The public domain is a range of abstract materials—commonly referred to as intellectual property—which are not owned or controlled by anyone. The term indicates that these materials are therefore "public property", and available for anyone to use for any purpose. The public domain can be defined in contrast to several forms of intellectual property; the public domain in contrast to copyrighted works is different from the public domain in contrast to trademarks or patented works. Furthermore, the laws of various countries define the scope of the public domain differently, making it necessary to specify which jurisdiction's public domain is being discussed.
The public domain is most often discussed in contrast to works whose use is restricted by copyright. Under modern law, most original works of art, literature, music, etc. are covered by copyright from the time of their creation for a limited period of time (which varies by country). When the copyright expires, the work enters the public domain. It is estimated that currently, of all the books found in the world's libraries, only about 15% are in the public domain, even though only 10% of all books are still in print; the remaining 75% are books which remain unavailable because they are still under copyright protection.[1]
The public domain can also be defined in contrast to trademarks. Names, logos, and other identifying marks used in commerce can be restricted as proprietary trademarks for a single business to use. Trademarks can be maintained indefinitely, but they can also lapse through disuse, negligence, or widespread misuse, and enter the public domain. It is possible, however, for a lapsed trademark to become proprietary again, leaving the public domain.
The public domain also contrasts with patents. New inventions can be registered and granted patents restricting others from using the inventions without permission from the inventor. Like copyrights, patents last for a limited period of time, after which the inventions covered by them enter the public domain and can be used by anyone.
No legal restriction on use
A creative work is said to be in the public domain if there are no laws which restrict its use by the public at large. For instance, a work may be in the public domain if no laws establish proprietary rights over the work, or if the work or its subject matter are specifically excluded from existing laws.
Because proprietary rights are founded in national laws, an item may be public domain in one jurisdiction but not another. For instance, some works of literature are public domain in the United States but not in the European Union and vice versa.
The underlying idea that is expressed or manifested in the creation of a work generally cannot be the subject of copyright law (see idea-expression divide). Mathematical formulæ will therefore generally form part of the public domain, to the extent that their expression in the form of software is not covered by copyright; however, algorithms can be the subject of a software patent in some jurisdictions.[2][3]
Works created before the existence of copyright and patent laws also form part of the public domain. For example, the Bible and the inventions of Archimedes are in the public domain, but copyright may exist in translations or new formulations of these works.
Although "intellectual property" laws are not designed to prevent facts from entering the public domain, collections of facts organized or presented in a creative way, such as categorized lists, may be copyrighted. Collections of data with intuitive organization, such as alphabetized directories like telephone directories, are generally not copyrightable. In some countries copyright-like rights are granted for databases, even those containing mere facts.
Works of the United States Government and various other governments are excluded from copyright law and may therefore be considered to be in the public domain in their respective countries.[4] In the United States, when copyrighted material is enacted into the law, it enters the public domain. Thus, the building codes, when enacted, are in the public domain.[5] They may also be in the public domain in other countries as well. "It is axiomatic that material in the public domain is not protected by copyright, even when incorporated into a copyrighted work."[6]
[edit] Expiration
In most countries, the term for patents is 20 years, after which the invention becomes part of the public domain.
A trademark registration may remain in force indefinitely, or expire without specific regard to its age. For a trademark registration to remain valid, the owner must continue to use it. In some circumstances, such as disuse, failure to assert trademark rights, or common usage by the public without regard for its intended use, it could become generic, and therefore part of the public domain.
The expiration of a copyright is more complex than that of a patent. Historically the United States has specified terms of a number of years following creation or publication; this number has been increased several times. Most other countries specify terms of a number of years following the death of the last surviving creator; this number varies from one country to another (50 years and 70 years are the most common), and has also been increased in many of them. See List of countries' copyright length. Legal traditions differ on whether a work in the public domain can have its copyright restored. Term extensions by the U.S. and Australia generally have not removed works from the public domain, but merely delayed the addition of works to it. By contrast, a European Union directive harmonizing the term of copyright protection was applied retrospectively, restoring and extending the terms of copyright on material previously in the public domain.
[edit] United States law
Copyright law in the United States has changed several times. Although it is held under Feist v. Rural that Congress does not have the power to re-copyright works that have fallen into the public domain, re-copyrighting has happened: "After World War I and after World War II, there were special amendments to the Copyright Act to permit for a limited time and under certain conditions the recapture of works that might have fallen into the public domain, principally by aliens of countries with which we had been at war."[7]
Works "prepared by an officer or employee of the U.S. government as part of that person's official duties" are automatically in the public domain by law.[8] Examples include military journalism, federal court opinions (but not necessarily state court opinions), congressional committee reports, and census data. However, works created by a contractor for the government are still subject to copyright. Even public domain documents may have their availability limited by laws limiting the spread of classified information.
At most, terms end 120 years after publication in the United States, but they may end or have already ended sooner in certain situations.[9]
[edit] Since 1978
A work that is created (i.e. fixed in tangible form for the first time) after January 1, 1978, is automatically protected from the moment of its creation and is given a term lasting for the author’s life, plus an additional 70 years after the author’s death. In the case of “a joint work prepared by two or more authors who did not work for hire,” the term lasts for 70 years after the last surviving author’s death. For works made for hire, and for anonymous and pseudonymous works (unless the author’s identity is revealed in Copyright Office records), the duration of copyright will be 95 years from first publication or 120 years from creation, whichever is shorter.
Before 1978, unpublished works were not covered by the federal copyright act. Rather, they were covered under (perpetual) common law copyright. The Copyright Act of 1976, effective 1978, abolished common law copyright in the United States so that all works, published or unpublished, are now covered by federal statutory copyright, with the exception of sound recordings fixed before February 15, 1972.[10] The claim that "pre-1923 works are in the public domain" is correct only for published works; unpublished works are under federal copyright for at least the life of the author plus 70 years. For a work made for hire, the copyright in a work created before 1978, but not theretofore in the public domain or registered for copyright, subsists from January 1, 1978, and endures for a term of 95 years from the year of its first publication, or a term of 120 years from the year of its creation, whichever expires first.[11] If the work was created before 1978 but first published 1978–2002, the federal copyright will not expire before 2047.
Until the Berne Convention Implementation Act of 1988, the lack of a proper copyright notice would place an otherwise copyrightable work into the public domain, although for works published between January 1, 1978 and February 28, 1989, this could be prevented by registering the work with the Library of Congress within five years of publication. After March 1, 1989, an author's copyright in a work begins when it is fixed in a tangible form; neither publication nor registration is required, and a lack of a copyright notice does not place the work into the public domain.[12]
[edit] 1964 to 1977
Works published with notice of copyright or registered in unpublished form in the years 1964 through 1977 automatically had their copyrights renewed for a second term.
[edit] Before 1964
Works published with notice of copyright or registered in unpublished form on or after January 1, 1923, and prior to January 1, 1964, had to be renewed during the 28th year of their first term of copyright to maintain copyright for a full 95-year term.[13]
With the exception of maps, music, and movies, the vast majority of works published in the United States before 1964 were never renewed for a second copyright term.[14]
[edit] Sound recordings
Very few sound recordings are in the public domain in the United States. Sound recordings fixed in a tangible form before February 15, 1972, have been generally covered by common law or in some cases by anti-piracy statutes enacted in certain states, not by federal copyright law, and the anti-piracy statutes typically have no duration limit. The 1971 Sound Recordings Act, effective 1972,[15] and the 1976 Copyright Act, effective 1978, provide federal copyright for unpublished and published sound recordings fixed on or after February 15, 1972. Recordings fixed before February 15, 1972, are still covered, to varying degrees, by common law or state statutes.[10][16] Any rights or remedies under state law for sound recordings fixed before February 15, 1972, are not annulled or limited by the 1976 Copyright Act until February 15, 2067.[17] On that date, all sound recordings fixed before February 15, 1972, will go into the public domain in the United States.
