Subject: Re: new.net (was: Root Server DDoS Attack: What The Media Did Not Tell You)

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 29 Nov 2002 12:09:06 -0500

In message <[email-masked]>, Valdis.Kletni
[email-masked] writes:
>
>
>
>On Wed, 27 Nov 2002 12:45:23 PST, Einar Stefferud <[email-masked]>  sai
>d:
>
>> ICANN stands alone in its EXCLUSIVNESS, while arguing 
>> that there must only be one root.  All others must die!
>
>Think .BIZ.
>
>Now go back and *CAREFULLY* re-read RFC 2826.  Note that nowhere
>does it say that ICANN has to be "the root".  What it says is "either you
>have one centrally coordinated root, or you have Balkanization".
>

This is precisely the point.  It doesn't matter who selects the TLDs; 
all that matters is that there be a consistent set.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Nov 2002 12:47:09 -0500

> It doesn't matter who selects the TLDs;

Well, it also matters that the set be constrained to some degree.
A large flat root would not be very managable, and caches wouldn't 
be very effective with large numbers of TLDs.

Keith

---

From: Joe Baptista <[email-masked]>
Date: Fri, 29 Nov 2002 13:26:11 -0500 (EST)

> be very effective with large numbers of TLDs.

That's old fiction.  If it works for .com it will work for ".".

I don't see much in the way of difficulties here.

regards
joe baptista

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Nov 2002 14:08:34 -0500

> That's old fiction.  If it works for .com it will work for ".".

well, it's not clear that it works well for .com.  try measuring
delay and reliability of queries for a large number of samples
sometime, and also cache effectiveness.

let's put it another way.  under the current organization if .com breaks 
the other TLDs will still work.   if we break the root, everything fails.

Keith

---

From: Joe Baptista <[email-masked]>
Date: Fri, 29 Nov 2002 14:34:38 -0500 (EST)

> the other TLDs will still work.   if we break the root, everything fails.

I just can't buy the argument.  The root won't break.  .com works fine -
so would the root.  The only issue would be vulnerability - if the roots
were under attack and the "." file was as large as the .com zone - then i
would imgine there would be a significant problem.  These same
vulnerability issues exist for the .com zone everyday.  It's a very
vulnerable namespace to attack.

Thats about the only significant problem i see to a "." file being as
large as .com.

regards
joe baptista

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Nov 2002 14:37:49 -0500

> I just can't buy the argument.  The root won't break. 

forgive me if I don't think that we should take your word for it.

---

From: jfcm <[email-masked]>
Date: Fri, 29 Nov 2002 21:03:33 +0100

>                 http://www.wilyhacker.com ("Firewalls" book)

ICANN ICP-3 even goes to the extent to explain how a non-profit, harmless, 
temporary experimentation by the global community could lead to a 
root-management by multiple organizations instead of ICANN.

>be very effective with large numbers of TLDs.

That is also what is to experiment. Local TLDs are probably not going to be 
an as big burden as professional TLDs.

This is why to be relevant technical, societal and political 
experimentations must be carried together.
jfc

---

From: "Mark Harris" <[email-masked]>
Date: Fri, 29 Nov 2002 15:19:28 -0500

>the other TLDs will still work.   if we break the root, everything fails.

Quick Question: 

Regarding Many TLDs vs. Fewer TLDs...

If when .com breaks, the other TLDs still work...
then, isn't that a good reason to have more TLDs?

If you have millions of domains, across 1000s of TLDs,
and, when one TLD goes down,
then, doesn't it appear likely (statistically)
that less domains would be effected in the event of such a problem?

Regards,
Mark

---

From: Einar Stefferud <[email-masked]>
Date: Fri, 29 Nov 2002 13:43:33 -0800

OK, we now have several words used for suposedly the same thing.

1)  ONE "MONOPOLY ROOT" OWNED and CONTROLLED" BY ICANN; making all decisions and leasing out TLD and lower domain name "holder-ships", which supposedly yields ONE SINGE ROOT controlled by ICANN.  Also provides a pseudo-legal court system (UDRP) for adjudicating "holder" disputes below the ICANNIC root.  Any domain names in use outside this construct are declared to be operated by PIRATE and Dishonest parties, whether they existed before ICANN came into existence or not, and even when created by Jon Postel pre-ICANN.

