Subject: [dnsop] [[email-masked]: Mismanagement of the DNSOP list]

From: David Kessens <[email-masked]>
Date: Fri, 23 Sep 2005 17:56:49 -0700

IESG,

I would like to request that we consider Dean Anderson posting
privileges to be removed for the dnsop and ietf maillist.

As you can see from my private mail that Dean forwarded to the IETF
list, I have given him an official warning to refrain from sending any
more abusive mails to IETF maillists. Despite this, he immediately
followed up by sending more abusive mails to the dnsop and ietf
mail lists.

I hope that we can discuss this as soon as possible. Until then, I
will try to refrain from sending any more messages on this topic as I
don't believe that this will be productive. People on this mail list
might want to consider to do the same thing.

Thanks,

David Kessens
Operations & Management Area Director
---

----- Forwarded message from Dean Anderson <[email-masked]> -----

Date: Fri, 23 Sep 2005 20:08:46 -0400 (EDT)
From: Dean Anderson <[email-masked]>
X-X-Sender: [email-masked]
To: [email-masked]
Subject: Mismanagement of the DNSOP list

FYI: I am being threatened for posting operationally relevant criticism of 
mis-operation of the F DNS Root server on the DNSOP list.

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

---------- Forwarded message ----------
Date: Fri, 23 Sep 2005 15:55:20 -0700
From: David Kessens <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: David Meyer <[email-masked]>, Rob Austein <[email-masked]>,
     Bert Wijnen <[email-masked]>
Subject: [[email-masked]: Re: [dnsop] An attack that DNSSEC would
    have defended against...]

Dean,

To avoid any misunderstandings: My message is an official warning to
you that I will propose to the IESG to remove your posting privileges
if I see one more abusive mail from you.

Thanks,

David Kessens
---

----- Forwarded message from David Kessens <[email-masked]> -----

Date: Fri, 23 Sep 2005 15:36:11 -0700
From: David Kessens <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: Harald Tveit Alvestrand <[email-masked]>, [email-masked]
Subject: Re: [dnsop] An attack that DNSSEC would have defended against...

Dean,

You are welcome to post to this list if you have DNS operational
issues to discuss.

Any issues that you might have with ISC are outside the charter of
this working group and I would like to request you to take them up
privately with ISC. 