For sound recordings fixed on or after February 15, 1972, the earliest year that any will go out of copyright and into the public domain in the U.S. will be 2043,[18] and not in any substantial number until 2048.[19] Sound recordings fixed and published on or after February 15, 1972, and before 1978, which did not carry a proper copyright notice on the recording or its cover entered the public domain on publication.[20] From 1978 to March 1, 1989 the owners of the copyrights had up to five years to remedy this omission without losing the copyright.[21] Since March 1, 1989, no copyright notice has been required.[22]
[edit] British law
British government works are restricted by either Crown copyright or Parliamentary copyright. Published Crown copyright works become public domain at the end of the year 50 years after they were published, unless the author of the work held copyright and assigned it to the Crown. In that case, the copyright term is the usual life of author plus 70 years. Unpublished Crown copyright documents become public domain at the end of the year 125 years after they were first created. However, under the legislation that created this rule, and abolished the traditional common law perpetual copyright of unpublished works, no unpublished works will become public domain until 50 years after the legislation came into effect. Since the legislation became law on August 1, 1989, no unpublished works will become public domain under this provision until 2039. Parliamentary copyright documents become public domain at the end of the year 50 years after they were published. Crown copyright is waived on some government works provided that certain conditions are met.
[edit] Laws of Canada, Australia, and other Commonwealth nations
These numbers reflect the most recent extensions of copyright in the United States and Europe. Canada and New Zealand have not, as of 2009[update], passed similar twenty-year extensions. Consequently, their copyright expiry times are still life of the author plus 50 years. Australia passed a 20-year copyright extension in 2004, but delayed its effect until 2005, and did not make it revive already-expired copyrights. Hence, in Australia works by authors who died before 1955 are still in the public domain.
As with most other Commonwealth of Nations countries, Canada and Australia follow the general lead of the United Kingdom on copyright of government works. Both have a version of Crown Copyright which lasts for 50 years from publication. New Zealand also has Crown copyright, but has a much greater time length: at 100 years from the date of publication.
Photographs taken before 1955 are now out of copyright in Australia.[23]
[edit] Thai law
According to Thai copyright law, the copyright term is the life of author plus 50 years.[24] When the author is a legal entity or an anonymous person, the copyright term is 50 years from the date of publication. Works of applied art (defined as a work which takes a composition of works such as drawings, paintings, sculpture, prints, architecture, photography, drafts, and models for utility or functional use) have a copyright term of 25 years from publication.[25] Republication of works after the expiration of the copyright term does not reset the copyright term. Thai state documents are public domain,[26] but creative works produced by or commissioned by government offices are protected by copyright.[27]
[edit] Japanese law
Japanese copyright law does not mention public domain. Hence, even when some materials are said to be "in the public domain" there can be some use restrictions. In that case, the term copyright-free is sometimes used instead.
Many pre-1953 Japanese and non-Japanese films are considered to be in the public domain in Japan.[28]
[edit] Examples
The most basic example of what is in the public domain are works such as national anthems and traditional songs such as "Auld Lang Syne."
In the United States, the images of Frank Capra's film, It's a Wonderful Life (1946) entered into the public domain in 1974, because the copyright holder failed to file a renewal application with the Copyright Office during the 28th year after the film's release or publication. However in 1993, Republic Pictures utilized the 1990 United States Supreme Court ruling in Stewart v. Abend to enforce its claim of copyright because the film was a derivative work of a short story that was under a separate, existing copyright, to which Republic owned the film adaptation rights, effectively regaining control of the work in its complete form.[29]
Charles Chaplin re-edited and scored his 1925 film The Gold Rush for reissue in 1942. Subsequently, the 1925 version fell into the public domain when Chaplin's company failed to renew its copyright in 1953, although the 1942 version is still under US copyright.[30]
The distributor of the cult film Night of the Living Dead, after changing the film's title at the last moment before release in 1968, failed to include a proper copyright notice in the new titles, thereby immediately putting the film into the public domain after its release.[31] This provision of US copyright law was revised with the United States Copyright Act of 1976, which allowed such negligence to be remedied within five years of publication.[32]
Some works may never fully lapse into the public domain. A perpetual crown copyright is held for the Authorized King James Version of the Bible in the UK.[33] While the copyright of the play Peter Pan, or the Boy Who Wouldn't Grow Up by J. M. Barrie has expired in the United Kingdom, it was granted a special exception under the Copyright, Designs and Patents Act 1988 (Schedule 6)[34] that requires royalties to be paid for performances within the UK, so long as Great Ormond Street Hospital (to whom Barrie gave the rights) continues to exist.
A number of TV series in America have lapsed into the public domain, in whole or only in the case of certain episodes, giving rise to wide distribution of some shows on DVD. Series that have only certain episodes in the public domain include Petticoat Junction, The Beverly Hillbillies, The Dick Van Dyke Show, Bonanza, and Annie Oakley, while Decoy is an example of a series that lies completely within the public domain.[citation needed]
[edit] Disclaimer of interest
Ambox globe content.svg
The examples and perspective in this section may not represent a worldwide view of the subject. Please improve this article and discuss the issue on the talk page. (September 2008)
Laws may make some types of works and inventions ineligible for monopoly; such works immediately enter the public domain upon publication. Many kinds of mental creations, such as publicized baseball statistics, are never covered by copyright. However, any special layout of baseball statistics, or the like, would be covered by copyright law. For example, while a phonebook is not covered by copyright law, any special method of laying out the information would be.
For example: U.S. copyright law, 17 U.S.C. § 105, releases all works created by the U.S. government into the public domain. U.S. patent applications containing a copyright notice must also include a disclaimer of certain exclusive rights as part of the terms of granting the patent to the invention (leaving open the question regarding copyright of patents with no such notice). Agreements that Germany signed at the end of World War I released such trademarks as "aspirin" and "heroin" into the public domain in many areas.
Another example would be Charles Darwin's theory of evolution. Being an abstract idea it has therefore never been patentable. After Darwin constructed his theory, he did not disclose it for over a decade (see Development of Darwin's theory). He could have kept his manuscript in his desk drawer forever but once he published the idea, the idea itself entered public domain. However, the carrier of his ideas, in the form of a book titled The Origin of Species, was covered by copyright (though, since he died in 1882, the copyright has since expired).
[edit] Copyright
In the past, in some jurisdictions such as the USA, a work would enter the public domain with respect to copyright if it was released without a copyright notice. This was true prior to March 1, 1989 (according to the USA Copyright office), but is no longer the case. Any work (of certain, enumerated types) receives copyright as soon as it is fixed in a tangible medium.
It is commonly believed by non-lawyers that it is impossible to put a work into the public domain. Although copyright law generally does not provide any statutory means to "abandon" copyright so that a work can enter the public domain, this does not mean that it is impossible or even difficult, only that the law is somewhat unclear. Congress may not have felt it necessary to codify this part of the law, because abandoning property (like a tract of land) to the public domain has traditionally been a matter of common law, rather than statute. (Alternatively, because copyright has traditionally been seen as a valuable right, one which required registration to achieve, it would not have made sense to contemplate someone abandoning it in 1976 and 1988.)
