Subject: www.irtf.org unreachable?

From: Lloyd Wood <[email-masked]>
Date: Fri, 9 Nov 2018 23:35:49 +0000 (UTC)

Is there any particular reason www.irtf.org appears
to be unreachable?

(over IPv4. Haven't tried IPv6, which noone uses...)

thanks

 Lloyd Wood [email-masked] http://about.me/lloydwood

---

From: Allison Mankin <[email-masked]>
Date: Fri, 9 Nov 2018 18:51:53 -0500

try https://irtf.org

I’m not entirely clear on why we don’t have www

---

From: Dick Franks <[email-masked]>
Date: Sat, 10 Nov 2018 00:11:38 +0000

Just tried www.irtf.org and it appears to work for me  (UK, BT network)

Dick
________________________

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 10 Nov 2018 07:37:38 +0700

> Is there any particular reason www.irtf.org appears

WFM.

> (over IPv4. Haven’t tried IPv6, which noone uses...)

If you cared to acquire more knowledge about this (e.g., [1].[2],[3]), you would be surprised.
(In this case, I am too lazy to find out whether www.irtf.org came via a stagecoach or via today’s IP.)

Grüße, Carsten

[1]: http://www.worldipv6launch.org/major-mobile-us-networks-pass-50-ipv6-threshold/
[2]: https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6-adoption
[3]: https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption

OBTW, $ curl -I www.irtf.org
HTTP/1.1 301 Moved Permanently
Date: Sat, 10 Nov 2018 00:23:23 GMT
Server: Apache
Strict-Transport-Security: max-age=16070400; includeSubDomains
Location: https://www.irtf.org/
Cache-Control: max-age=0
Expires: Sat, 10 Nov 2018 00:23:23 GMT
Content-Type: text/html; charset=iso-8859-1

So we do “have” it, but of course it redirects to https.

And then:

$ /usr/bin/curl -I https://www.irtf.org/
HTTP/1.1 301 Moved Permanently
Date: Sat, 10 Nov 2018 00:27:46 GMT
Server: Apache
Location: http://irtf.org/
Content-Type: text/html; charset=iso-8859-1

As it should be.  (Except that the copy of curl at hand doesn’t accept the cert chain, so I have to switch to another copy. Standard fare.)

---

From: "Marco Davids (Private)" <[email-masked]>
Date: Sat, 10 Nov 2018 07:57:01 +0700

> Just tried www.irtf.org and it appears to work for

Than perhaps you should ask BT to turn on DNSSEC-validation? ;-)

Although...

I noticed that for me 8.8.8.8 and 9.9.9.9 are serving an expired signature:

;; ANSWER SECTION:
irtf.org.	1509 IN	A 4.31.198.44
irtf.org.	1509 IN	RRSIG A 5 2 1800 (
			20191108202257 20181108192421 46380 irtf.org.
			DIYuuDXJH7sb1FhjhhSIr/1jn3dcUS1K8EqC6VeqCY7/
			OCo0tZpb30OwSRH82Y/KkHrR5UzKFtzFdEts5GSVoql5
			1RlCik6bSaa0OcuTdqKZuM1W6RhsxJncaBI/sV4i6JxQ
			ls2d50okfg4eHxIKMoa6WqqJ3jKnVMz2POQukO+sLUOf
			01kImGkTx0NQAp6fhNC9FweEQ6OnuqD/IIW+tHfKojSw
			ha6uZBgANXYHB8uDmHOzaP8SvAIfTlsvTaLElNaLxg1F
			4blO5GY45oonAXQxbqgarPXqrk6nnWTSCq1rBjyMNl9C
			tDlfKjHhedrSNgued4amJtW61WOPEfp+1g== )

Some of the name servers of irtf.org still seem to be serving that. But
not all.

