Thank you Rubens, you saved me the effort. Eric

On 7/2/13 7:06 PM, John Levine wrote:

Rather than asking random strangers, you can read the applicant guidebook and find out what the actual rules are:

There really should be a kinder introduction to those who lack basic clue than to attempt to read the last version of the DAG, even for the American Legally Literate. Someone who has more than just ICANNatitude (in either of the usual senses) should do a standup at the next {$NETTECH} meet and 'splain policy and business, can the bits and vod them out on the *OG lists. Then we could discuss the merits, such as they are. Eric

On Thu, Jul 4, 2013 at 12:00 PM, Ted Cooper <ml-nanog090304q@elcsplace.com>wrote:

On 03/07/13 11:12, Scott Weeks wrote:

...

"As of July 2, 2013, .nyc has been approved by ICANN as a city-level top-level domain (TLD) for New York City"

Do they have DNSSEC from inception? It would seem a sensible thing to do for a virgin TLD.

All new gTLDs are required to be DNSSEC-signed. The requirement only applies to the parent zone, unless registry policy dictates otherwise, so we can expect many more DS records in the root but a similar DS rate for 2LDs to other gTLDs, likely to be less than 1%: http://scoreboard.verisignlabs.com/percent-trace.png Rubens

On 7/4/13 8:00 AM, Ted Cooper wrote:

Do they have DNSSEC from inception? It would seem a sensible thing to do for a virgin TLD.

In the evolution of the DAG I pointed out that both the DNSSEC and the IPv6 requirements, as well as other SLA requirements, were significantly in excess of those placed upon the legacy registries, and assumed general value and availability with non-trivial cost to entry operators, some of whom might not be capitalized by investors with profit expectations similar to those that existed prior to the catastrophic telecoms build-out and the millennial dotbomb collapse. The v6-is-everywhere and the DNSSEC-greenfields advocates prevailed, and of course, the SLA boggies remain "elevated" w.r.t. the legacy registry operator obligations. "Sensible" may be subject to cost-benefit analysis. I did .cat's DNSSEC funnel request at the contracted party's insistence and I thought it pure marketing. The .museum's DNSSEC funnel request must have, under the "it is necessary" theory, produced demonstrable value beyond the technical pleasure of its implementer. Anyone care to advance evidence that either zone has been, not "will someday be", significantly improved by the adoption of DS records? Evidence, not rhetoric, please. #insert usual junk from *nog v6 evangelicals that .africa and .eos (Basque Autonomous Region) must drive v6 adoption from their ever-so-deep-pockets, or the net will die. Eric

On 7/4/13 10:48 AM, John Levine wrote:

I dunno. Can you point to parts of your house that have been significantly improved by fire insurance?

Cute John. Let me know when you've run out of neat things other people should do. Eric

On 7/4/13 11:11 AM, Valdis.Kletnieks@vt.edu wrote:

I'll bite. What's the *actual* additional cost for dnssec and ipv6 support for a greenfield rollout? It's greenfield, so there's no "our older gear/software/admins need upgrading" issues.

You'll let me know there is no place where v6 is not available, and while you're at it, why .frogans (I've met the guy, has to be the least obvious value proposition I've come across) needs to accessible to v6ers before, well, er, that .com thingie. "DNSSEC No clue necessary" ... so all those guys and gals out there selling training are ... adding no necessary value at some measurable cost? Eric

Someone who should know better wrote:

Well give that .com thingie is IPv6 accessable and has DNSSEC there is nothing we need to let you know. And yes you can get IPv6 everywhere if you want it. Native IPv6 is a little bit harder but definitely not impossible nor more expensive.

And this was true when the v6 and DEC requirements entered the DAG? Try again, and while you're inventing a better past, explain how everyone knew that it would take 6 revisions of the DAG and take until 3Q2012 before an applicant could predict when capabilities could be scheduled. The one thing you've got going for you is that in 2009 no one knew that almost all of the nearly 2,000 applicants would be forced by higher technical and financial requirements to pick one of a universe of fewer than 50 service providers, or that nearly all of the "developing economies" would be excluded, or self-exclude, from attempting to apply. So the basic diversity assumption was wrong. Why are the people who don't follow the shitty process so full of confidence they have all the clue necessary? Eric

I'm reasonably sure that there are more than 50 service providers who are able to privide you with a connection that will do IPv6.