[edit] Statutory law
[edit] Computer Software Rental Amendments Act
There are several references to putting copyrighted work into the public domain. The first reference is actually in a statute passed by Congress, in the Computer Software Rental Amendments Act of 1990 (Public Law 101–650, 104 Stat. 5089 (1990)). Although most of the Act was codified into Title 17 of the U.S. Code, there is a very interesting provision relating to "public domain shareware" which was not, and is therefore often overlooked.
Sec. 805. Recordation of Shareware
(a) IN GENERAL— The Register of Copyrights is authorized, upon receipt of any document designated as pertaining to computer shareware and the fee prescribed by section 708 of title 17, United States Code, to record the document and return it with a certificate of recordation.
(b) MAINTENANCE OF RECORDS; PUBLICATION OF INFORMATION— The Register of Copyrights is authorized to maintain current, separate records relating to the recordation of documents under subsection (a), and to compile and publish at periodic intervals information relating to such recordations. Such publications shall be offered for sale to the public at prices based on the cost of reproduction and distribution.
(c) DEPOSIT OF COPIES IN LIBRARY OF CONGRESS— In the case of public domain computer shareware, at the election of the person recording a document under subsection (a), 2 complete copies of the best edition (as defined in section 101 of title 17, United States Code) of the computer shareware as embodied in machine-readable form may be deposited for the benefit of the Machine-Readable Collections Reading Room of the Library of Congress.
(d) REGULATIONS— The Register of Copyrights is authorized to establish regulations not inconsistent with law for the administration of the functions of the Register under this section. All regulations established by the Register are subject to the approval of the Librarian of Congress.
One purpose of this legislation appears to be to allow "public domain shareware" to be filed at the Library of Congress, presumably so that the shareware would be more widely disseminated. Therefore, one way to release computer software into the public domain might be to make the filing and pay the $20 fee. This could have the effect of "certifying" that the author intended to release the software into the public domain. It does not seem that registration is necessary to release the software into the public domain, because the law does not state that public domain status is conferred by registration. Judicial rulings supports this conclusion, see below.
By comparing paragraph (a) and (c), one can see that Congress distinguishes "public domain" shareware as a special kind of shareware. Because this law was passed after the Berne Convention Implementation Act of 1988, Congress was well aware that newly-created computer programs (two years worth, since the Berne Act was passed) would automatically have copyright attached. Therefore, one reasonable inference is that Congress intended that authors of shareware would have the power to release their programs into the public domain. This interpretation is followed by the Copyright Office in 37 C.F.R. § 201.26.
[edit] Berne Convention Implementation Act
Main article: Berne Convention for the Protection of Literary and Artistic Works
The Berne Convention Implementation Act of 1988 states in section twelve that the Act "does not provide copyright protection for any work that is in the public domain." The congressional committee report explains that this means simply that the Act does not apply retroactively.
Although the only part of the act that does mention "public domain" does not speak to whether authors have the right to dedicate their work to the public domain, the remainder of the committee report does not say that they intended copyright should be an indestructible form of property. Rather the language speaks to getting rid of formalities in order to comply with Berne (non-compliance had become a severe impediment in trade negotiations) and making registration and marking optional, but encouraged. A fair reading is that the Berne Act did not intend to take away author's right to dedicate works to the public domain, which they had (by default) under the 1976 Act.
[edit] Section 203 of the Copyright Act
Although there is support in the statutes for allowing work to be dedicated to the public domain, there cannot be an unlimited right to dedicate work to the public domain because of a quirk of U.S. copyright law which grants the author of a work the right to cancel "the exclusive or nonexclusive grant of a transfer or license of copyright or of any right under a copyright" thirty-five years later, unless the work was originally a work for hire.[35]
It is unsettled how this section would mesh with a purported public domain dedication. Any of these interpretations are possible:
* No effect. Any holder of a copyright can release it to the public domain. This interpretation is probably wrong, because then an author would lose the right to his "termination right," which in practical terms means a royalty. To prevent paying the royalty, a comic book company could release the copyright to the public domain but hold onto the trademark, which would suffice to prevent knock-off comics from being made. Because the Captain America case (Marvel v. Simon) showed that this termination right cannot be alienated before death, this interpretation is almost certainly wrong.
* Some effect. An author may release his own work into the public domain, and a company holding a work for hire may release his work into the public domain. But a company which has purchased a copyright from an author (as was the case with most of the "Golden Age" comic book writers) cannot. Although the distinction of allowing an author to release his own work is not explicit in the statute, it may not be literally inconsistent (it is not a "transfer" or a "license," and it arguably is not a grant of a right under copyright), and this reading is necessary to comply with the 1990 Act discussed above, as well as the case law discussed below.
* Strong effect. Only a company holding a work for hire can release the work into the public domain. Because of the references to "shareware" (above) and "programmers" (below), and the fact that many software companies in the 1980s were quite small (and thus did not have employees), this reading seems inconsistent with the intent of Congress.
[edit] Case law
Another form of support comes from the seminal case Computer Associates Int'l v. Altai, 982 F.2d 693. This case set the standard for determining copyright infringement of computer software and is still followed today. Moreover, it was decided by the Second Circuit appellate court, which is famous for handing down some of the most well-reasoned American copyright decisions[who?]. In this case, it discusses the public domain.
(c) Elements Taken from the Public Domain
Closely related to the non-protectability of scenes a faire, is material found in the public domain. Such material is free for the taking and cannot be appropriated by a single author even though it is included in a copyrighted work. ... We see no reason to make an exception to this rule for elements of a computer program that have entered the public domain by virtue of freely accessible program exchanges and the like. See 3 Nimmer Section 13.03 [F] ; see also Brown Bag Software, slip op. at 3732 (affirming the district court’s finding that "[p]laintiffs may not claim copyright protection of an ... expression that is, if not standard, then commonplace in the computer software industry."). Thus, a court must also filter out this material from the allegedly infringed program before it makes the final inquiry in its substantial similarity analysis.
This decision holds that computer software may enter the public domain through "freely accessible program exchanges and the like," or by becoming "commonplace in the computer industry." Relying only on this decision, it is unclear whether an author can dedicate his work to the public domain simply by labeling it as such, or whether dedication to the public domain requires widespread dissemination.
This could make a distinction in a CyberPatrol-like case, where a software program is released, leading to litigation, and as part of a settlement the author assigns his copyright. If the author has the power to release his work into the public domain, there would be no way for the new owner to stop the circulation of the program. A court may look on an attempt to abuse the public domain in this way with disfavor, particularly if the program has not been widely disseminated. Either way, a fair reading is that an author may choose to release a computer program to the public domain if he can arrange for it to become popular and widely disseminated.
[edit] Treatise analysis
The treatise cited[36] holds in its most recent edition:
13.03[F] [4]
It is axiomatic that material in the public domain is not protected by copyright, even when incorporated into a copyrighted work. ...
An enormous amount of public domain software exists in the computer industry, perhaps to a much greater extent than is true of other fields. Nationwide computer "bulletin boards" permit users to share and distribute programs. In addition, computer programming texts may contain examples of actual code that programmers are encouraged to copy.
Programmers often will build existing public domain software into their works. The courts thus must be careful to limit protection only to those elements of the program that represent the author's original work.
