<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Mar 2, 2023, at 11:42 AM, Jeff Schmidt <<a href="mailto:jschmidt@jasadvisors.com" class="">jschmidt@jasadvisors.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> Are users likely to see those “breadcrumbs” and thus actually use them?</span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> No.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">One of our areas of disagreement is that (IMO) you overestimate the “notification effectiveness” of the honeypot approach and underestimate the notification effectiveness of CI. Because very little of the colliding traffic is actually browser-y, and all modern browsers will prefer https, it is extremely, extremely unlikely that *<b class="">any</b>* end users in normal course will actually see the honeypot content. Both Casey and I have written about this ad nauseum. We are therefore left to communicate with administrators through logs.</span></div></div></div></blockquote><div><br class=""></div>+1</div><div><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><br class=""><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> When I define user I’m imagining an actual physical person.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> The question, in my mind, is whether or not that actual physical<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> person is going to understand what is happening when a name<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> collision happens and thus be able to take direct action to resolve<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> the “problem” they are having.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">I agree with you, “Mabel in Accounting” is not the intended audience for the notification. The intended audience is some IT guy or gal that has a chance of understanding the problem and fixing it. That’s how I define “user.”<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Those are the very people that search google,<span class="Apple-converted-space"> </span><a href="http://stackoverflow.com/" style="color: blue; text-decoration: underline;" class="">stackoverflow.com</a>,<span class="Apple-converted-space"> </span><a href="http://serverfault.com/" style="color: blue; text-decoration: underline;" class="">serverfault.com</a>, etc, and are most likely to benefit from the tens of thousands of references therein. These are the people that start looking at logs when things break – thus the “interrupt and communicate through logs” approach.</span></div></div></blockquote><div><br class=""></div>+1 </div><div><br class=""><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">If you drill into the “google 127.0.53.53” experience – as this group did in NCAP Study 1, and as JAS did in our “Phase 2 report” – we see evidence that this does indeed happen. Those people are getting both the notification and the information they need. There are many, many, many more examples of this desired experience than the microscopic sample of people that filled-out the ICANN form claiming otherwise. (Notwithstanding the fact that they probably found ICANN and the form by Google!)</span></div></div></blockquote><div><br class=""></div><div>There is clear evidence that "127.0.53.53" is being found. In addition to the NCAP Study 1 and the JAS "Phase 2 report", the root cause analysis report [1] also discusses this in sections 4.4 (Root Cause Identification of Name Collisions Reports) and 5 (Web Search Results Analysis). However, these data points are biased because they don't tell us anything about those that experienced collisions and did *not* observe 127.0.53.53. That was the point of the survey. Nonetheless, I do not believe that either of these results can or should be looked at in isolation. There are a lot of Web results, but they are biased. The survey results are not biased (at least not in the same way) - but they are fewer. Both data sets need to be considered!</div><br class=""><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Again, I’m all for notification. Notification is a Very Good Thing. We all want that. The disagreement is about whether the *<b class="">effectiveness</b>* of the notification may be improved. Given DNS has no end user signaling channel, we’re all being creative to layer on these sorts of comms in “clever” ways. It will be a risk-reward balancing act.</span></div></div></blockquote><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> that are certainly no worse than CI and absolutely improve its effectiveness<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> in response to the changed DNS infrastructure of today. You may have a<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">> different opinion.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">I strongly object to blanket statements like this. “Absolutely improve its effectiveness” is objectively false. Hoping real hard that it’s an improvement - without facts or operational experience - does not equate to such a disingenuous and completely unsupported blanket statement. I don’t know how we’re still saying things like this as a group – if you don’t like or believe the JAS, Verisign, and Casey commentary on this. . . I’m not sure how to help.</span></div></div></blockquote><div><br class=""></div><div>And this is the point. There are pros and cons to each of the proposed methods. Each of the following was created to objectively evaluate these points, so we could get out of the business of making general statements about "improvements" without any qualification:</div><div><br class=""></div><div>1) Jeff's slides (attached to the previous email);</div><div>2) the comparison doc [2] (now part of the sections 1-3 doc [3]); and</div><div>3) my Feb 16 email [4]</div><div><br class=""></div><div>In fact, this question was raised in the NCAP meeting of May 18, 2022 [5] (and probably others) because it was such a notable gap in the decision-making and consensus-building process. See time 49:00 and onward, in particular. Among the notable quotes (transcribed):</div><div><br class=""></div><div>"we are going to do those comparisons I do want to pull in data and references as much as possible to drive what we're doing going forward."</div><br class=""><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1;"><div class="" style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 11pt;"><o:p class=""></o:p></span></div></div></blockquote><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">CI is an imperfect solution to a problem for which there are no perfect solutions. Try as we may, we have yet to identify an objectively superior solution to CI.</span></div></div></blockquote><div><br class=""></div><div>Perhaps. But to be more precise, I would say: "... a solution for which the collective benefits outweigh the costs, all things categorically considered."</div><div><br class=""></div><div>Even so, in my Feb 16 email [4], I proposed a compromise with risks "somewhere in between those of controlled interruption and active collision assessment," the intent of which is to "[address] some of the deficiencies of the alerting mechanisms from the 2012 round (i.e., controlled interruption exclusively) at a much lower cost of security/privacy/user experience than active collision assessment." There have been no additional comments.</div><div><br class=""></div><div>And also, as stated in that email: "I oppose active collision assessment, as currently defined. There are too many unknowns associated with security, privacy, and user experience concerns."</div><div><br class=""></div><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 10pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Slide 1 of my comparison deck (re-attached here, first shared with NCAP in Feb 2022 and largely ignored) would be good content for the NCAP report. Also see Casey’s 2/16/23 email to the list, which is clear and well-reasoned. In my opinion, this group needs to debate the *<b class="">facts</b>* of the attached and Casey’s recent 16 Feb email. Upon agreement of baseline facts, we can consider paths forward. In the current state where factions are operating from different facts, consensus on the path forward is impossible.</span></div></div></blockquote><div><br class=""></div>+1</div><div><br class=""></div><div>Casey<br class=""><div><br class=""></div><div><br class=""></div><div><br class=""></div>[1] <a href="https://docs.google.com/document/d/1YSvdH9Slws0iW3e6yoS04s5zANBnyMMFn9DUNE19fkg/edit" class="">https://docs.google.com/document/d/1YSvdH9Slws0iW3e6yoS04s5zANBnyMMFn9DUNE19fkg/edit</a></div><div>[2] <a href="https://docs.google.com/document/d/14g4hp_BlosWQJ6-otygww9OHmu1C0GCHIMyfsinbqOE/edit" class="">https://docs.google.com/document/d/14g4hp_BlosWQJ6-otygww9OHmu1C0GCHIMyfsinbqOE/edit</a></div><div>[3] <a href="https://docs.google.com/document/d/13SQnZt1HHeD9i1cSds-kj16mxRQgxp6hpb2K1kLqB1U/edit" class="">https://docs.google.com/document/d/13SQnZt1HHeD9i1cSds-kj16mxRQgxp6hpb2K1kLqB1U/edit</a></div><div>[4] <a href="https://mm.icann.org/pipermail/ncap-discuss/2023-February/001105.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2023-February/001105.html</a></div><div>[5] <a href="https://community.icann.org/pages/viewpage.action?pageId=197264149" class="">https://community.icann.org/pages/viewpage.action?pageId=197264149</a></div></body></html>