March 2001 - Test - lists.nanog.org

Re: Statements against new.net?
by Steven M. Bellovin 14 Mar '01

14 Mar '01

In message <Pine.BSF.4.21.0103131054220.42622-100000@localhost>, Patrick Greenw ell writes: (Portions of post elided, in the name of brevity.) > >The fact that there currently exists several different operations root >server networks(ORSC, Pacific Root, Name.Space) to name a few. In fact, >if you ask ICANN board member Karl Auerbach, he'll tell you he uses the ORSC >root servers. > >To be clear I am not arguing the merits of any of these particular >efforts, but simply that they exist, are operational, and as of yet the >"Internet" has not come crashing down upon anyones head. > >Were you not aware of the existence of one or more such organizations when >the IAB formulated this document? > .... > >What exactly was the motivation for such a document if not political, >especially given the timing? Of course we were aware of such efforts -- that's precisely why we wrote the document, to warn that they were bad ideas. And the fact that the Internet "has not come crashing down upon anyones head" is due to their very limited deployment. The Internet is quite large; local disruptions *usually* don't affect most of the net. > ... > >Second, the alternative root server operators have attempted to address >this issue through communication/negotiation, like responsible members of >any community would. My understanding through following the various >mailing lists is that the majority of conflicts have been resolved in this >fashion. Where there is a refusal to communicate, or where conflict still >remains, the various operators act as they best see fit. I understand that >a community-based approach to "claim-staking"/conflict resolution makes >the "command and control" crowd a bit uncomfortable(witness some of the >virulant posters on the subject of new.net, et al.,) but this does nothing >to change the fact that these alternative root server networks exist and >that the Internet still works, mostly(as I'm sure you'd agree it's always >a little broken.) If our statement has advocated "command and control" as opposed to consensus-based design of the root, it would indeed have been a political statement. But it didn't say that. It said that there needs to be one root, regardless of how that is chosen. The notion that "the various operators act as they best see fit" is precisely the kind of thing we want to discourage, since that leads towards inconsistency. --Steve Bellovin, http://www.research.att.com/~smb

4 3

Re: Statements against new.net?
by Steven M. Bellovin 14 Mar '01

14 Mar '01

In message <LLEOLJEDPHOFANPCPKOMGEAPCCAA.mikebat(a)tmcs.net>, "Mike Batchelor" wr ites: > >> Now - I'll *readily* agree that "ICANN versus new.net" is political, >> and probably worth discussing. However, I'm going to have to start >> putting Bozo Flags on people who *still* claim that RFC2826 is political >> just because it points out that Things Will Provably Break if you have >> conflicting roots. > >Well DUH! I totally agree that conflicting roots break things. But I don't >think that conflicting roots is an inevitable consequence of having multiple >roots, or even multiple root zones. > >I still say it's a self-serving statement with political motivations, and I >hope I have adequately explained why I think that. I don't expect you to >agree with me, but I hope I'm not as Bozotic as you thought at first. I'm sorry -- I still don't see your point. We agree that conflicts are bad. *All* RFC 2826 says is that you need to agree on the root zone, assuming that you agree that there's a conflict between a delegation and non-existence of a zone. 2826 says *nothing* about where that zone comes from, how you agree on it, etc. It does not mandate ICANN. It does not mandate the current 13 root servers (though I'll note that that limit comes from the 512-byte limit on DNS packets, and that DNS cache contamination means that you may end up believing in different root *servers* than you thought you believed in, if you send the wrong query to a site that adheres to a different root religion). If you can build a *working* root zone with no conflicts -- full agreement on what all the TLDs are and to whom they're delegated; no conflicting claims (and delegations) to the One True .xxx; no dissatisfied people stomping off and building the Even More Open Pacific Root Zone Conglomerate -- it will be in full compliance with 2826 and I won't have a single technical complaint. To be sure, I might have my doubts that you can build such a thing, especially the part about no conflicts -- but I've been saying ever since this whole topic came up that the worst possible outcome was more than one root. Nothing that has happened in the interim has changed my mind about that. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Broken Internet?
by Peter Francis 14 Mar '01

14 Mar '01

Those T1's can be run directly into your colo as a "private" network. Peter At 8:21 PM -0600 3/13/01, Nathan Mills wrote: >On Tue, 13 Mar 2001, Peter Francis wrote: > >> No. Co-lo your website and "intranet". Get two T1's that same provider via two different entry points/carriers to your office (if possible) and you should be about as rock solid you could expect for $2-3000/month or there abouts. > >And how, pray tell, do you plan to have 5 data-entry clerks sitting in a >colo entering their data? The colo doesn't help a damn if you can't get >the orders back to your warehouse or if you can't get the data up to the >server, now does it? > >-Nathan

