- Test - lists.nanog.org

RE: Statements against new.net?
by Mathew Butler 14 Mar '01

14 Mar '01

(My comments interspersed) -----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] > To remain a global network, the Internet requires the > existence of a > globally unique public name space. The DNS name space is a > hierarchical name space derived from a single, globally > unique root. > This is a technical constraint inherent in the design of the DNS. False. It is not a constraint, it results from a restricted implementation. --My Comment-- And how would you propose unrestricting this implementation? The DNS design is ratified as an Internet Standard. --End My Comment-- >That one root must be > supported by a set > of coordinated root servers administered by a unique naming > authority. This statement is a pure non-technical value-judgement, supporting the legacy implementation, and is entirely self-serving. Of course, this statement, itself, is also a value-judgement. However, note that the defeat of the false premise, and it's direct improper conclusion, make this statement a pure political phrase. --My Comment-- The DNS SOA record specifies a single point of contact for all failures related to the zone, as well as the name of the true master of the zone. Yes, it's possible for there to be an arbitration authority who is ultimately responsible for the root zone, but THERE IS A SINGLE AUTHORITY WHO IS RESPONSIBLE FOR THE ZONE. Read that statement again. Be it a corporation, a partnership, or an individual person (such as Jon Postel, may he rest in peace), there is ONE single authority. There -must- be, as a purely operational issue -- just as there must be a single POC for a NOC for a backbone transit provider. Or else nobody will use it, due to the issues involved in trying to coordinate between two or more authorities. Miscommunication == Downtime. Miscommunication Between Parts of the Authority == More Downtime. Downtime is Unacceptable in the Root. --End My Comment-- > Put simply, deploying multiple public DNS roots would raise a very > strong possibility that users of different ISPs who click > on the same > link on a web page could end up at different destinations, against > the will of the web page designers. This entire paragraph is a NOP. Webpage designers would never link to external resources under such condition as stated here. Those that do, deserve to get appendages whacked. --My Comment-- How would you propose to resolve this problem? Without a SINGLE point of authority for the Root, there is no one person/organization/etc who is ultimately responsible for the shape or design. Which means that there is Confusion. From Confusion comes Chaos and Politics... in the old days, when it was primarily a technical decision, the Techs could deal with it. Now, with Users and Politicians and Managers (collectively Chaosmongers), the Order (such as it is) of the Techs will not be heard. --End My Comment-- You really should calm down. I use external programs to build db.root.zone files, from external sources. All of the ORSC agrees to the core TLDs, which includes the legacy roots, and there are dispute proceedures for handeling collisions. --My Comment-- That's fine, but ORSC doesn't attempt to hijack any TLDs that were already claimed and invested into by other entities. You choose to use your own root -- this means that your "private" TLDs will not be visible to people outside of the ORSC's sphere of authority -- that's the risk and choice that you have made. But as soon as your "private" TLDs are taken over by another corporation/entity that can make deals to hijack them in the public eye, you're probably going to be raising bloody hell. Also, how many webpages actually refer to the ORSC's TLDs? --End My Comment-- > RFC2826 SAYS YOU HAVE TO CHOOSE FOR YOURSELF. Which is more important > to *YOU*? 100% consistency with the rest of the world, or access to > your private name space? *YOU* evaluate, *YOU* choose, and RFC2826 is > nice enough to point out the problems you'll encounter. It is not at all an either/or situation. There *is* the path of "accommodation". --My Comment-- Indeed... but will other people accommodate -you-? --End My Comment

