<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Danny,<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Feb 25, 2022, at 2:14 PM, Danny McPherson <<a href="mailto:danny@tcb.net" class="">danny@tcb.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: CourierNewPSMT; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I suppose the author of those comments would also say that ignoring the plausibility of said exfiltration _until someone has made money off the domain sale (i.e., TLD delegated, traffic analyzed, domain registered, registrant does whatever they want, etc..) might well be convenient, but I'm not sure it's what responsible or good looks like.</span><br style="caret-color: rgb(0, 0, 0); font-family: CourierNewPSMT; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote></div><br class=""><div class="">Are you suggesting that the issue of exfiltration via ECI should be ignored until there is demonstrated harm?</div><div class=""><br class=""></div><div class="">Your comments above don’t appear to align with Verisign’s public comment submission <a href="https://forum.icann.org/lists/comments-name-collision-26feb14/pdfTWUAZM3gBN.pdf" class="">Additional Comments on “Mitigating the Risk of DNS Namespace Collisions” Phase One Report</a>, which reads:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">Verisign maintains its position that directing requesters to an internal address during the controlled interruption period is preferable to an external honeypot, because as previously stated, it avoids “controlled exfiltration” where sensitive traffic from an installed system – without the advance consent of the user or system administrator – may be drawn outside the local network.</blockquote></div><div class=""><br class=""></div><div class="">Am I not understanding something?</div><div class=""><br class=""></div><div class="">Matt (L.)</div><div class=""><br class=""></div></body></html>