1 0

The Meat of The Matter
by Timothy R. McKee 14 Mar '01

14 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Let's cut to the meat of the 'New.Net' matter... Essentially we, the ISP community, are being invited to help a wanna-be commercial registrar establish a new monopoly (read as 'gold-mine'), not on just a couple of TLDs, but on a LOT of TLDs... I would be one of the first to lament the failure of ICANN to establish new, logically laid out TLDs... But this is NOT the way to force a solution, it will simply result in massive headaches for all of our NOCs and Tech Support organizations as they attempt to explain the resulting mess to John Q. Corporate User. (Maybe all the resultant Tech Support hires will help the unemployment situation??!!) I think it's time for all of us that will end up having to deal with this mess to stand up and say NOT ONLY NO, BUT HELL NO! Tim McKee -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBOq7FzBRIXzEQLahvEQLWnACg7dBT2HFbRuquf6RoHlva0fQDoRkAoKAC e/tc8Xh2Ahz9I8AaJ59RjOKT =9EGr -----END PGP SIGNATURE-----

1 0

RE: Statements against new.net?
by Mathew Butler 14 Mar '01

14 Mar '01

(My comments interspersed) -----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] > To remain a global network, the Internet requires the > existence of a > globally unique public name space. The DNS name space is a > hierarchical name space derived from a single, globally > unique root. > This is a technical constraint inherent in the design of the DNS. False. It is not a constraint, it results from a restricted implementation. --My Comment-- And how would you propose unrestricting this implementation? The DNS design is ratified as an Internet Standard. --End My Comment-- >That one root must be > supported by a set > of coordinated root servers administered by a unique naming > authority. This statement is a pure non-technical value-judgement, supporting the legacy implementation, and is entirely self-serving. Of course, this statement, itself, is also a value-judgement. However, note that the defeat of the false premise, and it's direct improper conclusion, make this statement a pure political phrase. --My Comment-- The DNS SOA record specifies a single point of contact for all failures related to the zone, as well as the name of the true master of the zone. Yes, it's possible for there to be an arbitration authority who is ultimately responsible for the root zone, but THERE IS A SINGLE AUTHORITY WHO IS RESPONSIBLE FOR THE ZONE. Read that statement again. Be it a corporation, a partnership, or an individual person (such as Jon Postel, may he rest in peace), there is ONE single authority. There -must- be, as a purely operational issue -- just as there must be a single POC for a NOC for a backbone transit provider. Or else nobody will use it, due to the issues involved in trying to coordinate between two or more authorities. Miscommunication == Downtime. Miscommunication Between Parts of the Authority == More Downtime. Downtime is Unacceptable in the Root. --End My Comment-- > Put simply, deploying multiple public DNS roots would raise a very > strong possibility that users of different ISPs who click > on the same > link on a web page could end up at different destinations, against > the will of the web page designers. This entire paragraph is a NOP. Webpage designers would never link to external resources under such condition as stated here. Those that do, deserve to get appendages whacked. --My Comment-- How would you propose to resolve this problem? Without a SINGLE point of authority for the Root, there is no one person/organization/etc who is ultimately responsible for the shape or design. Which means that there is Confusion. From Confusion comes Chaos and Politics... in the old days, when it was primarily a technical decision, the Techs could deal with it. Now, with Users and Politicians and Managers (collectively Chaosmongers), the Order (such as it is) of the Techs will not be heard. --End My Comment-- You really should calm down. I use external programs to build db.root.zone files, from external sources. All of the ORSC agrees to the core TLDs, which includes the legacy roots, and there are dispute proceedures for handeling collisions. --My Comment-- That's fine, but ORSC doesn't attempt to hijack any TLDs that were already claimed and invested into by other entities. You choose to use your own root -- this means that your "private" TLDs will not be visible to people outside of the ORSC's sphere of authority -- that's the risk and choice that you have made. But as soon as your "private" TLDs are taken over by another corporation/entity that can make deals to hijack them in the public eye, you're probably going to be raising bloody hell. Also, how many webpages actually refer to the ORSC's TLDs? --End My Comment-- > RFC2826 SAYS YOU HAVE TO CHOOSE FOR YOURSELF. Which is more important > to *YOU*? 100% consistency with the rest of the world, or access to > your private name space? *YOU* evaluate, *YOU* choose, and RFC2826 is > nice enough to point out the problems you'll encounter. It is not at all an either/or situation. There *is* the path of "accommodation". --My Comment-- Indeed... but will other people accommodate -you-? --End My Comment