Thanks,

David Kessens
---

On Fri, Sep 23, 2005 at 06:09:23PM -0400, Dean Anderson wrote:
> Harald, you may be right about DNSSEC protecting from this. I haven't looked at
> your data, yet. However, you probably aren't about to be very well protected by
> DNSSEC, despite the progress of specifications on DNSEXT.
> 
> DNSSEC isn't deployable on F-root nor the other anycast'ed* roots, nor a lot of
> other anycast'ed non-root servers.  DNS servers with the Anycast Extension are
> increasingly popular due to suppression of discussion of negative aspects of the
> Anycast Extension on forums such as Nanog as recently as May, 2005 because only
> information that promotes ISC's view is allowed on Nanog, misleading network
> operators about the Anycast Extension.  Many root server operators accepted
> ISC's assurances as an unofficial IETF liason and deployed Anycast Extension on
> production servers and on root servers in violation of RFC 2870**. They appear
> not to have understood that they were deploying an untested, undocumented, and
> unapproved Anycast Extension.
> 
> And despite substantiated criticism on DNSEXT and DNSOP by persons including Dan
> Bernstein, Iljitsch van Beijnum, Dean Anderson, and others since the 2002 Nanog
> presentation by ISC, ISC has not yet even publicly acknowledged the problems
> with the Anycast Extension, and continues to promote the extension as completely
> safe. ISC even describes it to prospective customers as "uncontroversial",
> despite the controversies on DNSEXT, DNSOP, and Nanog beginning after the Nanog
> presentation in 2002.  
> 
> The Anycast Extension is now proposed to the GROW working group some 3 years
> after being described to Nanog as operationally safe and stable.  At present,
> the Anycast Extension proposal appears to be dead or dying on both DNSOP and
> GROW WGs because of evidence that it can't work in general, and the specialized
> conditions where it can work are uninteresting to the current users such as root
> DNS operators and other DNS operators, and thus uninteresting to ISC.
> 
> The only reason there are no present complaints with root operations is that DNS
> is mostly still stateless small UDP packets, reducing to RFC 1546 Anycast***,
> which works fine with stateless small UDP packets. And it may well be that those
> working on DNSSEC testing comply with the assumptions stated on the Anycast
> Extension.
> 
> So the question is when will F-root and other roots be able to handle TCP and
> large UDP packets from any internet host, including those hosts serviced by
> networks that use fine-grained load-splitting as described by RFC1812?.  When
> will operators be informed of these problems by ISC?
> 
> Critics of these problems, particularly Dan Bernstein and Dean Anderson, have
> been attacked personally by persons generally associated with ISC or friendly to
> ISC with no remedial action by the respective organizations (IETF and Nanog) in
> spite of well-documented complaints.  Uncontrolled personal corruption at the
> IETF and Nanog appears to be preventing actual progress.
> 
>                 --Dean
> 
> [* the Anycast Extension
> http://www.ietf.org/internet-drafts/draft-ietf-grow-anycast-01.txt doesn't work
> in general because routers are allowed by RFC1812 to do fine-grained "load
> splitting" if they wish. Fine-grained load splitting, also known as Per Packet
> Load Balancing (PPLB) and other names, prevents Anycast from being used with TCP
> or large UDP packets and fragments. The draft documents a number of assumptions
> that have to be true in order for the Anycast Extension to work. These
> assumptions aren't true in general.]
> 
> [** RFC 2870 section 2.6 specifies that Root DNS server operators must operate
> servers that respond to _any_ Internet host.  That is, Root nameservers that
> only work for say, 95% of the world are not acceptable.
> 
>    2.6 Root servers MUST answer queries from any internet host, i.e. may
>        not block root name resolution from any valid IP address, except
>        in the case of queries causing operational problems, in which
>        case the blocking SHOULD last only as long as the problem, and be
>        as specific as reasonably possible.
> ]
> 
> [*** RFC1546 notes that:
> 
>    It is important to remember that anycasting is a stateless service.
>    An internetwork has no obligation to deliver two successive packets
>    sent to the same anycast address to the same host.
> ]
> 
> 
> On Fri, 23 Sep 2005, Harald Tveit Alvestrand wrote:
> 
> > I'm not sure this is on-topic for this list, but may be an illustrative 
> > story....
> > 
> > I had some percentage of the queries for a domain I use hijacked by an 
> > attacker last week. The technique involved was interesting to me.
> > 
> > Moral: Know your secondaries, and what happens to them..... if someone 
> > steals your secondary's NAME, you're toast.
> > 
> > If I'd had DNSSEC, and the people looking it up had had DNSSEC, this would 
> > have been a detectable DOS attack, not a stealth redirection attack.
> > 
> > Detailed writeup: http://www.alvestrand.no/subjects/dns-attack-1.html
> > 
> >                       Harald
> > 
> > 
> > .
> > dnsop resources:_____________________________________________________
> > web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
> > mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html
> > 
> > 
> 
> -- 
> Av8 Internet   Prepared to pay a premium for better service?
> www.av8.net         faster, more reliable, better service
> 617 344 9000   
> 
> 
> 
> 
> 
> 
> .
> dnsop resources:_____________________________________________________
> web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
> mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Dean Anderson <[email-masked]>
Date: Sat, 24 Sep 2005 23:28:01 -0400 (EDT)

None of my emails have been abusive.  The IETF is not some random list that can
make up rules as it pleases. Nor is the IETF a popularity contest. Unlike
members of "joes barbecue list" or Nanog, or other such lists, IETF Participants
have an opportunity to participate and under the ISOC and IETF codes of conduct,
a right to be free of unwarranted personal attacks and threats.  Valid,
justified, technical criticism is not a violation of any IETF rule. Nor is valid
criticism a disruption.