1.1.1.1 had a newer one:

;; ANSWER SECTION:
irtf.org.	1390 IN	A 4.31.198.44
irtf.org.	1390 IN	RRSIG A 5 2 1800 (
			20191108202257 20181108192421 46380 irtf.org.
			DIYuuDXJH7sb1FhjhhSIr/1jn3dcUS1K8EqC6VeqCY7/
			OCo0tZpb30OwSRH82Y/KkHrR5UzKFtzFdEts5GSVoql5
			1RlCik6bSaa0OcuTdqKZuM1W6RhsxJncaBI/sV4i6JxQ
			ls2d50okfg4eHxIKMoa6WqqJ3jKnVMz2POQukO+sLUOf
			01kImGkTx0NQAp6fhNC9FweEQ6OnuqD/IIW+tHfKojSw
			ha6uZBgANXYHB8uDmHOzaP8SvAIfTlsvTaLElNaLxg1F
			4blO5GY45oonAXQxbqgarPXqrk6nnWTSCq1rBjyMNl9C
			tDlfKjHhedrSNgued4amJtW61WOPEfp+1g== )

Testing the NS-set gave:

for a in $(dig +nssearch +nodnssec +short irtf.org | awk '{print $11}');
do echo $a;dig irtf.org|grep 20181109213626; done
65.22.8.1
65.22.7.1
65.22.9.1
65.22.6.1
65.22.6.79
2001:1900:3001:11::28
2a01:8840:9::1
			20181109213626 20171109203628 46380 irtf.org.
4.31.198.40
2a01:8840:7::1
2a01:8840:6::1
2a01:8840:8::1
			20181109213626 20171109203628 46380 irtf.org.

--
Marco

> On Fri, 9 Nov 2018 at 23:36, Lloyd Wood
> <lloyd.wood=[email-masked]..org
> <mailto:[email-masked]>> wrote:
> 
>     Is there any particular reason www.irtf.org <http://www.irtf.org>
>     appears
>     to be unreachable?
> 
>      Lloyd Wood [email-masked] <mailto:[email-masked]>
>     http://about.me/lloydwood
>

---

From: "Marco Davids (Private)" <[email-masked]>
Date: Sat, 10 Nov 2018 08:03:19 +0700

> Testing the NS-set gave:

[wrong paste - here's a better one]

for a in $(dig +nssearch +nodnssec +short irtf.org | awk '{print $11}');
do echo $a;dig irtf.org @$a|grep 20181109213626; done

65.22.7.1

Only these two get it right:

2001:1900:3001:11::28

That's ns0.amsl.com (the primary?)

--
Marco

---

From: Randy Bush <[email-masked]>
Date: Sat, 10 Nov 2018 13:41:46 +0700

> Is there any particular reason www.irtf.org appears

from where?  like a traceroute?

---

From: Lloyd Wood <[email-masked]>
Date: Sat, 10 Nov 2018 07:20:24 +0000 (UTC)

Thanks Marco - it's broken via the nameservers I use at
home and work, and has been for what, about a week?

So, denial of service of public content via an expired
certificate? Is this really what the web has come to? 

And who is responsible for and gets to fix it?

(redirecting from www.irtf.org to irtf.org is just
tricksy abuse for cosmetic purposes that doesn't help.)

L.

________________________________
From: Marco Davids (Private) <mdavids=[email-masked]>
To: [email-masked] 
Sent: Saturday, 10 November 2018, 11:57
Subject: Re: www.irtf.org unreachable?

Although...

;; ANSWER SECTION:

1.1.1.1 had a newer one:

;; ANSWER SECTION:

Testing the NS-set gave:

--
Marco

---

From: S Moonesamy <[email-masked]>
Date: Fri, 09 Nov 2018 23:51:56 -0800

Hi Marco,

[Cc to AMSL]

At 04:57 PM 09-11-2018, Marco Davids (Private) wrote:
> > Just tried www.irtf.org and it appears to work for
> > meÂ  (UK, BT network)
>

Please see http://dnsviz.net/d/www.irtf.org/dnssec/

Regards,
S. Moonesamy

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 10 Nov 2018 03:22:12 -0500

> Please see http://dnsviz.net/d/www.irtf.org/dnssec/

My take on this on this is that is an symptom of an unfortunate
operational model.