1 0

RE: Broken Internet? [OT]
by Karyn Ulriksen 13 Mar '01

13 Mar '01

Yeah. Just think of us as the "pork bellies" of the twenty first century. K -----Original Message----- From: Mathew Butler [mailto:mbutler@tonbu.com] Sent: Tuesday, March 13, 2001 1:37 PM To: 'Roeland Meyer'; 'Patrick Greenwell'; Steven M. Bellovin Cc: nanog(a)merit.edu Subject: RE: Broken Internet? [OT] *ponders* Is it possible that our technical solutions are at least contributorially responsible for the economic slowdown? (Small businesses can't get connected, so large numbers of high-money dotcoms get massive amounts of funding, but few of them can make any money, so their debts skyrocket, and the massive power shifts happen?) Don't mind me, I'm just pondering. -Mat -----Original Message----- From: Roeland Meyer [ mailto:rmeyer@mhsc.com <mailto:rmeyer@mhsc.com> ] Sent: Tuesday, March 13, 2001 12:53 PM To: 'Patrick Greenwell'; Steven M. Bellovin Cc: nanog(a)merit.edu Subject: Broken Internet? > From: Patrick Greenwell [ mailto:patrick@cybernothing.org <mailto:patrick@cybernothing.org> ] > Sent: Tuesday, March 13, 2001 11:29 AM > to change the fact that these alternative root server > networks exist and > that the Internet still works, mostly(as I'm sure you'd agree > it's always a little broken.) That is an understatement (a little broken). I have just been introduced to one of those broken areas, the hard way. Given: 1. Prefix filtering at /20. 2. Most small busineses limited to /24, by policy/procedure. 3. Multi-homing requirements for multi-office businesses (many SOHO's). 4. Impending business failure of many DSL ISPs. 5. Total lack of responsibile behavior among DSL access providers. It is next to impossible for a small business to have reliable internet connectivity without moving into a large co-lo. Even if they can afford the multiple T1's, they can't get portable IP addresses that will be advertised reliably. Many of them need, at most, a pair of /24's and ARIN, knowing this, will not issue them portable blocks larger than /24 without severe justification requirements. Many of you might think that is okay, but what if their upstream dies off (as recently happened to MHSC). In the current day and age, business stops until they get reconnected. This disconnect is at minimum, 4-6 weeks, under the best of circumstances. As one vendor recently pointed out in their adverts, most businesses, down for more than 14 days, will never survive. More importantly, such an outage flat-lines the revenue picture for that entire fiscal quarter, for the unlucky victim. What we have today is a manufactured dependence on a single upstream provider and no way to multi-home. Even co-lo boils down to single-home dependency. Yes, there are a bunch of hacks to work around this problem. But, that is exactly what they are ... hacks. They are not something I could build a sustainable business around. Any business needs: 1. to be able to change upstream providers without having to renumber. 2. to be able to change access providers without having to suffer multi-month down-times. 3. to be able to have its net-block(s) visible regardless of which ISPs they are currently using. Currently the only ones that can do that are those that; 1. Are large enough to justify a /20 (begging the question of how they got that large). 2. Can afford their own datacenter. It looks like our technical solutions are raising unreasonable barriers to entry for small businesses.

