Yesterday, Wired ran
a story on the Cayman Islands bank that got Wikileaks.org blocked. This story said, in part:
When the bank's lawyers indicated they would be filing a suit, she asked them to tell her where so that Wikileaks could find an attorney in the appropriate jurisdiction to represent it. She says the lawyers refused to tell her. Two and a half weeks later, the bank filed a restraining order against Dynadot and Wikileaks in San Francisco. Wikileaks received notice only a few hours before the case went to a judge who accepted the agreement between Dynadot and the bank.
(emphasis mine)
Now, Dynadot and this Cayman Islands bank apparently had an agreement to block wikileaks.org already. Not only did Dynadot effectively take wikileaks.org down, but also they "lock(ed) the wikileaks.org domain name to prevent transfer of the domain name to a different domain registrar." The U.S. Disctrict Court for Northern California issued this injunction without ever giving Wikileaks a chance to respond. The bank only filed the request against Dynadot. Apparently Wikileaks received notification that this was going to happen only 6 hours before the hearing (an incredibly short time in legal terms), nowhere near enough time to prepare a case.
Now, the reason I post this is because I have looked at Dynadot as a registrar before. They have good prices and a whois privacy service that makes sense: where you remain the owner of record, making it easier if you need to transfer the domain or prove your ownership of it.
But before signing up, I read their
AUP carefully. Among many alarming things, I noticed this paragraph:
You further agree that Dynadot, in its sole discretion and without liability to You for any resulting loss or damages, may take immediate corrective action, including, but not limited to, removal of all or a portion of Your domain services and/or deletion, suspension, cancellation, termination, or other interruption of domain services or Your customer account with Dynadot, at any time during the term of this Agreement, in the event of notice of any possible violation of this Agreement by You or Your end users, or if such service or account is used in association with morally objectionable activities, or for any reason whatsoever. In such cases, any and all fees paid to Dynadot will be non-refundable and ineligible for account credit.
So, I thought I would write to them about it. Here is an excerpt from their response:
We always conduct an investigation before taking action against a domain. We will give you a chance to respond to the complaints.
From Wired's story, it doesn't look like that really happened. The US Government has already issued advisories about Cayman Islands banks, and it is unclear (to me at least) what law Wikileaks broke, or how Dynadot could find their actions of exposing fraud "morally objectionable". What's more, collaborating with the bank to get a takedown order written, but not talking to Wikileaks, seems to go against their statements to me (assuming again that the Wired story is accurate).
Here is my entire mail. You may also find archive.org's copy of the AUP
from last July to be helpful. (I wrote the email in November, and they've added some sections since then, so the section numbers don't necessarily match up)
Hello,
Thank you for your email. Responses are below.
Best Regards,
Dynadot Staff
--------------------------------------------------
DYNADOT... $8.99 domain names... $1/mo. web hosting
http://www.dynadot.com
Hi,
I currently have several domains being hosted with Gandi. I have long been looking for someone that can provide a level of privacy for my whois data in a sane way. I think Dynadot is the first I've seen that looks like it can do that and still be affordable.
In preparation to transfer over a first test domain, I read your AUP and frankly am quite troubled by what I saw. I hope that you can allay my fears.
In section 4 of part 2, the last paragraph states that Dynadot "for any reason whatsoever" may delete, cancel, or terminate my domain services or customer account. It also lists "notice of possible violation" as a justification for that. That makes me even more nervous -- any random person could send you an email claiming something nefarious is happing with my domain name, and I'm agreeing to just let you delete it because of that?
We always conduct an investigation before taking action against a domain. We will give you a chance to respond to the complaints.
A very similar clause appears in section 7 of part 1 ("cancellation of services"). It goes on to cast a very broad net around objectionable material and says that Dynadot decides what's objectionable. Now, if you go to my website at www.complete.org or blog at changelog.complete.org, you'll see I'm an upstanding netizen. But the AUP says that things that "are designed to or effectively... embarrass" third parties could get my domain cancelled. So if I post a review of Vista that says I think Microsoft did a poor job of engineering, would my account be yanked if one of their engineers complained? What if I (legally!) linked to a Comedy Central sketch using real TV footage to mock George W. Bush or Hillary Clinton?
The cases you described above would never happen with us. Complaining about Microsoft or making fun of George Bush are protected free speech. The service agreement is designed to give us some flexibility in dealing with customers that break the law.
I'm particularly concerned about this because apparently DynaDot felt it worthwhile to try to take down the website of someone that found a security hole: http://www.jhuskisson.com/friends/dynadot-fights-back-bans-nick-from-everything
While I wouldn't condone step-by-step cracking instructions in most cases, this is concerning to me.
He was posting a step by step guide to hacking our website, which is illegal. The hack did not work, but we noticed an upsurge in strange activity in our logs, so we requested the hacking guide be taken down.