Although Computer Associates only mentioned the issue in passing, Nimmer observes that the public domain is particularly rich and valuable for computer programs. He seems to say that a computer program author who wishes to release his work into the public domain may either include it in a book as example code or post it on a "bulletin board" and encourage sharing and distribution. (Nimmer is the treatise most widely cited in copyright opinions, and is generally authoritative.)
[edit] Patent
With regard to patents, on the other hand, public use or publishing the details of an invention before applying for a patent will generally place an invention in the public domain and (in theory) prevent its subsequent patenting by anyone—an effective disclaimer. For example, a chemistry journal publishing a formula prevents patenting the formula by anyone. This tactic was commonly used by Bell Labs. The famous Bell Labs Technical Journal was sent free of charge to the library of the U.S. Patent Office to establish a base of prior art without the inconvenience, cost, and hassle of filing patent applications for inventions of no immediate monetary value. (Unix was famously described in this journal.) This is sometimes called "defensive disclosure"—one way to make sure someone is not later accused of infringing a patent on their own invention. There is an exception to this rule, however: in U.S. (not European) law, an inventor may file a patent claim up to one year after publishing a description (but not, of course, if someone else published or used it first).
In practice, patent examiners only consider other patents and the books they have in their library for prior art, largely because the patent office has an elaborate classification system for inventions. This means that an increasing number of issued patents may be invalid, based upon prior art that was not brought to the examiner's attention. Once a patent is issued, it is very expensive to invalidate. Publishing a description on a website as a preemptive disclosure does very little in a practical sense to release an invention to the public domain; it might still be considered "patentable", although erroneously. However, anyone aware of an omitted prior art citation in an issued patent may submit it to the US Patent Office and request a "reexamination" of the patent during the enforceable period of the patent (that is, its life plus statute of limitations). This may result in loss of some or all of the patent on the invention, or it may backfire and actually strengthen the claims.
An applicant may also choose to file a Statutory Invention Registration, which has the same effect as a patent for prior art purposes. These SIRs are relatively expensive. These are used strategically by large companies to prevent competitors from obtaining a patent.
Section 102(c) says that an invention that has been "abandoned" cannot be patented. There is precious little case-law on this point. It is largely a dead letter.
If an inventor has an issued patent, there are several ways to release it to the public domain (other than simply letting it expire). First, he can fail to pay the maintenance fee the next time it is due, about every four years. Alternatively he can file a terminal disclaimer under 37 CFR 1.321 for a reasonable fee. The regulations explicitly say that the "patentee may disclaim or dedicate to the public the entire term, or any terminal part of the term, of the patent granted. Such disclaimer is binding upon the grantee and its successors or assigns." Usually this is used during the application process to prevent another patent from a "double patenting" invalidation. Lastly, he may grant a patent license to the world, although the issue of revocability may raise its head again.
[edit] Trade secret
If guarded properly, trade secrets are forever. A business may keep the formula to Coca-Cola a secret. However, once it is disclosed to the public, the former secret enters public domain, although an invention using the former secret may still be patentable in the United States if it is not barred by statute (including the on-sale bar).[37]
Some businesses choose to protect products, processes, and information by guarding them as trade secrets, rather than patenting them. Hershey Foods, Inc., for example, does not patent some of its processes, such as the recipe for Reese's, but rather maintains them as trade secrets, to prevent competitors from easily duplicating or learning from their invention disclosures, or from using the information after the patent lapses.
One risk, however, is that anyone may reverse engineer a product and thus discover (and copy and publish) all of its secrets, to the extent they are not covered by other laws (e.g. contract).
[edit] Trademark
Main article: Genericized trademark
A trademark registration is renewable. If a trademark owner wishes to do so, he may maintain a registration indefinitely by paying renewal fees, using the trademark and defending the registration.
However, a trademark or brand can become unenforceable if it becomes the generic term for a particular type of product or service—a process called "genericide". If a mark undergoes genericide, people are using the term generically, not as a trademark to exclusively identify the particular source of the product or service. One famous example is "thermos" in the United States.
Because trademarks are registered with governments, some countries or trademark registries may recognize a mark, while others may have determined that it is generic and not allowable as a trademark in that registry. For example, the drug "acetylsalicylic acid" (2-acetoxybenzoic acid) is better known as aspirin in the United States—a generic term. In Canada, however, "aspirin" is still a trademark of the German company Bayer. Bayer lost the trademark after World War I, when the mark was sold to an American firm. So many copy-cat products entered the marketplace during the war that it was deemed generic just three years later.[38]
Terms can be deemed "generic" in two ways. First, any potential mark can be deemed "generic" by a trademark registry, that refuses to register it. In this instance, the term has no secondary meaning that helps consumers identify the source of the product; the term serves no function as a "mark". Second, a mark, already in use, may be deemed generic by a court or registry after the mark is challenged as generic—this is known as "genericide". In this instance, the term previously had a secondary meaning, but lost its source-identifying function.
To avoid "genericide", a trademark owner must balance between trying to dominate the market, and dominating their market to such an extent that their product name defines the market. A manufacturer who invents an amazing breakthrough product which cannot be succinctly described in plain English (for example, a vacuum-insulated drinking flask) will likely find its product described by the trademark ("Thermos"). If the product continues to dominate the market, eventually the trademark will become generic ("thermos").
However, "genericide" is not an inevitable process. In the late 1980s, "Nintendo" was becoming synonymous with home video game consoles but Nintendo was able to reverse this process through marketing campaigns. Xerox was also successful in avoiding its name becoming synonymous with the act of photocopying (although, in some languages (such as Russian and Polish) and countries (like India), it became generic).
Trademarks currently thought to be in danger of being generic include iPod, Jell-O, Band-Aid, Rollerblade, Google, Spam, Hoover, and Sheetrock. Google vigorously defends its trademark rights. Although Hormel resigned itself to genericide,[39] it has fought attempts by other companies to register "spam" as a trademark in relation to computer products.[40]
When a trademark becomes generic, it is as if the mark were in the public domain.
Trademarks which have been genericized in particular places include: Formica, Escalator, Trampoline, Raisin Bran, Linoleum, Dry Ice, Shredded Wheat (generic in US), Mimeograph, Yo-Yo, Kerosene, Cornflakes, Cube Steak, Lanolin, and High Octane, (Source: Xerox ad, reprinted in Copyright, Patent, Trademark, ..., by Paul Goldstein, 5th ed., p. 245) as well as Aspirin (generic in the United States, but not in Canada), Allen wrench, Beaver Board, Masonite, Coke, Pablum, Styrofoam, Heroin, Bikini, Chyron, Crapper, Weedwhacker, Kleenex, Linux (generic in Australia) and Zipper.
[edit] Domain name
A domain name never enters public domain in the sense that copyrighted material does. It is closer in nature to a trademark, in that a failure to maintain it makes it available for others to use (with different standards to maintain it from those for a trademark). If another party registers a lapsed domain name, it is no longer available to the public, as would be the case with former intellectual property which has become public domain.
Tuesday, October 20, 2009
Domain hijacking
Domain hijacking or domain theft is the process by which registration of a currently registered domain name is transferred without the permission of its original registrant, generally by exploiting a vulnerability in the domain name registration system.
Domain names expire after a fixed period of time and become available to the public. If their original owner allows them to expire even momentarily, they may be immediately purchased by another party. Although this may be frustrating for a domain owner who is slow to renew, generally the new purchaser is not considered liable in this scenario and the original owner has no recourse.
