<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">We are stuck in a Groundhog Day cycle of re-litigation on ancient issues.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Some suggest (repeatedly) that Controlled Interruption was designed the way it was because we don’t like data and honeypots (redirecting colliding lookups to some Internet host controlled by “good guys”) would
generate the data panacea we always wanted but never had. Suddenly all of our questions would be answered, toast would never burn, and the coronavirus would be cured. This is wrong. Honeypots create significant new risks; we concluded that the risks created
by a honeypot approach were worse than the rewards and suggested (Recommendation 12) alternative approaches to gathering more data. This issue was discussed extensively in the JAS Phase 2 report.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Verisign in their public comments, agreed with us (quoting from Section 2 of their comment to the JAS Phase 2 Report):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><Verisign quote><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Verisign maintains its position that directing requesters to an internal address during the controlled interruption period is preferable to an external honeypot, because as previously stated, it avoids “controlled
exfiltration” where sensitive traffic from an installed system – without the advance consent of the user or system administrator – may be drawn outside the local network. This risk is acknowledged in Google Registry’s comments advocating for the external honeypot
[5]: <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">“Unfortunately, some protocols will send sensitive information unsolicited (e.g., login.example/login.php?user=fred and HTTP cookies). The honeypot will specifically not log this sort of information, but this
doesn't change the fact that the information has been communicated over the Internet.”
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"></Verisign quote><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="https://forum.icann.org/lists/comments-name-collision-26feb14/pdfTWUAZM3gBN.pdf">https://forum.icann.org/lists/comments-name-collision-26feb14/pdfTWUAZM3gBN.pdf</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Please refer to section 3.1.6 “Alternatives to Controlled Interruption” for a detailed discussion of Honeypot (Section 3.1.8) (and other) approaches:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="https://www.icann.org/en/system/files/files/name-collision-mitigation-final-28oct15-en.pdf">https://www.icann.org/en/system/files/files/name-collision-mitigation-final-28oct15-en.pdf</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Jeff<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>