It does, but you also lose 100% of the accountability. eMudhra is leaving this business because the root programs are about to humiliate them. There are no programs anywhere that can do the same thing to a major TLD operator.

▲

kensey 2 hours ago | parent [-]

If ICANN decides you no longer operate the TLD, and takes your name servers out of the root server zones and replaces them with somebody else's... you don't run that TLD any more, sorry, go have a good cry and then see if maybe running a hot dog stand is more your speed. DNSSEC is one of the services ICANN considers critical enough to take away your TLD stewardship if you aren't providing that service properly.

Of course we wouldn't want ICANN to do that on a whim, or without having a new operator for the TLD ready to go, but there's already process defined for both planned and emergency transfers of operation of a TLD:

https://www.icann.org/en/contracted-parties/registry-operato...

▲

tptacek 2 hours ago | parent [-]

ICANN is not going to tell the USG (or, for identical reasons, Verisign) that it no longer operates .COM. This particular deus ex machina is fanciful.

▲

kensey 2 hours ago | parent [-]

You don't think so? In a scenario where it becomes known the US government is actively subverting Verisign to tamper with DNSSEC integrity (or where Verisign just screwed up badly enough to make their continued stewardship untenable, and I think either case would become known, in pretty short order), I absolutely think ICANN would expatriate .com. If they didn't, they would lose legitimacy with everybody who isn't the US government. That leads to at best an international effort to replace ICANN and at worst the splintering of the DNS root. Nobody wants either of those scenarios -- the least-damaging thing for the Internet and for ICANN as an organization would indeed to be to take .com away and let say, the British run it for awhile. (Maybe you could get your .com domain registrations at Sainsbury's, in the aisle next to the anti-demon plant misters.)

Which is exactly the kind of scenario a lot of people hyperventilated about back when ICANN was formed, for reasons of varying validity, but in this case it would indeed be the least-worst option all around.

	▲	toast0 an hour ago \| parent \| next [-]
		> In a scenario where it becomes known the US government is actively subverting Verisign to tamper with DNSSEC integrity (or where Verisign just screwed up badly enough to make their continued stewardship untenable, and I think either case would become known, in pretty short order), I absolutely think ICANN would expatriate .com ICANN is an organization headquartered in California ... I don't see how they can redelegate .com without approval of the feds. IMHO, that isn't that compelling of an argument against domain hierarchy certificate issuance. If the feds want to mess with your .com today, they can and then they can get a cert from any CA. Adding a dependency on CAs doesn't remove the dependency on the TLD operator. If you wanted to stick with x.509 certs and you had an ICANN root that would sign Name Constrained TLD intermediate(s), and the registry would sign name constrained Domain Intermediates, and all those require certificate transparency, then we'd be about where we are with WebPKI, but without trusting any parties you don't already have to trust.
	▲	tptacek an hour ago \| parent \| prev [-]
		I am 100% confident that .COM will not be rescued from law enforcement and national security surveillance by ICANN, yes. You can disagree! But then: let's just keep the premises clear. You think DNSSEC makes sense because you also think states will lose control over their registry operators.