The most common tactic used by a domain hijacker is to use acquired personal information about the actual domain owner to impersonate them and persuade the domain registrar to modify the registration information and/or transfer the domain to another registrar, a form of identity theft. Once this has been done, the hijacker has full control of the domain and can use it or sell it to a third party. This can be financially devastating to the original domain name holder, who may have derived commercial income from a website hosted at the domain or conducted business through that domain's e-mail accounts. Additionally, the hijacker can use the domain name to facilitate illegal activity such as phishing, where a website is replaced by an identical website that records private information such as log-in passwords.
Responses to discovered hijackings vary; sometimes the registration information can be returned to its original state by the current registrar, but this may be more difficult if the domain name was transferred to another registrar, particularly if that registrar resides in another country. In some cases the original domain owner is not able to regain control over the domain.
The legal status of domain hijacking remains unclear. It is analogous with theft, in that the original owner is deprived of the benefits of the domain, but theft traditionally regards concrete goods such as jewelry and electronics, whereas domain name ownership is stored only in the digital state of the domain name registry, a network of computers. There are no specific laws regarding domain hijacking, nor any law that specifically holds the domain name registrar responsible for allowing the registrant information to be modified without the permission of the original registrant. In some cases there may be recourse under trademark law, but not all domain names are (or can be) registered as trademarks.
[edit] Prevention
ICANN imposes a 60-day waiting period between a change in registration information and a transfer to another registrar; this is intended to make domain hijacking more difficult, since a transferred domain is much more difficult to reclaim, and it is more likely that the original registrant will discover the change in that period and alert the registrar. Extensible Provisioning Protocol is used for many TLD registries, and uses an authorization code issued exclusively to the domain registrant as a security measure to prevent unauthorized transfers.
Domain names expire after a fixed period of time and become available to the public. If their original owner allows them to expire even momentarily, they may be immediately purchased by another party. Although this may be frustrating for a domain owner who is slow to renew, generally the new purchaser is not considered liable in this scenario and the original owner has no recourse.
The most common tactic used by a domain hijacker is to use acquired personal information about the actual domain owner to impersonate them and persuade the domain registrar to modify the registration information and/or transfer the domain to another registrar, a form of identity theft. Once this has been done, the hijacker has full control of the domain and can use it or sell it to a third party. This can be financially devastating to the original domain name holder, who may have derived commercial income from a website hosted at the domain or conducted business through that domain's e-mail accounts. Additionally, the hijacker can use the domain name to facilitate illegal activity such as phishing, where a website is replaced by an identical website that records private information such as log-in passwords.
Responses to discovered hijackings vary; sometimes the registration information can be returned to its original state by the current registrar, but this may be more difficult if the domain name was transferred to another registrar, particularly if that registrar resides in another country. In some cases the original domain owner is not able to regain control over the domain.
The legal status of domain hijacking remains unclear. It is analogous with theft, in that the original owner is deprived of the benefits of the domain, but theft traditionally regards concrete goods such as jewelry and electronics, whereas domain name ownership is stored only in the digital state of the domain name registry, a network of computers. There are no specific laws regarding domain hijacking, nor any law that specifically holds the domain name registrar responsible for allowing the registrant information to be modified without the permission of the original registrant. In some cases there may be recourse under trademark law, but not all domain names are (or can be) registered as trademarks.
[edit] Prevention
ICANN imposes a 60-day waiting period between a change in registration information and a transfer to another registrar; this is intended to make domain hijacking more difficult, since a transferred domain is much more difficult to reclaim, and it is more likely that the original registrant will discover the change in that period and alert the registrar. Extensible Provisioning Protocol is used for many TLD registries, and uses an authorization code issued exclusively to the domain registrant as a security measure to prevent unauthorized transfers.
Fully qualified domain name
A fully qualified domain name (FQDN), sometimes referred to as an absolute domain name[1], is a domain name that specifies its exact location in the tree hierarchy of the Domain Name System (DNS). It specifies all domain levels, including the top-level domain, relative to the root domain. A fully qualified domain name is distinguished by its unambiguity; it can only be interpreted one way.
For example, given a device with a local hostname myhost and a parent domain name example.com, the fully qualified domain name is written like this:
myhost.example.com
The FQDN therefore uniquely identifies the device — while there may be many hosts in the world called myhost, there can only be one myhost.example.com. In the DNS, and most notably, in DNS zone files, an FQDN is specified with a trailing dot, for example:
somehost.example.com.
The trailing dot denotes the root domain. Most DNS resolvers will process a domain name that contains a dot as being an FQDN[2] or add the final dot needed for the root of the DNS tree. Resolvers will process a domain name without a dot as unqualified and automatically append the system's default domain name and the final dot.
Some applications, such as web browsers will try to qualify the domain name part of a Uniform Resource Locator (URL) if the resolver cannot find the specified domain. Some applications, however, never use trailing dots to indicate absoluteness, because the underlying protocols require the use of FQDNs, such as Simple Mail Transfer Protocol (e-mail).[3]
For example, given a device with a local hostname myhost and a parent domain name example.com, the fully qualified domain name is written like this:
myhost.example.com
The FQDN therefore uniquely identifies the device — while there may be many hosts in the world called myhost, there can only be one myhost.example.com. In the DNS, and most notably, in DNS zone files, an FQDN is specified with a trailing dot, for example:
somehost.example.com.
The trailing dot denotes the root domain. Most DNS resolvers will process a domain name that contains a dot as being an FQDN[2] or add the final dot needed for the root of the DNS tree. Resolvers will process a domain name without a dot as unqualified and automatically append the system's default domain name and the final dot.
Some applications, such as web browsers will try to qualify the domain name part of a Uniform Resource Locator (URL) if the resolver cannot find the specified domain. Some applications, however, never use trailing dots to indicate absoluteness, because the underlying protocols require the use of FQDNs, such as Simple Mail Transfer Protocol (e-mail).[3]
Internationalized domain name
An internationalized domain name (IDN) is an Internet domain name that contains one or more non-ASCII characters. Such domain names could contain letters with diacritics, as required by many languages, or characters from non-Latin scripts such as Arabic, Chinese, Cyrillic, Devanagari or Hebrew. However, the standard for domain names does not allow such characters, and much work has gone into finding a way to internationalize domain names into a standard ASCII format, thereby preserving the stability of the domain name system.
IDN was originally proposed in 1996 by M. Dürst and implemented in 1998 by Tan Juay Kwang and Leong Kok Yong under the guidance of T.W. Tan (James Seng was only recruited later after he joined the nascent company, i-dns.net). After much debate and many competing proposals, a system called Internationalizing Domain Names in Applications (IDNA) [1] was adopted as a standard, and has been implemented in several top level domains.
In IDNA, the term internationalized domain name means specifically any domain name consisting only of labels to which the IDNA ToASCII algorithm can be successfully applied. (For the meaning of 'label' and 'ToASCII', see the section ToASCII and ToUnicode below.) In March 2008, the IETF formed a new IDN working group to update[2] the current IDNA protocol.
Internationalizing Domain Names in Applications
Internationalizing Domain Names in Applications (IDNA) is a mechanism defined in 2003 for handling internationalized domain names containing non-ASCII characters. While much of the Domain Name System can technically support non-ASCII characters, applications such as e-mail and web browsers restrict domain names to what can be used as a hostname. Rather than redesigning the existing DNS infrastructure, it was decided that non-ASCII domain names should be converted to a suitable ASCII-based form by web browsers and other user applications; IDNA specifies how this conversion is to be done.