1 0

RE: Broken Internet? [OT]
by Mathew Butler 13 Mar '01

13 Mar '01

*ponders* Is it possible that our technical solutions are at least contributorially responsible for the economic slowdown? (Small businesses can't get connected, so large numbers of high-money dotcoms get massive amounts of funding, but few of them can make any money, so their debts skyrocket, and the massive power shifts happen?) Don't mind me, I'm just pondering. -Mat -----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] Sent: Tuesday, March 13, 2001 12:53 PM To: 'Patrick Greenwell'; Steven M. Bellovin Cc: nanog(a)merit.edu Subject: Broken Internet? > From: Patrick Greenwell [mailto:patrick@cybernothing.org] > Sent: Tuesday, March 13, 2001 11:29 AM > to change the fact that these alternative root server > networks exist and > that the Internet still works, mostly(as I'm sure you'd agree > it's always a little broken.) That is an understatement (a little broken). I have just been introduced to one of those broken areas, the hard way. Given: 1. Prefix filtering at /20. 2. Most small busineses limited to /24, by policy/procedure. 3. Multi-homing requirements for multi-office businesses (many SOHO's). 4. Impending business failure of many DSL ISPs. 5. Total lack of responsibile behavior among DSL access providers. It is next to impossible for a small business to have reliable internet connectivity without moving into a large co-lo. Even if they can afford the multiple T1's, they can't get portable IP addresses that will be advertised reliably. Many of them need, at most, a pair of /24's and ARIN, knowing this, will not issue them portable blocks larger than /24 without severe justification requirements. Many of you might think that is okay, but what if their upstream dies off (as recently happened to MHSC). In the current day and age, business stops until they get reconnected. This disconnect is at minimum, 4-6 weeks, under the best of circumstances. As one vendor recently pointed out in their adverts, most businesses, down for more than 14 days, will never survive. More importantly, such an outage flat-lines the revenue picture for that entire fiscal quarter, for the unlucky victim. What we have today is a manufactured dependence on a single upstream provider and no way to multi-home. Even co-lo boils down to single-home dependency. Yes, there are a bunch of hacks to work around this problem. But, that is exactly what they are ... hacks. They are not something I could build a sustainable business around. Any business needs: 1. to be able to change upstream providers without having to renumber. 2. to be able to change access providers without having to suffer multi-month down-times. 3. to be able to have its net-block(s) visible regardless of which ISPs they are currently using. Currently the only ones that can do that are those that; 1. Are large enough to justify a /20 (begging the question of how they got that large). 2. Can afford their own datacenter. It looks like our technical solutions are raising unreasonable barriers to entry for small businesses.

2 1

Re: Statements against new.net?
by owen＠dixon.delong.sj.ca.us 13 Mar '01

13 Mar '01

> Are we going to have to go back to %hacking domain names, such as: > > foobar.tvshow%ORSC, > foobar.tvshow%MSN, > foobar.tvshow%AOL, > foobar.tvshow%ICANN, > foobar.tvshow%pacificroot, > foobar.tvshow%new.net, > foobar.tvshow%name.space > > and so on? > That doesn't solve the problem. The % is not effectively different from the . in your example, and if you replace % with ., it becomes quite obvious that you've just inserted a new top-level. Once you've done that, who controls who gets ICAN vs. AOL vs. MSN, and the problem repeats. Anyone who decides to run a competing root for resolving these hack-names and voila, now foobar.tvshow%AOL means different things depending on where you resolve %AOL to. > > Were you not aware of the existence of one or more such organizations when > > the IAB formulated this document? > > I am *not* privy to IAB deliberations, but I'm fairly sure that they were > painfully aware of their existence - the IAB doesn't issue documents in > a vacuum. RFC2826 was issued because the IAB was aware if their existence. > > I fail to see how RFC2826 is in any way "political". Upon careful re-reading > it boils down to: > > If you use one root, everybody agrees what things look like. > > If you use multiple roots, what people will see depends on which root they ask. > > How is this political? It becomes political when it goes beyond those two statements and says "Since these two statements are true, everyone should use one root." It becomes completely political when it expands that to encompass the concept of "ICANN root is the one true root. Thou shall have no other root before me." While I agree that having one true root is good, and that for the time being, that should be the ICANN root, the bottom line is that whether we like it or not, that is, indeed, a political issue and not a technical one. Sure, the desire to have one root is driven by technical merits. However, how that root is chosen, which root it is, and who gets to decide are all political issues. The fact that the current method of choice is "It's the one that has been there the longest" doesn't change the fact that it is a method of choice, and that it is a political issue. Owen

4 3

Re: Statements against new.net?
by Sean Donelan 13 Mar '01

13 Mar '01

On Tue, 13 March 2001, "Steven M. Bellovin" wrote: > Put simply, deploying multiple public DNS roots would raise a very > strong possibility that users of different ISPs who click on the same > link on a web page could end up at different destinations, against > the will of the web page designers. Its not really the "will of the web page designers." If this becomes popular, I suspect most web page designers will start using dotted-quad addresses inside their HTML URLs on their web pages. So clicking on a link on a web page will go to were the web page designer directs you. Except for NAT strangeness, IP Address are mostly globally unique. The issue is really one of user expectations. Some class of users have developed the expectation if they type some words resembling what they are looking for in the "address" prompt of their web browser, they will get taken to someplace they want. Web browser companies (e.g. Netscape, Microsoft) have reinforced this perception by automagically transforming the user's input into something else. Type "white house" into Internet Explorer 5.5's address prompt, and watch what happens. Netscape's browser has transformed any single word "XXXXXX" into http://www.XXXXXXX.com/ for a while.