In this context the universe of 50 providers are registry service providers, existing and entrant. Verisign, NeuStar, Afilias, CORE, AusReg, ISC, ... Your side won if you predicted in 2009, or even as late as 2011, that there would be many many applicants, using very very few providers, and none in awkward places. If you predicted that, you won on all counts, v6 availability, density of available technical clue for DNSSEC as the cheap box checks -- the real win was access to investment capital and financial instruments, access to American or equivalent legal and ancillary services, shared fate (still being dickered) on insurance bundling and business continuity set-aside, the business advantages offered by Verisign, NeuStar, Afilias, CORE, AusReg, ISC, ... Absent that it really doesn't matter if a light in the sky told you that v6 was everywhere and free, or that DNSSEC was vital to everything, and free too, or not. I didn't predict it, so I lobbied under the assumption that very low capitalizations would attempt to provide some locally needed name to existing address mapping, and that signing the zone had little but cosmetic effect unless there were resources within the zone offering a greater return on attacker investment than any large, and unsigned zone (and there still are some of those). I also tried to get ICANN's attempt to provide "Applicant Support" to defer these non-essentials for registry start-up, but that whole thing went south and the one qualified application was disallowed because ... .ummah upset someone who didn't care to admit it (the Support Program reviewers are anonymous). .museum started on a desktop. There has to be a good reason why this can never happen again. Eric

...

Why are the people who don't follow the shitty process so full of confidence they have all the clue necessary?

Probably because they don't think that new TLDs are particularly useful or valuable.

Oops, just a minute, gotta grab the popcorn and cooler for this one...ok, proceed. -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

On 5 July 2013 02:02, Eric Brunner-Williams <ebw@abenaki.wabanaki.net>wrote:

Someone who should know better wrote:

...

Well give that .com thingie is IPv6 accessable and has DNSSEC there is nothing we need to let you know. And yes you can get IPv6 everywhere if you want it. Native IPv6 is a little bit harder but definitely not impossible nor more expensive.

And this was true when the v6 and DEC requirements entered the DAG?

Try again, and while you're inventing a better past, explain how everyone knew that it would take 6 revisions of the DAG and take until 3Q2012 before an applicant could predict when capabilities could be scheduled.

The one thing you've got going for you is that in 2009 no one knew that almost all of the nearly 2,000 applicants would be forced by higher technical and financial requirements to pick one of a universe of fewer than 50 service providers, or that nearly all of the "developing economies" would be excluded, or self-exclude, from attempting to apply. So the basic diversity assumption was wrong.

Why are the people who don't follow the shitty process so full of confidence they have all the clue necessary?

Why do people who make statements about .com not being IPv6 reachable think they have all the clue necessary? And what about those people who think that DNSSEC is about validating the answers from the root/TLD name servers? At least you avoided the common mistake of citing the 1% end user IPv6 availability figure when claiming that IPv6 wasn't available in data centres... ;) - Mike

In message <9FF40D24-169E-4568-9F25-EE00BEEED13A@matthew.at>, Matthew Kaufman writes:

Well, for starters there's whole truckloads of surplus gear that you can't get for pennies and use successfully.

Surplus IPv6 capable gear has been around for a long while now. Remember most gear has had IPv6 for over a decade now. A lot of gear that ISC got given for IPv6 development was on it 2nd or 3rd repurposing before we got it nearly a decade ago.

Matthew Kaufman

(Sent from my iPhone)

On Jul 4, 2013, at 11:11 AM, Valdis.Kletnieks@vt.edu wrote:

...

On Thu, 04 Jul 2013 10:34:41 -0700, Eric Brunner-Williams said:

...

#insert usual junk from *nog v6 evangelicals that .africa and .eos (Basque Autonomous Region) must drive v6 adoption from their ever-so-deep-pockets, or the net will die.

I'll bite. What's the *actual* additional cost for dnssec and ipv6 support for a greenfield rollout? It's greenfield, so there's no "our older gear/software/admins need upgrading" issues.

-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org