IDNA was designed for maximum backward compatibility with the existing DNS system, which was designed for use with names using only a subset of the ASCII character set.
An IDNA-enabled application is able to convert between the restricted-ASCII and non-ASCII representations of a domain, using the ASCII form in cases where it is needed (such as for DNS lookup), but being able to present the more readable non-ASCII form to users. Applications that do not support IDNA will not be able to handle domain names with non-ASCII characters, but will still be able to access such domains if given the (usually rather cryptic) ASCII equivalent.
ICANN issued guidelines for the use of IDNA in June 2003, and it was already possible to register .jp domains using this system in July 2003 and .info[3] domains in March 2004. Several other top-level domain registries started accepting registrations in 2004 and 2005. IDN Guidelines were first created[4] in June 2003, and have been updated[5] to respond to phishing concerns in November 2005. An ICANN working group focused on country code domain names at the top level was formed in November 2007[6] and promoted jointly by the country code supporting organization and the Governmental Advisory Committee.
Mozilla 1.4, Netscape 7.1, Opera 7.11 and Safari are among the first applications to support IDNA. A browser plugin is available for Internet Explorer 6 to provide IDN support. Internet Explorer 7.0[7][8] and Windows Vista's URL APIs provide native support for IDN.[9]
[edit] ToASCII and ToUnicode
The conversions between ASCII and non-ASCII forms of a domain name are accomplished by algorithms called ToASCII and ToUnicode. These algorithms are not applied to the domain name as a whole, but rather to individual labels. For example, if the domain name is www.example.com, then the labels are www, example, and com, and ToASCII or ToUnicode would be applied to each of these three separately.
The details of these two algorithms are complex, and are specified in the RFCs linked at the end of this article. The following gives an overview of their behaviour.
ToASCII leaves unchanged any ASCII label, but will fail if the label is unsuitable for DNS. If given a label containing at least one non-ASCII character, ToASCII will apply the Nameprep algorithm (which converts the label to lowercase and performs other normalization) and will then translate the result to ASCII using Punycode[10] before prepending the 4-character string "xn--". This 4-character string is called the ACE prefix, where ACE means ASCII Compatible Encoding, and is used to distinguish Punycode-encoded labels from ordinary ASCII labels. Note that the ToASCII algorithm can fail in a number of ways; for example, the final string could exceed the 63-character limit for the DNS. A label on which ToASCII fails cannot be used in an internationalized domain name.
ToUnicode reverses the action of ToASCII, stripping off the ACE prefix and applying the Punycode decode algorithm. It does not reverse the Nameprep processing, since that is merely a normalization and is by nature irreversible. Unlike ToASCII, ToUnicode always succeeds, because it simply returns the original string if decoding would fail. In particular, this means that ToUnicode has no effect on a string that does not begin with the ACE prefix.
[edit] Example of IDNA encoding
Main article: Punycode
As an example of how IDNA works, suppose the domain to be encoded is Bücher.ch (“Bücher” is German for “books”, and .ch is the country domain for Switzerland). This has two labels, Bücher and ch. The second label is pure ASCII, and so is left unchanged. The first label is processed by Nameprep to give bücher, and then by Punycode to give bcher-kva, and then has xn-- prepended to give xn—bcher-kva. The final domain suitable for use with the DNS is therefore xn—bcher-kva.ch.
[edit] ASCII Spoofing and squatting concerns
Main article: IDN homograph attack
Because IDN allows websites to use full Unicode names, it also makes it much easier to create a spoofed web site that looks exactly like another, including domain name and security certificate, but in fact is controlled by someone attempting to steal private information. These spoofing attacks potentially open users up to phishing attacks.
These attacks are not due to technical deficiencies in either the Unicode or IDNA specifications, but because different characters in different languages can look the same, depending on the font used. For example, Unicode character U+0430, Cyrillic small letter a ("а"), can look identical to Unicode character U+0061, Latin small letter a, ("a") which is the lowercase "a" used in English. Characters that look alike in this way may be termed homonyms, homographs, or (less ambiguously) homoglyphs.
Although a computer may display visually identical or very similar glyphs for two different characters, these differences are still significant to the computer when locating web sites or validating certificates. The user assumes a one-to-one correspondence between the visual appearance of a name and the named entity, but when two names appear identical, this correspondence breaks down.
By contrast, with the old set of a to z, 0 to 9, and the hyphen, there is little in the way of homographs. Capital I (in a sans-serif font), lower-case l and number 1, and number 0 and capital O are the closest, and combinations, such as "r" with "n" and "v" with another "v" can look similar to "m" ("rn") and "w" ("vv"), in fonts that do not make a noticeable visible distinction between them. However, this provides a much smaller domain of collisions than all of Unicode.
On December 2001, two Israeli researchers, Evgeniy Gabrilovich and Alex Gontmakher, published a paper titled "The Homograph Attack",[11] an attack that used Unicode URLs to spoof a website URL. To prove the feasibility of this kind of attack, the researchers successfully registered a variant of the domain name "Microsoft.com" which incorporated Russian language characters.
In general, this kind of attack is known as a homograph spoofing attack. This problem was anticipated before IDN was introduced, and guidelines were issued to registries to try and avoid or reduce the problem – for example, recommending that registries only accept the Latin alphabet and that of their own country, not all of Unicode. Unfortunately this advice was not followed by those in control of a number of major TLDs.
On February 7, 2005, Slashdot reported that this exploit was disclosed at the hacker conference Shmoocon with an example available at http://www.shmoo.com/idn/. On browsers supporting IDNA, the URL "http://www.pаypal.com/" (where the first a is replaced by a Cyrillic а) appears to lead to paypal.com but instead led to a spoofed PayPal web site that said "Meeow."
Internet Explorer 7 imposes restrictions on displaying non-ASCII domain names based on a user-defined list of allowed languages and provide an anti-phishing filter that checks suspicious Web sites against a remote database of known phishing sites.
Since Internet Explorer prior to version 7 does not support IDNs, it is not vulnerable to this kind of attack. However, older versions of Internet Explorer can be made IDN-compatible by browser plug-ins some of which are vulnerable to the spoofing attacks.
On February 17, 2005, Mozilla developers announced that they would ship their next versions of their software with IDN support still enabled, but showing the punycode URLs instead, thus thwarting any attacks exploiting similarities between ASCII and non-ASCII letters (but not necessarily, for example, between Cyrillic and Greek letters, unless the user knows which Punycode URL corresponds to their chosen IDN URL) while still allowing people to access websites on an IDN domain. This is a change from the earlier plans to disable IDN entirely for the time being. [1]
Since then, both Mozilla and Opera have now announced that they will be using per-domain whitelists to selectively switch on IDN display for domain run by registries which are taking appropriate anti-spoofing precautions[2]. (See the article on homograph spoofing attacks for more details). As of September 9, 2005, the most recent version of Mozilla Firefox as well as the most recent Internet Explorer displays the spoofed Paypal URL as "http://www.xn--pypal-4ve.com/", unsightly but clearly different from the actual paypal.com. By contrast, the (non-existent) "http://www.xn--pypal-4ve.org" will display in the Firefox address bar as http://www.pаypal.org, as this form of domain is prohibited from registration at the Afilias registry level and therefore does not pose the same risk.
