Subject: Root Server DDoS Attack: What The Media Did Not Tell You

From: Joe Baptista <[email-masked]>
Date: Sat, 23 Nov 2002 09:10:52 -0500 (EST)

It's time to consider multiple root servers and an education campaign to
give name server operators some options.

The .com name servers are the most vulnerable.  The USG root is not as
vulnerable.

Original story indexed at:

URL: http://www.circleid.com/articles/2553.asp

DDoS Attack: What The Media Did Not Tell You
November 20, 2002  |  By Joe Baptista

On Monday, October 21, a "distributed denial of service" (DDOS) attack
struck 9 out of the 13 root servers operated by a number of contractors on
behalf of the United States Department of Commerce (USG). The next day,
the Washington Post reported, "The heart of the Internet sustained its
largest and most sophisticated attack ever."

This claim was only partially true. The classic hacker attack was indeed
the largest ever witnessed in 20 years of root history -- in fact, it was
the first attack against the roots.

But claims that the attack was "sophisticated" were bogus. Most network
operators were of the opinion that the attack showed a serious ignorance
of the domain name system (DNS) and general network operations. A great
deal more damage could have been done if the individuals responsible had
targeted the DNS directly. At worst the attack was a test or probe for a
potential future attack.

The root servers struck by the attack assist computers in translating
Internet domain names, such as www.circleid.com, to numeric equivalents
used by computers. These servers provide the primary roadmap for 70% of
all Internet communications. The remaining 30% of the net now uses
competing root service providers who bypass the USG root system. They were
not under attack.

According to statements by U.S. Federal Bureau of Investigation (FBI)
director Robert Mueller, the incident lasted about an hour and originated
from computers in the United States and Korea. Most often, computers used
in the DDOS assaults are commandeered by hackers either manually or
remotely with the help of automated software tools that scan millions of
computers for known security holes. These computers often belong to
unsuspecting home users. An FBI spokesperson confirmed that the incident
was still under investigation.

Fortunately, despite its size, the attack had no impact on the Internet,
and no users or computers were affected. The USG root server system
contains only 258 top-level domains, of which 243 are ccTLDs (country code
top-level domains) and the rest are generic top-level domains (gTLDs) like
.com, .org and .net. In comparison to many Internet root server systems,
the USG is the smallest. As a result of its limited size, most of the
information contained in that root is cached by Internet Service
Providers (ISPs) and refreshed every 48 hours. Under those circumstances,
Internet users would not have noticed the one-hour attack even if all 13
roots had been successfully blocked the entire time. There simply was not
enough time for the cache records at ISPs to expire long enough for anyone
to notice.

Petri Helenius was one of the first people to witness and report the
attack in progress. He notified the networking community that the DDOS
attack was not "causing any serious operational problems" but was slowing
things down. Helenius is a telecommunications expert whose company
developed the ROMmon (Robust Online Metric MONitoring) system that alerted
Mr. Helenius to the intrusion. Helenius notified the North American
Network Operators' Group (NANOG) by email at 21:29 UTC. "I remember
spending some time before sending off the email," said Helenius. "And,
trying to figure out specifics and failing to get further, I sent the
email."

The alarms went off at ROMmon at 20:46 (UTC) and the threshold for
escalation was crossed at 20:49. The situation dropped "below radar" at
22:01. Helenius pointed out, "the timestamp is a little later than the
fact (attack) due to the averaging of the system that (ROMmon) does before
it's happy."

Paul Vixie, a root operator, confirmed to NANOG that the DDOS attack was
an Internet Control Message Protocol (ICMP) request. ICMP messages are
used in the processing of datagrams through which Internet systems
communicate. This was the first clue to network operators that the people
behind the attack had no clue as to how to effectively take out the roots.
If the attackers had focused their computer power on generating bogus
queries to port 53, used by roots to provide domain name service, the
attack might have been successful -- provided that it was sustained for
more than one hour. Vixie successfully blocked the DDOS traffic he was
getting with the assistance of his backbone providers. Other operators,
however, were not as successful in defending their systems against the
attack.