Kessens' fallacious complaint is just revenge in an attempt to squash valid
technical criticism of ISC's operation of F Root.  Valid criticism of Root DNS
operation is an appropriate topic for the DNSOP list.  I think that the IESG
ought to address the validity of my criticism of ISC Root DNS operation and
deployment of the Anycast Extension, and I think that the IESG should address
the abuse of WG Chair privileges by the Mr. Kessens, and consider the failures
of the WG chairs to properly criticize actual abuse.  Kessens is not the only
abuser.

Kessens further claims falsely below that I "immediately followed up by sending
more abusive mails to the dnsop and ietf mail lists".  Plainly, there is nothing
abusive about complaining about Kessens' threats, nor is there anything abusive
about defending my criticisms as being valid, justified, and appropriate to the
DNSOP list. Plainly, my complaint about Kessens' behavior to the IETF list is an
administrative issue, and so it is within the administrative purpose of the main
IETF list. There is nothing abusive about that.

However, this is not to say that abuse isn't happening. Besides Mr. Kessens'
instant abuse of his position, there is a history of unchecked abuse against
myself and others, including Dr. Dan Bernstein, who have been abused several
times on the IETF main list as well as a particular pattern of disruption on the
DNSOP and DNSEXT lists.

From RFC 3683:

   Notably, in a small number of cases, a participant has engaged in
   what amounts to a "denial-of-service" attack to disrupt the
   consensus-driven process.  Typically, these attacks are made by
   repeatedly posting messages that are off-topic, inflammatory, or
   otherwise counter-productive.  In contrast, good faith disagreement
   is a healthy part of the consensus-driven process.

My activity hasn't been disruptive of any IETF activity. In fact, Mr. Kessens'
complaint is plainly meant to disrupt consideration of my (but not just mine)  
valid technical criticism.  The only possible disruption is to ISC financial
income from selling Anycast DNS Root services.  But since the technical
contributions of myself, Dan Bernstein, Iljitsch van Beijnum and others is that
those services can't work in general, the IETF DNSOP WG has an obligation to
investigate and discuss that.

However, there has been much disruptive behavior by others especially on the
subject of the ISC Anycast Extension. Activity that is clearly intended to
disrupt or even deny email service. Here is a short list:

In 2002, after Dr. Bernstein reported on the DNSEXT list about the ISC Anycast
Extension described by ISC in a presentation to Nanog, his subscription address
was posted by Randy Bush (then DNSEXT WG chair) on several occasions to the
DNSEXT list.  The enabled forged unsubscriptions of his email address,
disrupting Dr. Bernstein's email subscription. The posting of the unsubscription
address only happened to Dr. Bernstein. This eventually disrupted the discussion
of the ISC Anycast Extension, as discussion turned to the abuse of Dr.
Bernstein.  This is plainly a violation of IETF rules on participation.  Bush
stepped down as WG chair afterward, and many including myself thought that this
was a punishment. However, Harald Alvestrand informed me in his role as IETF
Chair that Bush was not punished. So no action was ever taken for this abuse.

Other incidents happened, generally involving Nanog participants and
ISC-friendly people. For example:

The 2002 Nanog Presentation on Anycast Extension was made by ISC Project Manager
Suzanne Woolf. In September, 2004, on the subject of the ISC Anycast Extension,
John Brown made a vicious personal attack on the DNSOP list against Dean
Anderson. A complaint was made to DNSOP and the IETF main list on September 30,
2004.  In his attack, Brown claimed no affiliation with ISC:

    "...I felt it important to reply as someone thats NOT in
    any shape fashion or form, ISC or its staff"  --John Brown.

It turned out that Brown was involved with Suzanne Woolf in at least
Chagres.net, at the time. The same Woolf who was in charge of the Anycast
Extension at ISC.  Still, non-affiliation doesn't justify unwarranted personal
attacks, but affiliation and false claims of non-affiliation certainly makes
those attacks look more self-serving.  No action was ever taken by the IETF or
by the DNSOP WG chair in response to this or ANY other complaints.