Safari's approach is to render problematic character sets as punycode. This can be changed by altering the settings in Mac OS X's system files[12].
IDN was originally proposed in 1996 by M. Dürst and implemented in 1998 by Tan Juay Kwang and Leong Kok Yong under the guidance of T.W. Tan (James Seng was only recruited later after he joined the nascent company, i-dns.net). After much debate and many competing proposals, a system called Internationalizing Domain Names in Applications (IDNA) [1] was adopted as a standard, and has been implemented in several top level domains.
In IDNA, the term internationalized domain name means specifically any domain name consisting only of labels to which the IDNA ToASCII algorithm can be successfully applied. (For the meaning of 'label' and 'ToASCII', see the section ToASCII and ToUnicode below.) In March 2008, the IETF formed a new IDN working group to update[2] the current IDNA protocol.
Internationalizing Domain Names in Applications
Internationalizing Domain Names in Applications (IDNA) is a mechanism defined in 2003 for handling internationalized domain names containing non-ASCII characters. While much of the Domain Name System can technically support non-ASCII characters, applications such as e-mail and web browsers restrict domain names to what can be used as a hostname. Rather than redesigning the existing DNS infrastructure, it was decided that non-ASCII domain names should be converted to a suitable ASCII-based form by web browsers and other user applications; IDNA specifies how this conversion is to be done.
IDNA was designed for maximum backward compatibility with the existing DNS system, which was designed for use with names using only a subset of the ASCII character set.
An IDNA-enabled application is able to convert between the restricted-ASCII and non-ASCII representations of a domain, using the ASCII form in cases where it is needed (such as for DNS lookup), but being able to present the more readable non-ASCII form to users. Applications that do not support IDNA will not be able to handle domain names with non-ASCII characters, but will still be able to access such domains if given the (usually rather cryptic) ASCII equivalent.
ICANN issued guidelines for the use of IDNA in June 2003, and it was already possible to register .jp domains using this system in July 2003 and .info[3] domains in March 2004. Several other top-level domain registries started accepting registrations in 2004 and 2005. IDN Guidelines were first created[4] in June 2003, and have been updated[5] to respond to phishing concerns in November 2005. An ICANN working group focused on country code domain names at the top level was formed in November 2007[6] and promoted jointly by the country code supporting organization and the Governmental Advisory Committee.
Mozilla 1.4, Netscape 7.1, Opera 7.11 and Safari are among the first applications to support IDNA. A browser plugin is available for Internet Explorer 6 to provide IDN support. Internet Explorer 7.0[7][8] and Windows Vista's URL APIs provide native support for IDN.[9]
[edit] ToASCII and ToUnicode
The conversions between ASCII and non-ASCII forms of a domain name are accomplished by algorithms called ToASCII and ToUnicode. These algorithms are not applied to the domain name as a whole, but rather to individual labels. For example, if the domain name is www.example.com, then the labels are www, example, and com, and ToASCII or ToUnicode would be applied to each of these three separately.
The details of these two algorithms are complex, and are specified in the RFCs linked at the end of this article. The following gives an overview of their behaviour.
ToASCII leaves unchanged any ASCII label, but will fail if the label is unsuitable for DNS. If given a label containing at least one non-ASCII character, ToASCII will apply the Nameprep algorithm (which converts the label to lowercase and performs other normalization) and will then translate the result to ASCII using Punycode[10] before prepending the 4-character string "xn--". This 4-character string is called the ACE prefix, where ACE means ASCII Compatible Encoding, and is used to distinguish Punycode-encoded labels from ordinary ASCII labels. Note that the ToASCII algorithm can fail in a number of ways; for example, the final string could exceed the 63-character limit for the DNS. A label on which ToASCII fails cannot be used in an internationalized domain name.
ToUnicode reverses the action of ToASCII, stripping off the ACE prefix and applying the Punycode decode algorithm. It does not reverse the Nameprep processing, since that is merely a normalization and is by nature irreversible. Unlike ToASCII, ToUnicode always succeeds, because it simply returns the original string if decoding would fail. In particular, this means that ToUnicode has no effect on a string that does not begin with the ACE prefix.
[edit] Example of IDNA encoding
Main article: Punycode
As an example of how IDNA works, suppose the domain to be encoded is Bücher.ch (“Bücher” is German for “books”, and .ch is the country domain for Switzerland). This has two labels, Bücher and ch. The second label is pure ASCII, and so is left unchanged. The first label is processed by Nameprep to give bücher, and then by Punycode to give bcher-kva, and then has xn-- prepended to give xn—bcher-kva. The final domain suitable for use with the DNS is therefore xn—bcher-kva.ch.
[edit] ASCII Spoofing and squatting concerns
Main article: IDN homograph attack
Because IDN allows websites to use full Unicode names, it also makes it much easier to create a spoofed web site that looks exactly like another, including domain name and security certificate, but in fact is controlled by someone attempting to steal private information. These spoofing attacks potentially open users up to phishing attacks.
These attacks are not due to technical deficiencies in either the Unicode or IDNA specifications, but because different characters in different languages can look the same, depending on the font used. For example, Unicode character U+0430, Cyrillic small letter a ("а"), can look identical to Unicode character U+0061, Latin small letter a, ("a") which is the lowercase "a" used in English. Characters that look alike in this way may be termed homonyms, homographs, or (less ambiguously) homoglyphs.
Although a computer may display visually identical or very similar glyphs for two different characters, these differences are still significant to the computer when locating web sites or validating certificates. The user assumes a one-to-one correspondence between the visual appearance of a name and the named entity, but when two names appear identical, this correspondence breaks down.
By contrast, with the old set of a to z, 0 to 9, and the hyphen, there is little in the way of homographs. Capital I (in a sans-serif font), lower-case l and number 1, and number 0 and capital O are the closest, and combinations, such as "r" with "n" and "v" with another "v" can look similar to "m" ("rn") and "w" ("vv"), in fonts that do not make a noticeable visible distinction between them. However, this provides a much smaller domain of collisions than all of Unicode.
On December 2001, two Israeli researchers, Evgeniy Gabrilovich and Alex Gontmakher, published a paper titled "The Homograph Attack",[11] an attack that used Unicode URLs to spoof a website URL. To prove the feasibility of this kind of attack, the researchers successfully registered a variant of the domain name "Microsoft.com" which incorporated Russian language characters.
In general, this kind of attack is known as a homograph spoofing attack. This problem was anticipated before IDN was introduced, and guidelines were issued to registries to try and avoid or reduce the problem – for example, recommending that registries only accept the Latin alphabet and that of their own country, not all of Unicode. Unfortunately this advice was not followed by those in control of a number of major TLDs.
On February 7, 2005, Slashdot reported that this exploit was disclosed at the hacker conference Shmoocon with an example available at http://www.shmoo.com/idn/. On browsers supporting IDNA, the URL "http://www.pаypal.com/" (where the first a is replaced by a Cyrillic а) appears to lead to paypal.com but instead led to a spoofed PayPal web site that said "Meeow."
Internet Explorer 7 imposes restrictions on displaying non-ASCII domain names based on a user-defined list of allowed languages and provide an anti-phishing filter that checks suspicious Web sites against a remote database of known phishing sites.
Since Internet Explorer prior to version 7 does not support IDNs, it is not vulnerable to this kind of attack. However, older versions of Internet Explorer can be made IDN-compatible by browser plug-ins some of which are vulnerable to the spoofing attacks.
