Software Released To Neutralize Verisign Typosquatting
by Anick Jesdanun
The developer of software that essentially guides Web surfers sought Tuesday to neutralize a controversial service designed to help users who mistype Internet addresses.
The Internet Software Consortium, the nonprofit organization that develops BIND software for Internet domain name directories, is writing an "urgent patch" for Internet service providers and others who want to block customers from a new Site Finder service from VeriSign Inc.
VeriSign, which keeps the master lists of names ending in ".com" and ".net," launched Site Finder on Monday to steer users to likely alternatives when they type addresses for which no Web site exists.
Though VeriSign gets unspecified revenues from search engine partners whose technology powers Site Finder, company officials described the service as primarily a navigation tool to help lost Internet users.
Critics, however, say the service eliminates user choice, gives a private company too much control over online commerce and could violate longstanding Internet standards.
VeriSign's service, which affects only ".com" and ".net" names, also overrode similar services offered by several Internet service providers, including America Online, and through Microsoft Corp.'s Internet Explorer browser.
The BIND patch allows AOL and others to restore control by identifying and then ignoring data from Site Finder, said Paul Vixie, president of the Internet Software Consortium.
When the patched software receives such data, it will instead pass along an "address not found" message.
"We're making this patch available because our customers are screaming for it," Vixie said.
Though running the software update is optional, Vixie expects many customers will. The consortium was testing the patch Tuesday and planned to release it by Wednesday.
VeriSign officials did not immediately return calls Tuesday. On Monday, its vice president for naming services, Ben Turner, said service providers were free to configure their systems so customers would bypass Site Finder.
BIND, a free product, is used by most domain name servers at service providers, corporations and other networks. Typically, those servers keep temporary copies of the master directories obtained from VeriSign.
VeriSign estimates that people mistype ".com" and ".net" names some 20 million times daily and cites internal studies showing users prefer navigational help over a generic error message.
Earlier this year, a suburban Washington company called Paxfire Inc. tested a similar service for ".biz" and ".us" names, but the U.S. government and a private oversight board asked Paxfire to suspend it after a few weeks pending a review, Paxfire chairman Mark Lewyn said.
A similar feature exists with ".museum" names. People who type in nonexistent addresses are offered an index of museum sites.