1 0

RE: Broken Internet? [OT]
by Karyn Ulriksen 13 Mar '01

13 Mar '01

Yeah. Just think of us as the "pork bellies" of the twenty first century. K -----Original Message----- From: Mathew Butler [mailto:mbutler@tonbu.com] Sent: Tuesday, March 13, 2001 1:37 PM To: 'Roeland Meyer'; 'Patrick Greenwell'; Steven M. Bellovin Cc: nanog(a)merit.edu Subject: RE: Broken Internet? [OT] *ponders* Is it possible that our technical solutions are at least contributorially responsible for the economic slowdown? (Small businesses can't get connected, so large numbers of high-money dotcoms get massive amounts of funding, but few of them can make any money, so their debts skyrocket, and the massive power shifts happen?) Don't mind me, I'm just pondering. -Mat -----Original Message----- From: Roeland Meyer [ mailto:rmeyer@mhsc.com <mailto:rmeyer@mhsc.com> ] Sent: Tuesday, March 13, 2001 12:53 PM To: 'Patrick Greenwell'; Steven M. Bellovin Cc: nanog(a)merit.edu Subject: Broken Internet? > From: Patrick Greenwell [ mailto:patrick@cybernothing.org <mailto:patrick@cybernothing.org> ] > Sent: Tuesday, March 13, 2001 11:29 AM > to change the fact that these alternative root server > networks exist and > that the Internet still works, mostly(as I'm sure you'd agree > it's always a little broken.) That is an understatement (a little broken). I have just been introduced to one of those broken areas, the hard way. Given: 1. Prefix filtering at /20. 2. Most small busineses limited to /24, by policy/procedure. 3. Multi-homing requirements for multi-office businesses (many SOHO's). 4. Impending business failure of many DSL ISPs. 5. Total lack of responsibile behavior among DSL access providers. It is next to impossible for a small business to have reliable internet connectivity without moving into a large co-lo. Even if they can afford the multiple T1's, they can't get portable IP addresses that will be advertised reliably. Many of them need, at most, a pair of /24's and ARIN, knowing this, will not issue them portable blocks larger than /24 without severe justification requirements. Many of you might think that is okay, but what if their upstream dies off (as recently happened to MHSC). In the current day and age, business stops until they get reconnected. This disconnect is at minimum, 4-6 weeks, under the best of circumstances. As one vendor recently pointed out in their adverts, most businesses, down for more than 14 days, will never survive. More importantly, such an outage flat-lines the revenue picture for that entire fiscal quarter, for the unlucky victim. What we have today is a manufactured dependence on a single upstream provider and no way to multi-home. Even co-lo boils down to single-home dependency. Yes, there are a bunch of hacks to work around this problem. But, that is exactly what they are ... hacks. They are not something I could build a sustainable business around. Any business needs: 1. to be able to change upstream providers without having to renumber. 2. to be able to change access providers without having to suffer multi-month down-times. 3. to be able to have its net-block(s) visible regardless of which ISPs they are currently using. Currently the only ones that can do that are those that; 1. Are large enough to justify a /20 (begging the question of how they got that large). 2. Can afford their own datacenter. It looks like our technical solutions are raising unreasonable barriers to entry for small businesses.

1 0

RE: Broken Internet? [OT]
by Mathew Butler 13 Mar '01

13 Mar '01

*ponders* Is it possible that our technical solutions are at least contributorially responsible for the economic slowdown? (Small businesses can't get connected, so large numbers of high-money dotcoms get massive amounts of funding, but few of them can make any money, so their debts skyrocket, and the massive power shifts happen?) Don't mind me, I'm just pondering. -Mat -----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] Sent: Tuesday, March 13, 2001 12:53 PM To: 'Patrick Greenwell'; Steven M. Bellovin Cc: nanog(a)merit.edu Subject: Broken Internet? > From: Patrick Greenwell [mailto:patrick@cybernothing.org] > Sent: Tuesday, March 13, 2001 11:29 AM > to change the fact that these alternative root server > networks exist and > that the Internet still works, mostly(as I'm sure you'd agree > it's always a little broken.) That is an understatement (a little broken). I have just been introduced to one of those broken areas, the hard way. Given: 1. Prefix filtering at /20. 2. Most small busineses limited to /24, by policy/procedure. 3. Multi-homing requirements for multi-office businesses (many SOHO's). 4. Impending business failure of many DSL ISPs. 5. Total lack of responsibile behavior among DSL access providers. It is next to impossible for a small business to have reliable internet connectivity without moving into a large co-lo. Even if they can afford the multiple T1's, they can't get portable IP addresses that will be advertised reliably. Many of them need, at most, a pair of /24's and ARIN, knowing this, will not issue them portable blocks larger than /24 without severe justification requirements. Many of you might think that is okay, but what if their upstream dies off (as recently happened to MHSC). In the current day and age, business stops until they get reconnected. This disconnect is at minimum, 4-6 weeks, under the best of circumstances. As one vendor recently pointed out in their adverts, most businesses, down for more than 14 days, will never survive. More importantly, such an outage flat-lines the revenue picture for that entire fiscal quarter, for the unlucky victim. What we have today is a manufactured dependence on a single upstream provider and no way to multi-home. Even co-lo boils down to single-home dependency. Yes, there are a bunch of hacks to work around this problem. But, that is exactly what they are ... hacks. They are not something I could build a sustainable business around. Any business needs: 1. to be able to change upstream providers without having to renumber. 2. to be able to change access providers without having to suffer multi-month down-times. 3. to be able to have its net-block(s) visible regardless of which ISPs they are currently using. Currently the only ones that can do that are those that; 1. Are large enough to justify a /20 (begging the question of how they got that large). 2. Can afford their own datacenter. It looks like our technical solutions are raising unreasonable barriers to entry for small businesses.