Both irtf.org and ietf.org seem optimized for more DNSSEC signing
key security than is operationally wise, likely with off-line
signature keys and a manual process to re-resign the zones on an
*annual* basis.  They are DNSSEC-signed roughly once each year,
with correspondingly long RRsigs.

And timely re-signing seems to be a bit of a hit-or-miss afair,
IIRC I saw similar problems with ietf.org a year or two back.

In my experience the operational discipline to reliably perform a
manual critical process just once a year is not easily attained.

It would be far better to accept the risk of having the keys online
on a hardened master node that automatically re-signs the zones
once or twice a month, or even just continuously (as with BIND's
"maintain" model).

Perhaps the folks at AMSL and their ietf.org liaisons can be persuaded
to adopt a more reliable operating model, along with monitoring
that checks that all the key RRsigs are sufficiently far above a
minimum threshold on the the remaining signature validity time and
are are getting automatically re-signed.

-- 
	Viktor.

---

From: "Marco Davids (Private)" <[email-masked]>
Date: Sat, 10 Nov 2018 14:02:31 +0400

On 10/11/2018 12:22, Viktor Dukhovni wrote:

> key security than is operationally wise

> They are DNSSEC-signed roughly once each year,

Next year; don't forget to increase the serial ;-)

-- 
Marco

---

From: Lloyd Wood <[email-masked]>
Date: Sat, 10 Nov 2018 10:28:59 +0000 (UTC)

Randy

>tracert www.irtf.orgUnable to resolve target system name www.irtf.org.

the traceroute isn't interesting.

the deliberate unnecessary complexity of the system
and the failure to maintain it is interesting...

________________________________
From: Randy Bush <[email-masked]>
To: Lloyd Wood <[email-masked]> 
Cc: IETF Discussion Mailing List <[email-masked]>
Sent: Saturday, 10 November 2018, 17:41
Subject: Re: www.irtf.org unreachable?

---

From: Dick Franks <[email-masked]>
Date: Sat, 10 Nov 2018 12:54:53 +0000

On Sat, 10 Nov 2018 at 00:57, Marco Davids (Private) <mdavids=
[email-masked]> wrote:

> > me  (UK, BT network)

I don't depend on BT for DNSSEC :-)

The odds are longer than 5-1 against a successful validation, so you have
to ask yourself, "Do I feel lucky?"

Examining RRSIGs served by ns0.amsl.com  (zone primary)

 www.irtf.org    A    RRset verified    (keytag 46380)
 www.irtf.org    AAAA    RRset verified    (keytag 46380)
 irtf.org    DNSKEY    RRset verified    (keytag 46380)
 irtf.org    DNSKEY    RRset verified    (keytag 65218)

Zone secondary nameservers have not been updated since new RRSIGs were
created over 40 hours ago.

 www.irtf.org    A    key 1: Signature expired at 20181109213333    (keytag
46380)
 www.irtf.org    AAAA    key 1: Signature expired at 20181109213526
(keytag 46380)

This reveals the questionable robustness of the operation and maintenance
functions, and the absence of any service level monitoring at all.

--Dick

---

From: Lloyd Wood <[email-masked]>
Date: Sat, 10 Nov 2018 22:39:54 +0000 (UTC)

Carsten

https://www.akamai.com/uk/en/about/our-thinking/state-of-the-internet-report/state-of-the-internet-ipv6-adoption-visualization.jsp

claims that Australian adoption of IPv6 is at 15% - behind
even New Zealand. I suspect that's optimistic, given that
the measurements will be biased towards the core.

I am not expecting to receive plug and play IPv6
anytime soon.

But perhaps another World IPv6 Day will finally make
a difference!

regards

________________________________
From: Carsten Bormann <[email-masked]>
To: Lloyd Wood <[email-masked]> 
Cc: IETF Discussion Mailing List <[email-masked]>
Sent: Saturday, 10 November 2018, 11:37
Subject: Re: www.irtf.org unreachable?

[..]

