[wildcard-comments] Sept. 21 response shows that VeriSign is extremely irresponsible

["Bryan Curnutt" <bcurnutt@xxxxxxxx>]

One of the most disturbing things about this incident was this section of
VeriSign's September 21 response to ICANN:

    As to your call for us to suspend the service, I would respectfully
    suggest that it would be premature to decide on any course of action
    until we first have had an opportunity to collect and review the
    available data. After completing an assessment of any operational
    impact of our wildcard implementation, we will take any appropriate
    steps necessary.

A responsible entity would, of course, study the potential impact of the
changes first, and _then_ deploy them.

Deploying SiteFinder without sufficient regard for its impact on Internet
operation was irresponsible enough, but to refuse to suspend the service
while espousing a design philosophy of "throw it on the Internet and then
see whether it hurts anything badly enough that we need to remove it" is
flagrantly and _purposefully_ irresponsible.

I find this operational policy deeply disturbing, given VeriSign's position.
Any I.T. department which followed similar principles on a company's
business-critical network, or any consulting company which followed a
similar practice on its clients' networks, would undoubtedly find its
working relationship terminated rather quickly.

-- 
Bryan Curnutt
Director of I.T.
Salu, Inc.
... but any opinions expressed herein are mine and mine alone