2)  A "Consistent Set" of TLDs which do not include any collisions, and hopefully also do not endure any colliding domain names outside this Consistent Set.  How the collisions are avoided apparently assumes some kind of communications system that is used for coordinating the introductions of new domain names to avoid introducing any and all collisions.

3)  A "Centrally Coordinated Root" that entails some kind of communications system that is used for coordinating the introductions of new domain names to avoid introducing any and all collisions.

I can see some equivalence between 2 and 3, both of which can be seen to achieve the desired result of a collision free root and thus a collision free DNS name tree, if this same coordination responsibility is attached to all delegations under the root.

but, I see no justification for creation of a monopolistic single point of failure with the unilateral unquestioned power to unilaterally set many kinds of policies regarding registration business models and use rules for DNS names.

Please explain how you see these relationships.

Cheers...\Stef

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Nov 2002 17:13:35 -0500

> then, isn't that a good reason to have more TLDs?

it's a good reason to not put all of your eggs in one basket.

also by limiting the size of the root we make it somewhat easier
to verify that the root is working correctly.

Keith

---

From: Paul Vixie <[email-masked]>
Date: 30 Nov 2002 09:42:14 +0000

> > It doesn't matter who selects the TLDs; all that matters is that there
> > be a consistent set.

all that matters technically, that is.  nontechnical reasons (like who gets
the money, or whose friends get the money, seem to matter quite a bit.)

> A large flat root would not be very managable,

manageability is in the eye of the manager.  i'm sure there are plenty of
companies who would line up to take their share of the money if "." were
opened to rapacious land-grabbing development on the order of ".COM" today.

i'm equally sure that it would be "managed" perfectly well from the point
of view of the managers and even from the point of view of the domain holders.

the trouble is, tlds today have some mneumonic value left in them, whereas
if there were billions of them, more would have to be written and fewer
could simply be spoken or remembered.  that's a "human factors" problem but
before y'all point and laugh and say it isn't technical, recall that if not
for humans, we'd just use dotted quads and coloned hex.  domains are a crutch,
and it's not clear that a crutch with 45 million rubber feet on it would be
of any use to anybody.

> and caches wouldn't be very effective with large numbers of TLDs.

if you mean that you think there might end up being a large number of queries
sent to the root name servers, most of which are avoidable if people were
more sensible, then duane wessels has got some bad news for you.
-- 
Paul Vixie

---

From: jfcm <[email-masked]>
Date: Sat, 30 Nov 2002 15:38:30 +0100

At 10:42 30/11/02, Paul Vixie wrote:
>before y'all point and laugh and say it isn't technical,

Dear Paul,
your remark is a good one and shows the whole problem. Network is still 
conceived by many as a  technical remote access system to information 
computers. Users conceive the network as a way for many information systems 
and for other people's agents (mail, phone, ICQ, web, etc. ) to become 
accessible to them, individually and collectively.

This makes some to fail seeing there a difference of nature between a 
computer application and a large network application coming from the 
collective interoperation of the users' brains. This is as much a 
difference as having transistors interoperating to support software. EDP 
supports software programs, noosphere (as coined by Teilhard de Chardin) 
supports brainware (born or induced) comportments.

Let take the DNS example you correctly quote.

First there is a mnemonic in the user's mind (brain), for example "IBM". 
The brainware has been trained to "resolve" that mnemonic into - first 
guess: ibm.com, further guesses (depending on cultures) ibm.net, ibm.fr, 
ibm.us, ibm.org ... and when fed up: "ibm" in a search engine.

Second there is the DNS software level resolving "ibm.com" into (third 
layer) the IP address of the Hardware machine.

To say today that brainware is not technical sounds like in the 1950s 
saying that technicians use punch cards and that software guys are artists, 
philosophers, dreamers ...

One needs brainware to work on the root, TLD naming and DNS semantic. 
Without taking brainware into consideration one can only do what ICANN 
does: to stick to the 1984's status quo and to look for good reasons to do 
only that. Using brainware, you certainly know that many/most/all (?) 
objections fail or are to be rephrased. Also that new DNS management 
methods - even without DNS code change -address most of them ... (but you 
are right with an impact on the current moneymaking scheme). This is what 
we want to test.

Question remains: how did they developed from 1970's nil into the 1984's 
international agreement we keep living on? Why 1984 was a stop to that 
development?
jfc