2 1

Re: Statements against new.net?
by owen＠dixon.delong.sj.ca.us 13 Mar '01

13 Mar '01

> Are we going to have to go back to %hacking domain names, such as: > > foobar.tvshow%ORSC, > foobar.tvshow%MSN, > foobar.tvshow%AOL, > foobar.tvshow%ICANN, > foobar.tvshow%pacificroot, > foobar.tvshow%new.net, > foobar.tvshow%name.space > > and so on? > That doesn't solve the problem. The % is not effectively different from the . in your example, and if you replace % with ., it becomes quite obvious that you've just inserted a new top-level. Once you've done that, who controls who gets ICAN vs. AOL vs. MSN, and the problem repeats. Anyone who decides to run a competing root for resolving these hack-names and voila, now foobar.tvshow%AOL means different things depending on where you resolve %AOL to. > > Were you not aware of the existence of one or more such organizations when > > the IAB formulated this document? > > I am *not* privy to IAB deliberations, but I'm fairly sure that they were > painfully aware of their existence - the IAB doesn't issue documents in > a vacuum. RFC2826 was issued because the IAB was aware if their existence. > > I fail to see how RFC2826 is in any way "political". Upon careful re-reading > it boils down to: > > If you use one root, everybody agrees what things look like. > > If you use multiple roots, what people will see depends on which root they ask. > > How is this political? It becomes political when it goes beyond those two statements and says "Since these two statements are true, everyone should use one root." It becomes completely political when it expands that to encompass the concept of "ICANN root is the one true root. Thou shall have no other root before me." While I agree that having one true root is good, and that for the time being, that should be the ICANN root, the bottom line is that whether we like it or not, that is, indeed, a political issue and not a technical one. Sure, the desire to have one root is driven by technical merits. However, how that root is chosen, which root it is, and who gets to decide are all political issues. The fact that the current method of choice is "It's the one that has been there the longest" doesn't change the fact that it is a method of choice, and that it is a political issue. Owen

4 3

Re: Statements against new.net?
by Sean Donelan 13 Mar '01

13 Mar '01

On Tue, 13 March 2001, "Steven M. Bellovin" wrote: > Put simply, deploying multiple public DNS roots would raise a very > strong possibility that users of different ISPs who click on the same > link on a web page could end up at different destinations, against > the will of the web page designers. Its not really the "will of the web page designers." If this becomes popular, I suspect most web page designers will start using dotted-quad addresses inside their HTML URLs on their web pages. So clicking on a link on a web page will go to were the web page designer directs you. Except for NAT strangeness, IP Address are mostly globally unique. The issue is really one of user expectations. Some class of users have developed the expectation if they type some words resembling what they are looking for in the "address" prompt of their web browser, they will get taken to someplace they want. Web browser companies (e.g. Netscape, Microsoft) have reinforced this perception by automagically transforming the user's input into something else. Type "white house" into Internet Explorer 5.5's address prompt, and watch what happens. Netscape's browser has transformed any single word "XXXXXX" into http://www.XXXXXXX.com/ for a while.

