietary search engine.

    The Internet community should rally against any entity that seeks to appropriate undefined address space for their own gain.

    If Verisign is allowed to do this, what we're likely to see is each major ISP and browser manufacturer follow suit and hijack undefined space to promote their own systems.

    Imagine if you dialed a wrong number on the telephone and you got an advertisement for the phone company. What if local broadcasters bombarded all the unused frequency spectrum with their own promotions.

    This has less to do with Verisign than it does to protect the sanctity of null space.

    It makes me wonder if someone has a patent on silence yet?
  • by curtlewis ( 662976 ) on Friday September 19, 2003 @01:28AM (#7001394)
    Companies to boycott:

    SCO (need you ask?)
    Verisign (screwed by em long before this)
    SBC (for not blocking Verisign)
    Microsoft (ya just gotta)
    RIAA (You don't sue your customers. Solve the problem!)
    Sun (for the abomination called Java)
    Gray Davis (because he DOES suck)
    Cruz Bustamante (Don't give him a CHANCE to suck)

    Note to self:
    Get more RAM for Notes to self
  • Funny Stuff (Score:3, Funny)

    by NeoGeo64 ( 672698 ) on Friday September 19, 2003 @01:36AM (#7001423) Homepage Journal []

    "We didn't find"
    "There is no web site at this address."

    Only in a perfect world...
  • by consumer ( 9588 ) on Friday September 19, 2003 @01:40AM (#7001434)
    Has anyone else noticed this? It returns a sitefinder page immediately for, but nada for
  • I don't agree (Score:3, Interesting)

    by howhardcanitbetocrea ( 671190 ) on Friday September 19, 2003 @02:01AM (#7001495)
    I notice at the bottom of the sitefinder service page it has a "terms of service" link. I hereby declare that I do not agree to those terms of service. Now what? Do I stop getting redirected to that page?
  • by dmehus ( 630907 ) on Friday September 19, 2003 @02:24AM (#7001565) Homepage
    Full details of the lawsuit are available in this press release: ?epi-content=GENERIC&newsId=20030918005730&newsLan g=en&beanID=478837757&viewID=news_view []

    Copy of lawsuit: []

    Sorry, I forgot to include these links in my submission. Post away!

  • by AntiOrganic ( 650691 ) on Friday September 19, 2003 @02:26AM (#7001574) Homepage
    I truly thank VeriSign's lovely spam service.

    Someone a few months ago mentioned to me that Sendmail has a feature where, upon receiving mail, it will check the domain of the sender. If the domain does not exist, it has a forged From: header and is obviously spam.

    Thanks to Verisign's efforts to piss me off, every DNS query on a nonexistant .com domain or .net domain is returning an SOA record and none of these messages are being blocked.

    Since this "service" has been implemented, I've gone from 7-8 spams a day to 30-35.

    Thanks a lot, assholes.
  • Terms of Us (Score:4, Interesting)

    by flakac ( 307921 ) on Friday September 19, 2003 @02:58AM (#7001650)
    Never thought it'd happen, but I'm rooting for the squatter... if there's a group worse than spammers and domain squatters, it's Verisign. Just on a whim, I typed in a non-existent domain name, and sure enough, found myself on their page. Take a look at the "Terms of Use" []. Sections 2 and 14 are really telling:

    2. You may have accessed the VeriSign Service(s) by initiating a query to our DNS resolution service for a nonexistent domain name.
    14. By using the service(s) provided by VeriSign under these Terms of Use, you acknowledge that you have read and agree to be bound by all terms and conditions here in and documents incorporated by reference.

    I'm not sure how the came up with the fact that I, the end user, made a query to their DNS server. In fact, I did not. My ISP may be using their services, but I personally have no legal relationship with Verisign whatsoever. My ISP may be using their services, but that in no way establishes a relationship between myself and Verisign. IMO, unless you're querying Verisign directly, their terms of use cannot possibly apply -- which means that they apply to almost noone. I would challenge them to show any log that shows my IP address accessing their service. If they can't, then I did not in fact access their service.

    And what's worse is the implication that I can bound by "Terms of Use" that I have never seen, based on the assumption that I made the query, when in fact the query mas made to a DNS server at my ISP (and again, I don't really care how my ISP handles that request as long as it sends me the requested info.
  • by flakac ( 307921 ) on Friday September 19, 2003 @03:15AM (#7001699)
    From the article:

    Typically, Internet users are shown a generic "404 -- cannot be found" page when a Web address does not exist.

    Sooooo, if the web server can't be found, who's sending the HTTP 404 response (which incidentally means that a file on a server doesn't exist...)?
  • by fishbowl ( 7759 ) on Friday September 19, 2003 @03:17AM (#7001702)
    Why didn't this info leak before VS turned on the switch? That's the most surprising thing about the whole deal to me.

    The backlash against VS should have started BEFORE they went through with this decision -- and that backlash should have been OVERWHELMING, as in, every sysadmin with DNS should have been complaining, ISP's should have been filing motions for restraining orders, and ICANN should have been ready to pull the gTLD contract once and for all.