On February 17, 2005, Mozilla developers announced that they would ship their next versions of their software with IDN support still enabled, but showing the punycode URLs instead, thus thwarting any attacks exploiting similarities between ASCII and non-ASCII letters (but not necessarily, for example, between Cyrillic and Greek letters, unless the user knows which Punycode URL corresponds to their chosen IDN URL) while still allowing people to access websites on an IDN domain. This is a change from the earlier plans to disable IDN entirely for the time being. [1]
Since then, both Mozilla and Opera have now announced that they will be using per-domain whitelists to selectively switch on IDN display for domain run by registries which are taking appropriate anti-spoofing precautions[2]. (See the article on homograph spoofing attacks for more details). As of September 9, 2005, the most recent version of Mozilla Firefox as well as the most recent Internet Explorer displays the spoofed Paypal URL as "http://www.xn--pypal-4ve.com/", unsightly but clearly different from the actual paypal.com. By contrast, the (non-existent) "http://www.xn--pypal-4ve.org" will display in the Firefox address bar as http://www.pаypal.org, as this form of domain is prohibited from registration at the Afilias registry level and therefore does not pose the same risk.
Safari's approach is to render problematic character sets as punycode. This can be changed by altering the settings in Mac OS X's system files[12].
Web page
A webpage or web page is a document or resource of information that is suitable for the World Wide Web and can be accessed through a web browser and displayed on a computer screen.
This information is usually in HTML or XHTML format, and may provide navigation to other webpages via hypertext links.
Webpages may be retrieved from a local computer or from a remote web server. The web server may restrict access only to a private network, e.g. a corporate intranet, or it may publish pages on the World Wide Web. Webpages are requested and served from web servers using Hypertext Transfer Protocol (HTTP).
Webpages may consist of files of static text stored within the web server's file system (static webpages), or the web server may construct the (X)HTML for each webpage when it is requested by a browser (dynamic webpages). Client-side scripting can make webpages more responsive to user input once in the client browser.
Color, typography, illustration and interaction
Webpages usually include information as to the colors of text and backgrounds and very often also contain links to images and sometimes other media to be included in the final view.
Layout, typographic and color-scheme information is provided by Cascading Style Sheet (CSS) instructions, which can either be embedded in the HTML or can be provided by a separate file, which is referenced from within the HTML. The latter case is especially relevant where one lengthy stylesheet is relevant to a whole website: due to the way HTTP works, the browser will only download it once from the web server and use the cached copy for the whole site.
Images are stored on the web server as separate files, but again HTTP allows for the fact that once a webpage is downloaded to a browser, it is quite likely that related files such as images and stylesheets will be requested as it is processed. An HTTP 1.1 web server will maintain a connection with the browser until all related resources have been requested and provided. Web browsers usually render images along with the text and other material on the displayed webpage.
[edit] Dynamic behavior
Main article: dynamic web page
Client-side computer code such as JavaScript or code implementing Ajax techniques can be provided either embedded in the HTML of a webpage or, like CSS stylesheets, as separate, linked downloads specified in the HTML. These scripts may run on the client computer, if the user allows them to, and can provide additional functionality for the user after the page has downloaded.
This information is usually in HTML or XHTML format, and may provide navigation to other webpages via hypertext links.
Webpages may be retrieved from a local computer or from a remote web server. The web server may restrict access only to a private network, e.g. a corporate intranet, or it may publish pages on the World Wide Web. Webpages are requested and served from web servers using Hypertext Transfer Protocol (HTTP).
Webpages may consist of files of static text stored within the web server's file system (static webpages), or the web server may construct the (X)HTML for each webpage when it is requested by a browser (dynamic webpages). Client-side scripting can make webpages more responsive to user input once in the client browser.
Color, typography, illustration and interaction
Webpages usually include information as to the colors of text and backgrounds and very often also contain links to images and sometimes other media to be included in the final view.
Layout, typographic and color-scheme information is provided by Cascading Style Sheet (CSS) instructions, which can either be embedded in the HTML or can be provided by a separate file, which is referenced from within the HTML. The latter case is especially relevant where one lengthy stylesheet is relevant to a whole website: due to the way HTTP works, the browser will only download it once from the web server and use the cached copy for the whole site.
Images are stored on the web server as separate files, but again HTTP allows for the fact that once a webpage is downloaded to a browser, it is quite likely that related files such as images and stylesheets will be requested as it is processed. An HTTP 1.1 web server will maintain a connection with the browser until all related resources have been requested and provided. Web browsers usually render images along with the text and other material on the displayed webpage.
[edit] Dynamic behavior
Main article: dynamic web page
Client-side computer code such as JavaScript or code implementing Ajax techniques can be provided either embedded in the HTML of a webpage or, like CSS stylesheets, as separate, linked downloads specified in the HTML. These scripts may run on the client computer, if the user allows them to, and can provide additional functionality for the user after the page has downloaded.
Domain name warehousing
Domain name warehousing is the common practice of registrars obtaining control of domain names with the intent to hold or “warehouse” names for their use and/or profit. Also see domain name front running and domain tasting, related business practices employed by registrants.
Typically this practice occurs after a domain name has expired and the previous owner (registrant) has not exercised his/her right to renew that name within the allotted time frame (approximately 45 days following expiration). Domain's expiration date and time are easily calculated based on the expiration date in the whois and the redemption process.
According to GNSO Council Deletes Task Force Report (2003), a council organized under the Internet Corporation For Assigned Names and Numbers (ICANN), three specific modes of warehousing were identified:
- The registrant allows the domain name to lapse, but registrar fails to delete the domain name during the grace period, resulting in a paid renewal to the registry. The registrar subsequently assumes registration of the domain name.
- The registrant purchases the domain name through fraud and the registrar assumes registration of the name to resell in order to minimize losses.
- The registrar registers the domain in its own name outright.
When the phrase "Domain Warehousing" was coined in the late 1990s, ICANN registrars were two dimensional entities that served registrants of domain names. The concern at that time was that a registrar would register available domain names and then offer to re-sell those registrations at a "higher than registration" price to potential registrants. By 2006 the name space had clearly matured and the line between registrars, media companies such as AOL.com (who operate ICANN accredited registrars to manage their name portfolios) and large scale commercial registrants (who operate ICANN accredited registrars as security measures) had blurred. It has been hypothesized that by 2010 many large corporations or commercial registrants of domain names will operate an ICANN accredited registrar as a security measure to protect and manage valuable name and trademark inventory.
The primary concern today when one speaks of Domain Warehousing is that a retail registrar, which has historically focused on serving its individual and small business registrants, will make the domain name renewal process difficult, convoluted, or price prohibitive in an effort to unseat exasperated registrants and usurp their registration rights for a profit greater than the potential renewal fee they could earn.
An additional concern is that companies pooling scores of drop registrars for additional registry connections will stand at the expiring domain spigot conducting domain tasting without paying, and then warehouse those which meet traffic criteria while denying the broader community a fair opportunity to compete for those expiring names.
As of this writing the governing body over domain name registration, ICANN, has yet to address those potential inequities. Registrars are in a unique position to impact domain name pricing by introducing competitive bidding or auctions for expired domain names. Circumstances are further impacted when registrars opt not to market the domains in the near term, thereby excluding the recycling of warehoused names indefinitely.
Subscribe to:
Posts (Atom)