3 2

RE: Statements against new.net?
by Roeland Meyer 13 Mar '01

13 Mar '01

> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Tuesday, March 13, 2001 1:14 PM > On Tue, 13 Mar 2001 12:54:42 PST, Roeland Meyer said: > > By the sheer fact that they included a non-technical value-judgment. > > OK.. I'm going to cite chapter and verse: You might want to calm down a bit. I'm out of the game now anyway (at least, this round). BTW, I read the original when it was first published. There is zero technical content, in the original. to whit; > Summary > > To remain a global network, the Internet requires the > existence of a > globally unique public name space. The DNS name space is a > hierarchical name space derived from a single, globally > unique root. > This is a technical constraint inherent in the design of the DNS. False. It is not a constraint, it results from a restricted implementation. > Therefore it is not technically feasible for there to be more than > one root in the public DNS. Improper conclusion based on a false premise. SRS has shown that root-root synchronization can happen. Probably easier than TLD-TLD syncs, because the rate of change is much lower. That's a real-world-and-already-widely-implemented example for you. It gets better, SRS was already widely deployed BEFORE the IAB published their comment. They just had trouble connecting the dots. >That one root must be > supported by a set > of coordinated root servers administered by a unique naming > authority. This statement is a pure non-technical value-judgement, supporting the legacy implementation, and is entirely self-serving. Of course, this statement, itself, is also a value-judgement. However, note that the defeat of the false premise, and it's direct improper conclusion, make this statement a pure political phrase. > Put simply, deploying multiple public DNS roots would raise a very > strong possibility that users of different ISPs who click > on the same > link on a web page could end up at different destinations, against > the will of the web page designers. This entire paragraph is a NOP. Webpage designers would never link to external resources under such condition as stated here. Those that do, deserve to get appendages whacked. > This does not preclude private networks from operating their own > private name spaces, but if they wish to make use of names uniquely > defined for the global Internet, they have to fetch that > information > from the global DNS naming hierarchy, and in particular from the > coordinated root servers of the global DNS naming hierarchy. > > OK? Read that. Read it again. Read it a third time. *ALL* that > says is "If you want to agree what the DNS tree looks like, you have > to share a root. If you want your own view, use your own root. > That's the way DNS is. You're stuck with the fact that DNS works > that way. You have to make your own choice which root to use". You really should calm down. I use external programs to build db.root.zone files, from external sources. All of the ORSC agrees to the core TLDs, which includes the legacy roots, and there are dispute proceedures for handeling collisions. > RFC2826 SAYS YOU HAVE TO CHOOSE FOR YOURSELF. Which is more important > to *YOU*? 100% consistency with the rest of the world, or access to > your private name space? *YOU* evaluate, *YOU* choose, and RFC2826 is > nice enough to point out the problems you'll encounter. It is not at all an either/or situation. There *is* the path of "accommodation". > Now, what non-technical value judgment did you say that RFC2826 was > making for you? It's not a "value judgment" that using multiple roots > with DNS results in inconsistencies, it's *the way DNS works*. see above. > I suppose the *next* thing we'll see is people complaining that the > concept of CIDR is an evil value judgement, because you need > to decide what > aggregation to do in order to keep the routing table a > manageable size. I already have my complaints about CIDR. It is NOT the same and let's not go there right now. > Now - I'll *readily* agree that "ICANN versus new.net" is political, > and probably worth discussing. However, I'm going to have to start > putting Bozo Flags on people who *still* claim that RFC2826 > is political > just because it points out that Things Will Provably Break if you have > conflicting roots. It doesn't say what you think. Do a logical analysis of the docuemnt after removing all pre-judgements. The document is not self-standing. This is the first clue that it is a political document. Granted, some of the issues are that of word-smithing, but that is even more clue that it shouldn't be taken as "gospel". If you look at is from the perspective of a system designer/architect, you will see the holes readily. If you perform a permutations analysis, you will see that they've walled-off many branches for no good reason (possibly, convenience). A good design includes all the permutations of all parts of the requirements matrix. Including, implied requirements that aren't stated. A robust design doesn't include arbitrary limitations.

2 1