Grüße, Carsten

And then:

---

From: Carsten Bormann <[email-masked]>
Date: Sun, 11 Nov 2018 05:53:53 +0700

Of course my view is biased, being from Germany and talking a lot to US people (both in the forty to fifty percent area).
I just wanted to point that that “no-one uses IPv6” is not accurate anymore in the present decade.
Sure, there are countries like Bhutan and Austria, but even there “no-one uses IPv6” is no longer true.

> I am not expecting to receive plug and play IPv6

That may shape your personal perspective, but that is a bit of a minority view in many countries now.
(Which doesn’t mean the constituency is somehow unimportant.)

It will be a couple more years (but not that much longer) until IPv4-only service feels like analog cellular.
Unfortunately, we don’t have spectrum reclamation as a force to finally root it out.

Grüße, Carsten

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 11 Nov 2018 17:07:42 +1300

On 2018-11-11 11:39, Lloyd Wood wrote:
...
> I am not expecting to receive plug and play IPv6

It very much depends where you live and where you work. In terms
of products, it's been available for years, so it really depends
on the operator.

   Brian

---

From: "Scott O. Bradner" <[email-masked]>
Date: Sun, 11 Nov 2018 08:36:15 -0500

hmm - I have had plug & play IPv6 for a while now as a Comcast ISP customer & Mac user
same for my iPhone on Verizon - for both my connectivity is IPv6 if the target is IPv6 enabled

(fwiw - my test site is www.arin.net which reports what IP address I’m coming from )

Scott

> On Nov 10, 2018, at 5:39 PM, Lloyd Wood <lloyd.wood=[email-masked]> wrote:
>

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 11 Nov 2018 15:08:19 +0100 (CET)

On Sat, 10 Nov 2018, Lloyd Wood wrote:

> claims that Australian adoption of IPv6 is at 15% - behind even New 
> Zealand. I suspect that's optimistic, given that the measurements will 
> be biased towards the core.

https://stats.labs.apnic.net/IPv6/AU

Telstra is at 35%, Foxtel at 43%. Apart from that, rest is under 10%.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Lloyd Wood <[email-masked]>
Date: Sun, 11 Nov 2018 23:36:14 +0000 (UTC)

...and the Internet Society of Australia's IPv6 resource site has been
offline for months.

https://web.archive.org/web/20180318171852/http://www.ipv6.org.au/

traceroute www.ipv6.org.au

etc.

"it was for real!"

________________________________
From: Mikael Abrahamsson <[email-masked]>
To: Lloyd Wood <[email-masked]> 
Cc: Carsten Bormann <[email-masked]>; IETF Discussion Mailing List <[email-masked]>
Sent: Monday, 12 November 2018, 1:09
Subject: Re: IPv6 was Re: www.irtf.org unreachable?

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 12 Nov 2018 06:48:47 +0700

On Nov 12, 2018, at 06:36, Lloyd Wood <lloyd.wood=[email-masked]> wrote:
> 
> ....and the Internet Society of Australia's IPv6 resource site has been
> offline for months.
> 
> 

I’m not surprised.  For most of us the time when the move to IPv6 motivated some form of activism is long over.
Now it’s all about aging out of equipment that is not IPv6 capable; this will take a while but doesn’t require IPv6 pep sites.
(I do like the sites where I can monitor the global progress; thank you Google, Akamai, and many more that should be mentioned.)

Grüße, Carsten

---

From: Mikael Abrahamsson <[email-masked]>
Date: Mon, 12 Nov 2018 08:09:08 +0100 (CET)

> (I do like the sites where I can monitor the global progress; thank you Google, Akamai, and many more that should be mentioned.)

Yes, this is indeed very valuable. I refer to them all the time to 
convince laggards who think that IPv6 isn't even used. Being able to point 
to 25% worldwide adoption is one of the few ways I have seen to argue with 
people who are saying "nobody uses IPv6".