If the attackers had instead targeted the much larger databases used by
the .com servers, users would have noticed the incident and it could have
gotten ugly. The .com domain servers operated by VeriSign contain millions
of domain names, and are queried more often than the roots. If this had
been the scenario, the one-hour attack would have had significant
repercussions and most of the Internet would have been unreachable,
though it was reported on NANOG that the primary root server operated by
VeriSign had been unreachable at times during the DDOS attack. Still,
there are lots of clues here that the attackers had computer power behind
them but did not take full advantage of it. If the attackers had wanted
the world to notice, they should have attacked the .com servers. Or maybe
it was just a warning, as some have speculated.

The month of October has seen a number of possible attacks against the
roots, and this may not have been the first one. CAIDA, the Cooperative
Association for Internet Data Analysis, has been monitoring the
performance of root and gTLD servers since January 2002, using passive
monitors located at the University of California in San Diego and in San
Jose. Their report on the DDOS attack indicates that "unusual behavior"
in the roots was detected as early as October 7. The report suggests that
a series of probes in October preceded the attack.

Speculation by officials that the attack was a warning may be credible
under these circumstances. As attacks go, this one was a failure: no one
except the experts noticed. Thus, it could have been a short test to see
how the system responded. Expect more incidents like these in future.

The attack, however, should come as no surprise to ICANN (Internet
Corporation for Assigned Names and Numbers), the Department of Commerce
contractor responsible for root security. Over the years, ICANN has been
warned that the existing root infrastructure was vulnerable to attack, but
the warnings have been largely ignored. Now, however, ICANN President
Louis Touton insists that the attacks "make it important to have increased
focus on the need for security and stability of the Internet." ICANN's
Security and Stability Advisory Committee quickly moved in to investigate
the incident. The committee is expected to produce a report on securing
the edge of the USG Domain Name System network.

Informed sources at ICANN expect that the committee will initially
recommend that ISPs take steps to prevent packets with forged IP addresses
from being used in DDOS attacks. This, however, does not directly address
the problem of preventing a potential outage of the root system. It is,
rather, an attempt to protect the root servers from attack. But don't
expect ICANN's recommendations to be widely deployed. It's a difficult
process to get ISPs worldwide to do the work required. Rather, expect DDOS
to remain a fact of life on the net for now. There are technical solutions
available, and technicians and scientists are working to solve the DDOS
problem. Until then, taking control of root operations at the user or ISP
level is a more logical approach to avoiding any potential interruption to
service.

To survive a sustained DDOS attack against the roots, the best solution
an ISP has is to run its own system and eliminate any dependence on the US
government for basic internet services. It would also be prudent for other
primary namespaces like .com. Unfortunately, though, it would require a
considerable amount of resources -- the .com zone file alone is well over
a gigabyte in size. But the root file is very manageable and can easily
be run on an ISP's local domain name servers.

In fact, large ISP's facilities and co-location sites don't rely on the
USG for service. They run their own roots, and some mirror the USG root on
their local domain servers. ISPs and individual users also have the option
of leaving the USG root by switching to private root service providers.

Cheers
Joe Baptista

--
Planet Communications & Computing Facility
a division of The dot.GOD Registry, Limited

--
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

---

From: "vinton g. cerf" <[email-masked]>
Date: Sat, 23 Nov 2002 11:42:36 -0500

where are these statistics from - I cannot believe that more than a few
percent of the net uses non-USG root. 

Vint

>competing root service providers who bypass the USG root system. They were

Vint Cerf
SVP Architecture & Technology
WorldCom
22001 Loudoun County Parkway, F2-4115
Ashburn, VA 20147
703 886 1690 (v806 1690)
703 886 0047 fax

---

From: "vinton g. cerf" <[email-masked]>
Date: Sat, 23 Nov 2002 11:53:17 -0500

joe, this makes no sense to me - the cacheing mechanisms are essentially
doing what you suggest. That's one of the reasons the system is resilient.
But you need to invalidate the cache to deal with changes to the binding
of domain name and IP address. Simply mirroring everything doesn't improve
things, in my estimation. In fact, trying to mirror everything everywhere
has a massive update problem. Cacheing spreads the update process over time.

The USG doesn't actually run the root server (although some of the root
servers are in fact housed at USG supported laboratories). The Dept of
Commerce in effect delegates the actual operation to the root server operators.  

The issue is less the size of the file than the problem of updating many 
copies of it reliably. The root server operators find it a challenge to
assure that even the modestly sized root zone file is correctly distributed
to all root servers accurately and in a timely fashion. 