Finally, item (i) under the Domain Privacy Service section says that you could immediately reveal all my information upon the receipt of merely a *claim* (not even a court order), even if it's invalid. But I thought that NOT doing this was what you were saying made your service better, over at http://www.dynadot.com/resource/article/qa.html?aid=0
Once again we need to build some flexibility into our service agreement to deal with people who use their domains for criminal activity. Otherwise we could be liable for the damages that they cause to others. So far, we have never dropped anyones privacy except in the few cases we were forced to by a FBI subpoena.
I know this is a long message, and I appreciate your time. I really do want to use your service, but -- no offense intended -- I want to make sure I'm not dealing with scammers first, and from reading the AUP, I'm not so sure!
No offence taken. I will email our counsel to see if we can tighten up the agreement a bit.
-- John Goerzen
My FOSDEM talk didn't go entirely as planned. I tried to run a demo
of the beid packages, but unfortunately they decided to play up
again. This isn't the first time; they sometimes have this. It has
something to do with OpenSC or OpenCT, I believe, but it's hard to
figure out what, exactly. When I got back at the office with the machine
that failed to work properly, and tried again, it did work.
Heisenbugs suck. Pun
intended.
Anyway, since things work now, I prepared a screencast
showing off what I wanted to show during the talk; it takes about 8
minutes. I was going to edit the talk to hide the spammer who was
DoS'ing my mailserver just as I was trying to send an email out, and
perhaps to hide away the long waits at times; but I didn't find an easy
way to do so, and I got tired looking. If you're interested, have a
look.
Also, the screencast doesn't include any sound. This is because I
couldn't find any piece of equipment on which istanbul would produce
correct imagery (it appears to be buggy on powerpc), where the hardware
was fast enough to capture and encode both a video at 1024x768
resolution and sound from the sound card (ruling out "anything", the
machine on which I tried to do the presentation at FOSDEM), and
on which the microphone would actually work (ruling out the amd64 box
that was standing nearby). Since I could at least create a correct movie
on the last machine, I just forgot about the sound. Instead, I tried to
make the screencast show what was going on, by pointing at important
tidbits with my mouse pointer.
Which kindof worked, but was not ideal. Oh well.
Today I've noticed that my last post was on August and I've decided that I'm
going to try to keep this blog alive.
Since this summer I've left the University and now I only have two jobs... my
daily work and my son; I believe that things are going better at a personal
level, but the truth is that lately I have near zero time to devote to Debian
and Free Software in general.
As I don't want to leave the FLOSS world and I'm still able to do some
sysadmin related tasks at work and at home I've decided that I'll try to
reserve some time for blogging about them.
I'm also thinking about starting a blog and a wiki in Spanish, mainly to be
able to publish some of the documents I write at work about our installations,
the advantage for me is that I can publish them with a little revision and
that is much faster than translating them into English.
Anyway, before creating new blogs my first task is to finish my home server
migration; I'm moving all the services that were running on my old PowerBook
(PowerPC @ 400Mhz, 378MB of RAM, 10 GB HD) to my other PowerBook (PowerPC @
1Ghz, 768MB of RAM, 60GB HD), as I haven't used it for ages and I still use a
lot the old machine.
On the move I plan to change a lot of things, the machine is going to run
multiple vservers and I plan to change a lot of the software I was using,
always trying to simplify the maintenance and/or get more performance from the
new machine:
First time ever I have been at a conference and attending so few talks. Needed to talk to sooo many people.
But anyways, it was quite interesting to put some faces of the people I kind of work with. Especially my favourite kde upstream people.
So many keys to sign, but I guess I am finally thru it. If you are expecting a signature from me and haven’t got one yet, please check your spam filters and/or try poke me. I guess I will keep my paper notes a couple of days before ditching them.
Beer event was bigger this year, but still too crowded. Fosdem is also quite crowded - so crowded that I missed some talks because of it.
But anyway, see you next year - probably.
Sometimes a bug report is a labyrinth. 
1. After several years of it sitting on my shelf, I finally read Kernighan and Pike's "The Practice of Programming". I was always a little intimidated by this slender little book. I felt like it was full of wisdom that I couldn't really absorb at the right pace. Now that I've spent some time working on more challenging code and trying to come to grips with at the least the basics of more advanced computing concepts it was the right time to read it. I can't recommend it highly enough, it really is packed with wisdom. I've got Kernighan's "Software Tools" on the way, and I'll post a proper review of this at some point since it's not as well known.
I'm (again) writing a library that is supposed to be cross-platform, but needs sort of an event loop, which I'd rather leave in the main program and just give them a bunch of file descriptors to watch and a timeout.
Problem is, file descriptors are platform dependent.
There are a few approaches to this. The mighty ASIO simply annexes the entire loop, and just tells people to hook into it if they need anything -- it works, but on the downside you get threads for free when you didn't want or need them.
Simply spawning a new thread for everyone isn't a solution either, as it requires me to do lots of synchronised inter-thread communication -- and on Windows, file handles are thread affine, so I cannot even call into the same library from different threads.
I will probably go with ASIO for this project, but I'm fairly certain that there are better solutions out there.
Although an interim release, there are a number of new features in 0.8.2 that are worth noting.