On May 9, 2004, I attempted to send the DNSOP Co-chair Rob Austein a note about
draft-ietf-dnsop-dontpublish-unreachable-03.txt.  This message was rejected by
Mr. Austein, and I was told that Av8 Internets' IP addresses were Hijacked.  Mr
Austein was also an ISC Employee.  It turned out that Austein had been using a
counterfeit blacklist that was defaming Av8 Internet. These messages aren't just
sent to me, but to Av8 Internet's customers as well. This is defamation: that
is, a provably false statement made to a third party (Av8 Internet's customers):
a defamatory statement made by an IETF worker on official IETF business for
which the IETF and ISOC is legally responsible. Besides the defamatory aspect,
the IETF rules require WG chairs to interact with participants, and Austein's
use of the counterfeit blacklist prevents interaction in violation of IETF
rules.  Austein needs to use an official email address that accepts email from
IETF participants, and needs to stop making defamatory messages during official
IETF business. Austein has not yet done so, as of 9/24/2005. A complaint was
made to the IETF main list on May 10, 2004.  We still have several years in
which to discover pertinent facts before begining litigation on the defamation
issue.  We seem to be discovering official hostility, which isn't far from
malice. This remains an open issue.

June 21, 2004, a complaint was made after Paul Vixie called Av8 Internet by the 
disparaging name "dv8" several times.  No response on this.

October 4, 2004, a complaint was made after Stephane Bortzmeyer made disparaging 
remarks on the DNSOP list. The subject under discussion was also the ISC Anycast 
Extension.

I've just noticed that a number of these personal attacks involve the ISC
Anycast Extension, and are made by people involved with or friendly to ISC.  
Though, not all. A few are related to frequent posters to the Nanog list such as
Dave Crocker, Steven Bellovin, Stephane Bortzmeyer, etc. Over the years, I've
been involved in a number of controversial or at least unpopular issues
involving Nanog sometimes. On most or maybe all of these issues, I've been
vindicated and proved right over time.  See
http://www.iadl.org/nanog/nanog-story.html Vindication is apparently quite
irritating to those proved wrong.

There are a number of other incidents where personal attacks are made. Nick
Strand was told his view was a waste of time by the present IETF chair. In fact,
his view was articulate, and substantiated by facts.  These attacks are meant to
disrupt discussion.  If for example, Mr. Strand was wrong, people would make a
rational argument against his view. But they had no rational argument, leaving
them with only personal attacks and name-calling. Jefsey Morfin also comes to 
mind as a victim. No reparation has been made that I know of.

While name-calling and some kinds of professional dishonesty are usually merely
discourteous behaviors that don't ultimately affect the operation or decisions
of the IETF, by contrast, the failure to address valid DNS operational
criticisms by a Working Group charged with DNS operational issues is a
significant failure.  But more gravely still, active efforts by a WG Chair to
suppress valid technical criticism for what seems to be the financial benefit of
one company (ISC) is not just merely inappropriate, but in fact well beyond what
can be tolerated of an allegedly vendor neutral forum.  This has gone well
beyond mere name-calling and is now a serious issue of IETF operational
integrity.
 
Dean Anderson
Av8 Internet, Inc

.

---

From: bert hubert <[email-masked]>
Date: Sat, 24 Sep 2005 12:53:07 +0200

> privileges to be removed for the dnsop and ietf maillist.

The time honoured solution to net-kooks is to ignore them. It has been very
effective in the past. Banning them only fans the flames.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software
http://netherlabs.nl              Open and Closed source services
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: "Nicholas Staff" <[email-masked]>
Date: Sat, 24 Sep 2005 10:09:13 -0700

> Operations & Management Area Director

I agree this is not the forum for this discussion, but since you publicized
your attack I think he's entitled to at least one public dissent.  I'd be
happy to agree with you by the way if you could show me anything that
amounted to the abuse you claim (abuse from Dean that is).  Anyway, barring
that I'll list the 1,000 reasons why I think you're wrong in my email to the
IESG.

Thanks,

Nick Staff
.