Vint Cerf

---

From: "vinton g. cerf" <[email-masked]>
Date: Sat, 23 Nov 2002 11:46:55 -0500

Louis Touton is Vice President and General Counsel of ICANN.

ICANN has had a root server advisory committee from early days, working
on root server placement to improve resilience; the security and
stability advisory committee was created in the wake of 9/11 and
has increased the priority of root server security evaluation.

Vint Cerf

---

From: Gordon Cook <[email-masked]>
Date: Sat, 23 Nov 2002 16:17:33 -0500

>Louis Touton is Vice President and General Counsel of ICANN.

yes true

>on root server placement to improve resilience;

would you be kind enough to offer a url that points to what this 
group has done?  they had a CRADA to do something.  I am unaware that 
they ever did anything.  but perhaps I missed the announcement.

>  the security and

Vint said "has increased the priority of root server security 
evaluation" ....   This is
an interesting comment.  Again Vint please be concrete.  What 
precisely have they done?  Where is their report?  Have they ever 
actually had a meeting?  URL.  Press release....some definite 
citation please.
-- 
========================================================
The COOK Report on Internet, 431 Greenway Ave, Ewing, NJ 08618 USA (609)
882-2572 (phone & fax) [email-masked]  Subscription info & 
prices at   http://cookreport.com/subscriptions.shtml    Summary of 
content for 10 years at http://cookreport.com/past_issues.shtml  Info 
on Economics of Peering, Transit & IXs
November - December 118 pages available at http://cookreport.com/11.08-09.shtml
========================================================

---

From: Rick Wesson <[email-masked]>
Date: Sat, 23 Nov 2002 14:03:46 -0800 (PST)

first of all I don't think this belongs in the IETF forum.

> actually had a meeting?  URL.  Press release....some definite

see http://www.icann.org/committees/security/ for a list of the documents
the group has produced and presented to date.

-rick

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 23 Nov 2002 23:35:44 +0100

> first of all I don't think this belongs in the IETF forum.

That's what delete keys are for.

It seems relevant to me.

---

From: [email-masked]
Date: Sun, 24 Nov 2002 00:51:49 +0100 (MET)

Rick,
> first of all I don't think this belongs in the IETF forum.

why?  the DNS is a key piece of internet infrastrucure, as i'm sure you are
well aware.  if it is in danger, then all of us are in danger.  what group is
better equipped to deal with such problems than the ietf?

scott

-- 
Revolt now.

+++ GMX - Mail, Messaging & more  http://www.gmx.net +++
NEU: Mit GMX ins Internet. Rund um die Uhr für 1 ct/ Min. surfen!

---

From: Joe Baptista <[email-masked]>
Date: Sat, 23 Nov 2002 19:18:46 -0500 (EST)

> the group has produced and presented to date.

there's not much there.  it's lacking any response to the ddos incident.

regards
joe baptista

---

From: [email-masked]
Date: Sat, 23 Nov 2002 19:55:35 -0500

> better equipped to deal with such problems than the ietf?

That's an OPERATIONAL issue rather than a PROTOCOL issue.  As such, it
probably belongs over in NANOG or similar forums.  NANOG had much operational
discussion about the DDOS attack on the root servers recently, as it did about
the operational impact of 9/11 on sites like 60 Hudson.
-- 

				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Date: Sat, 23 Nov 2002 23:02:15 -0500 (EST)

On Sat, 23 Nov 2002, vinton g. cerf wrote:
....

> The USG doesn't actually run the root server (although some of the
> root servers are in fact housed at USG supported laboratories). The
> Dept of Commerce in effect delegates the actual operation to the root
> server operators.

As a technical, legal, and historical matter the USG does not "delegate"
root server management to anyone.  Root server operators are volunteers
and self-organizing. The USG lacks the authority to tell them what to do,
or to fire them.  Indeed, as you note, some are not affiliated with the US
in any way. 

Nit-picking, yes, but fairly important when sorting out who has authority
over what.  (Cf.
http://personal.law.miami.edu/~froomkin/articles/formandsubstance.pdf for
a discussion of the legal import of the root sever operator's legal
position.)

> to all root servers accurately and in a timely fashion. 