---

From: Jared Mauch <[email-masked]>
Date: Mon, 12 Nov 2018 08:57:02 -0500

On Mon, Nov 12, 2018 at 08:09:08AM +0100, Mikael Abrahamsson wrote:
> Yes, this is indeed very valuable. I refer to them all the time to convince
> laggards who think that IPv6 isn't even used. Being able to point to 25%
> worldwide adoption is one of the few ways I have seen to argue with people
> who are saying "nobody uses IPv6".
	
	In the US your handset is likely IPv6 unless you are on a MVNO.

	- Jared

-- 
Jared Mauch  | pgp key available via finger from [email-masked]
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.

---

From: [email-masked] (Martin Rex)
Date: Tue, 13 Nov 2018 15:29:31 +0100 (CET)

Carsten Bormann <[email-masked]> wrote:
[ Charset UTF-8 unsupported, converting... ]
> Of course my view is biased, being from Germany and talking a lot
> to US people (both in the forty to fifty percent area).

I'm living in Germany and without IPv6 -- and there exists nothing
interesting that isn't available thorugh IPv4.

And some of the equipment I have is IPv4-only, including a Sony LCD TV.

>
> I just wanted to point that that ?no-one uses IPv6?
> is not accurate anymore in the present decade.

The vast majority of users in Germany are using IPv6 by accident or
ISP mischief, but certainly not because they wantet it or asked for it,
let alone needed it.

> 
> It will be a couple more years (but not that much longer)
> until IPv4-only service feels like analog cellular.

Right now, IPv6-only feels like you're in a desert.

We're still *FAR*AWAY* from being able to reach everything via IPv6,
while you can get everywhere just fine with IPv4-only.

So the day when IPv4-only feels like analog celluar is more like
two decades away.

-Martin

---

From: Marco Davids <[email-masked]>
Date: Wed, 14 Nov 2018 11:06:59 +0100

Op 13-11-18 om 15:29 schreef Martin Rex:

> interesting that isn't available through IPv4.

You are aware of the fact that in order to achieve that, we had to come 
op with a couple of nasty tricks, are you? Things such as NAT, 
Carrier-Grade NAT and STUN.

Why? Well, because we have run out of IPv4. We have to create hacks in 
order to keep IPv4 usable and that is a kind of silly when there is a 
much more appropriate solution readily available.

>> I just wanted to point that that 'no-one uses IPv6'

That is a fact.

> ISP mischief, but certainly not because they wanted it or asked for it,
> let alone needed it.

Users don't ask for IP, whether it be v4 or v6 for that matter. They ask 
for 'internet' or 'cat pictures' or what have you.

User demand is not a reliable indicator when it comes to these kind of 
technologies 'under the hood'.

> Right now, IPv6-only feels like you're in a desert.

You might me surprised to see how much content is already available via 
IPv6 (albeit 'sap.com' seems to be lagging behind a bit).

> while you can get everywhere just fine with IPv4-only.

Not 'just fine'. It's horrible to get it working sometimes. Things like 
port forwarding relly are sub-optimal hacks. We could do so much better.

-- 
Marco

---

From: [email-masked]
Date: Wed, 14 Nov 2018 21:33:07 +0000 (UTC)

my point, of course, is that IPv6 adoption in Australia is woefully low (or sensibly low, YMMW), so evangelism is still needed here.
Shipping boxes also capable of IPv6 is not sufficient when network designers don't use it.. IPv6 will have arrived when box builders start removing all that legacy IPv4 code.

Lloyd [email-masked]

On Monday, November 12, 2018, 10:48 am, Carsten Bormann <[email-masked]> wrote:

Grüße, Carsten

---

From: Mark Andrews <[email-masked]>
Date: Thu, 15 Nov 2018 10:32:17 +1100

You can blame Optus for a large amount of the missing IPv6.  At least the routers they ship to their customers mention IPv6 (OPTUS F@ST 3864V3 AC by SAGECOM) though they don’t bring up IPv6 when plugged in to a IPv6 network that is just doing SLAAC.  It might work if I turn on DHCP-v6 internally. 

> On 15 Nov 2018, at 8:33 am, lloyd.wood=[email-masked] wrote:
> 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: [email-masked]