3 2

RE: Statements against new.net?
by Roeland Meyer 13 Mar '01

13 Mar '01

> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Tuesday, March 13, 2001 1:14 PM > On Tue, 13 Mar 2001 12:54:42 PST, Roeland Meyer said: > > By the sheer fact that they included a non-technical value-judgment. > > OK.. I'm going to cite chapter and verse: You might want to calm down a bit. I'm out of the game now anyway (at least, this round). BTW, I read the original when it was first published. There is zero technical content, in the original. to whit; > Summary > > To remain a global network, the Internet requires the > existence of a > globally unique public name space. The DNS name space is a > hierarchical name space derived from a single, globally > unique root. > This is a technical constraint inherent in the design of the DNS. False. It is not a constraint, it results from a restricted implementation. > Therefore it is not technically feasible for there to be more than > one root in the public DNS. Improper conclusion based on a false premise. SRS has shown that root-root synchronization can happen. Probably easier than TLD-TLD syncs, because the rate of change is much lower. That's a real-world-and-already-widely-implemented example for you. It gets better, SRS was already widely deployed BEFORE the IAB published their comment. They just had trouble connecting the dots. >That one root must be > supported by a set > of coordinated root servers administered by a unique naming > authority. This statement is a pure non-technical value-judgement, supporting the legacy implementation, and is entirely self-serving. Of course, this statement, itself, is also a value-judgement. However, note that the defeat of the false premise, and it's direct improper conclusion, make this statement a pure political phrase. > Put simply, deploying multiple public DNS roots would raise a very > strong possibility that users of different ISPs who click > on the same > link on a web page could end up at different destinations, against > the will of the web page designers. This entire paragraph is a NOP. Webpage designers would never link to external resources under such condition as stated here. Those that do, deserve to get appendages whacked. > This does not preclude private networks from operating their own > private name spaces, but if they wish to make use of names uniquely > defined for the global Internet, they have to fetch that > information > from the global DNS naming hierarchy, and in particular from the > coordinated root servers of the global DNS naming hierarchy. > > OK? Read that. Read it again. Read it a third time. *ALL* that > says is "If you want to agree what the DNS tree looks like, you have > to share a root. If you want your own view, use your own root. > That's the way DNS is. You're stuck with the fact that DNS works > that way. You have to make your own choice which root to use". You really should calm down. I use external programs to build db.root.zone files, from external sources. All of the ORSC agrees to the core TLDs, which includes the legacy roots, and there are dispute proceedures for handeling collisions. > RFC2826 SAYS YOU HAVE TO CHOOSE FOR YOURSELF. Which is more important > to *YOU*? 100% consistency with the rest of the world, or access to > your private name space? *YOU* evaluate, *YOU* choose, and RFC2826 is > nice enough to point out the problems you'll encounter. It is not at all an either/or situation. There *is* the path of "accommodation". > Now, what non-technical value judgment did you say that RFC2826 was > making for you? It's not a "value judgment" that using multiple roots > with DNS results in inconsistencies, it's *the way DNS works*. see above. > I suppose the *next* thing we'll see is people complaining that the > concept of CIDR is an evil value judgement, because you need > to decide what > aggregation to do in order to keep the routing table a > manageable size. I already have my complaints about CIDR. It is NOT the same and let's not go there right now. > Now - I'll *readily* agree that "ICANN versus new.net" is political, > and probably worth discussing. However, I'm going to have to start > putting Bozo Flags on people who *still* claim that RFC2826 > is political > just because it points out that Things Will Provably Break if you have > conflicting roots. It doesn't say what you think. Do a logical analysis of the docuemnt after removing all pre-judgements. The document is not self-standing. This is the first clue that it is a political document. Granted, some of the issues are that of word-smithing, but that is even more clue that it shouldn't be taken as "gospel". If you look at is from the perspective of a system designer/architect, you will see the holes readily. If you perform a permutations analysis, you will see that they've walled-off many branches for no good reason (possibly, convenience). A good design includes all the permutations of all parts of the requirements matrix. Including, implied requirements that aren't stated. A robust design doesn't include arbitrary limitations.