  • Alexa (Score:3, Informative)

    by Anonymous Coward on Friday September 19, 2003 @03:30AM (#7001741)
    Alexa Page Ranking, another insidious tool, lists Verisign Pagefinder as the number one Website in new Hits, up 1360 % on the week
  • by thomas_klopf ( 672359 ) on Friday September 19, 2003 @03:53AM (#7001797)
    When Verisign was given the authority to manage DNS for these TLDs, they were given this responsibility with the public trust.. The public trusted them NOT to do things exactly like this. You should do DNS, and that's it - nothing more, nothing less. In return, Verisign was given a source of income. I think that if Verisign continues in this way, it may be time to take back this thing entrusted to them. This has become yet another disaster in "privatization", and we should maybe consider moving this service back to the "public" sector (as much as it can be...).
  • Interesting point... (Score:4, Interesting)

    by Morden ( 15788 ) on Friday September 19, 2003 @03:56AM (#7001803)
    One comment I've seen noted about the whole SiteFinder thing is that Verisign now resolves domains which are not available for registration, so it's possible they're profiting from something that they're not allowing others to purchase.

    (Try,, etc ... you can't buy single character gTLDs)
  • by XNormal ( 8617 ) on Friday September 19, 2003 @05:23AM (#7002115) Homepage
    You may have accessed the VeriSign Service(s) by initiating a query to our DNS resolution service for a nonexistent domain name. We are unable to resolve such queries through the DNS resolution service.

    They are, and they do. They resolve such queries to
  • by royles ( 461766 ) on Friday September 19, 2003 @05:58AM (#7002209) Homepage
    I have simply sent them an email and more importantly a 'letter' that informs Verisign that I do not accept their terms of service and that I am seeking their advice on how to stop making use of their software, considering I do not meet their terms of service.

    I have informed them that if they cannot stop providing me with this service, (for which I do not accept their terms, and by which I cannot be bound) then they will have to contact me to negotiate a new set of terms to which I do agree.

    I would imagine that if every user that is upset by this new 'service' was to do the same then Verisign would have to do 'something' about it.
  • by johnraphone ( 624518 ) on Friday September 19, 2003 @06:02AM (#7002216) Homepage
  • by Harald Paulsen ( 621759 ) * on Friday September 19, 2003 @07:45AM (#7002464) Homepage
    Tried [] or [] lately? Other TLDs have had this for years, yet noone has complained about them. I'm all for stopping what VeriSign is doing now, but we should round up ALL the guilty parts while we're at it.
  • by tbase ( 666607 ) on Friday September 19, 2003 @08:27AM (#7002663)
    I registered a domain name last night for the girl who took our wedding photos. I paid for it, filled out the info, and now when I go there, I get ads for her competition. If that isn't an unfair business practice, I don't know what is.
  • by chongo ( 113839 ) * on Friday September 19, 2003 @08:52AM (#7002814) Homepage Journal
    n addition to a number of already posted suggestions, I recommend that you call Verisign and file a complain:

    +1 703-742-0914 (worldwide)
    +1 888-642-9675 (toll free US/Canada)

    When you call, select:

    * 1 (purchase an product or renew an exist product)
    * then 7 (all other questions)

    I recommend that you be patient with the Verisign rep that answers the phone. That person may not fully understand the issue / problem, and they are unlikely to personally be responsible for the Verisign decision. Remember that you are objecting what Verisign as a company is doing. Don't yell at the rep. Be polite but firm.

    Ask Verisign to stop the wildcarding now. Explain why what they are doing is wrong (such as being unable to determine of a EMail message is being sent from a bogus / non-existent domain because resolves to

    If you do business with Verisign now, tell them that you will switch vendors unless Verisign stops this practice in X weeks. (fill in the X)

    You might want to leave your phone number and request a callback. Anonymous complaints do not go as far.

    If you are in the US, you might want to contact your local member of congress and object about what Verisign is doing. Let Verisign know that you are doing this when you call.

    Yes, they might flush your complaint down /dev/null. But I suspect that pressure from all fronts might help. I have been told (off the record) that some people within Verisign are not happy with their wildcarding. Complaints get logged into a database that these people can review. Your complaints, in volume, might help those folks make a stronger case against top-level wildcarding.
    • I called them just now and basically said the stuff above. I own a few domain names bought from them, and will be transferring them to another provider. When I told them why, they read off a script that told me why their service was so great. Here's their answers and my responses:

      "Before, the user would get an unhelpful error message. Now, users always know where to go!"

      "That's good on paper, but the problem is that DNS is an inappropriate area to conduct that redirection. Yahoo or are w

  • by chongo ( 113839 ) * on Friday September 19, 2003 @09:26AM (#7003063) Homepage Journal
    In addition to signing the:
    online petition []

    you can file a complaint about Verisign to ICANN by using their:

  • by analog_line ( 465182 ) on Friday September 19, 2003 @10:55AM (#7003927)
    While I'm appalled at VeriSign's rank power grab, it's probably done me, personally, more good than harm Why you ask? Well, I took the time to get up to speed on BIND 9 and am running my office/home DNS on local machines, and uitilizing the code that blocks Verisign's hijacking attempt from affecting me.

    Now I can charge my clients for setting up a DNS server on their local networks on any spare crap machine they have lying around, making their networks more resilient to ISP DNS outages and crap like this.

    Now I have every excuse I might need to move all my clients name registrations to another registrar ASAP, and all the reason I need to not use VeriSign, or be plagued by their idiot customer service ever again!

    Thank you Verisign, for teaching me how to laugh about love...again.

"The way of the world is to praise dead saints and prosecute live ones." -- Nathaniel Howe