2 1

Apple security contact?
by David Lesher 13 Mar '01

13 Mar '01

Sorry to interupt the rancher vs cattleman range war.... Can anyone point me to a contact person at Apple to answer a network/security query? Thank you; you may resume shooting. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

RE: Statements against new.net?
by Roeland Meyer 13 Mar '01

13 Mar '01

> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Tuesday, March 13, 2001 12:26 PM > I have to ask if any of these people who advocate the new.net approach > have been in the business long enough to have diagnosed > problems caused > by "I've got the Sep 1 hosts.txt, but you've go the July 15 > and they've > got the Sep 22" version. > > I *thought* we learned our lesson. Apparently not. We did, that's why we use DNS. As long as we practice collision avoidance, we won't have any problems. However, those that intentionally collide must be made to pay for it. ICANN, by flat-out ignoring the existing RSCs, basically told the rest of the world that it is okay for everyone else to ignore each other too. Had ICANN even tried to include the existing RSCs, we would now have new, non-colliding, TLDs.(IMHO) Personally, from my vantage point, the Internet co-opetition model is collapsing. Co-operation is a tit-for-tat game and no one is going to play without some "quid pro quo". ICANN wants it all one-way and that isn't going to happen anytime soon. In fact, such policy stance encourages polarization and fragmentation of the market/community. This is what gave rise to the opportunity that new.net is trying to exploit. Inclusive co-opetition would not have prevented the rise of new.net, but it would have given them strong encouragement to NOT have colliding TLDs. BTW: Co-opetition ::= cooperative competetion.(coined elsewhere)

1 0

Re: UUNet / ATT peering meltdown?
by Sean Donelan 13 Mar '01

13 Mar '01

On Tue, 13 March 2001, Travis Pugh wrote: > Not to open up any potential disputes, but has anyone heard what is going > on between UUNet and AT&T on the east coast? We've been seeing this kind > of performance for a week ... standard UUNet NOC response was "it's ATT's > problem, call them" which doesn't do me a whole lot of good since we're > not an ATT customer. AT&T had a fiber cut in Atlanta last week. They may still be operating on alternate facilities.

1 0

RE: UUNet / ATT peering meltdown?
by Travis Pugh 13 Mar '01

13 Mar '01

That may be a little extreme ... I generally get good support from all of my upstreams. However, there's a certain amount of static to be expected when you start raising inter-provider issues, especially when all the latency seems be caused by the provider you aren't a customer of. -travis On Tue, 13 Mar 2001, Tom Thomas wrote: > Bad attitudes to a customer are a clear indication you should take your > money elsewhere. > > Personally I like NetRail, they are courteous and responsive. > > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Travis Pugh > Sent: Tuesday, March 13, 2001 1:13 PM > To: nanog(a)merit.edu > Subject: UUNet / ATT peering meltdown? > > > > > Not to open up any potential disputes, but has anyone heard what is going > on between UUNet and AT&T on the east coast? We've been seeing this kind > of performance for a week ... standard UUNet NOC response was "it's ATT's > problem, call them" which doesn't do me a whole lot of good since we're > not an ATT customer. > > UUNet --> ATT > > 6 POS6-0.BR3.NYC9.ALTER.NET (152.63.24.97) 9.212 ms 9.633 ms 10.363 > ms > 7 137.39.52.74 (137.39.52.74) 9.642 ms 12.967 ms 12.137 ms > 8 gbr3-p50.n54ny.ip.att.net (12.123.1.122) 418.555 ms 416.419 ms > 419.819 ms > > ATT --> UUNet > > 8 ggr1-p370.attga.ip.att.net (12.123.20.253) [AS 7018] 20 msec 24 msec > 20 msec > 9 att-gw.atl.uu.net (192.205.32.130) [AS 7018] 396 msec 396 msec 392 > msec > 10 179.at-6-0-0.XR1.ATL5.ALTER.NET (152.63.82.190) [AS 701] 388 msec 388 > msec 388 msec > > Thanks. > > -travis > > > >

1 0