Are there statistics on this?  Certainly the published info I've seen is
more of the patting-self-on-back variety.  

-- 
		Please visit http://www.icannwatch.org
A. Michael Froomkin   |    Professor of Law    |   [email-masked]
U. Miami School of Law, P.O. Box 248087, Coral Gables, FL 33124 USA
+1 (305) 284-4285  |  +1 (305) 284-6506 (fax)  |  http://www.law.tm
                        -->It's hot here.<--

---

From: jfcm <[email-masked]>
Date: Sun, 24 Nov 2002 09:59:44 +0100

>more of the patting-self-on-back variety.

This is why the only long term viable solution is to get the root file used 
by a root server - or small group of root servers - asynchronously rebuilt 
by its operator from the very autroritative data of the TLD Managers, and 
to have them mutually crosschecked for consistency among root servers 
systems. Obviously this means to consider the Internet as a distributed 
network of cooperating - or even concerting - (instead of coordinated) 
systems, probably not what IETF and ICANN share as a network subsidiairity 
culture as yet. Maye be what an appropriate analysis of the requirments for 
a real and stable global security may change?
jfc

---

From: Joe Baptista <[email-masked]>
Date: Sun, 24 Nov 2002 09:48:28 -0500 (EST)

> percent of the net uses non-USG root.

It's much more then that Vint.  The last poll I conducted on the dns
showed at least 5%.  But that was a few years ago.  The 30% comes from
various discussions we had concerning new.net.  At the time the internet
had about 300 million users - estimated by various sources and new.net
claimed some 80 million users.  The bulk of the argument was held on the
opensrs discussion lists hosted by tucows.

So I have no doubt the estimate of 30% is now very conservative
considering new.net now claims over 156 million users - but i don't know
the user stats for current user population.  However I suspect their
market share has grown significantly since the 30% estimates.

So there you have it - new.net is your competition by market share.  the
other alt.roots are peanuts in comparison.  Now mind you new.net has
purchased the right to be the navigator of record for those 156 million
users.  Unlike the USG root system which does not buy the publics
affections.

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Sun, 24 Nov 2002 10:03:46 -0500 (EST)

> Louis Touton is Vice President and General Counsel of ICANN.

Sorry about that.  Must be a cut and paste typo I missed.  I'll have it
fixed.

> has increased the priority of root server security evaluation.

I know.  It a very patriotic committee - but what exactly has it done
concerning root security.  I'd like to examine the documents the committee
presented in shanghai - but i can't find it on the web site.

Basically I'm interested to know if they addressed these recent attacks.
Like everyone else I heard the rumour -

"Informed sources at ICANN expect that the committee will initially
recommend that ISPs take steps to prevent packets with forged IP addresses
from  being used in DDOS attacks."

But I've seen nothing so far.

regards
joe baptista

---

From: Pekka Savola <[email-masked]>
Date: Sun, 24 Nov 2002 17:22:34 +0200 (EET)

> users.  Unlike the USG root system which does not buy the publics

I don't think any source related to new.net regarding this can be treated 
as reliable.

Do you have independent estimates or some rough data?

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Joe Baptista <[email-masked]>
Date: Sun, 24 Nov 2002 10:18:01 -0500 (EST)

> doing what you suggest. That's one of the reasons the system is resilient.

I agree and beutifully so.  I take my hat off to the crew which put the
dns together in the first place.  A good example is discussed from time to
time on the [email-masked] mailing lists.  As you may know ICANN has refused
to update some cctld records - but those cctlds continue to resolve.  SO
yes I agree it is very resilient.

> has a massive update problem. Cacheing spreads the update process over time.

But does it matter.  We both agree it's a resilient system.  Eventually
the updates are done.  I don't see an issue here.  Like I said before the
USG root file has carried incorrect information on cctlds and the system
still resolved.

> Commerce in effect delegates the actual operation to the root server operators.

Well who owns this monopoly.  Whoever has control of the roots has control
of the 70% USG monopoly.

> to all root servers accurately and in a timely fashion.

well .. maybe the root committee or the security committee could
investigate sponsoring root servers systems worldwide and work on solving
the update issue and the ietf i'm sure can help.  After all the icann
through GAC is an international organization - or at least wants to be.
Your mission should be to reduce international dependence on a US centric
root system.

I feel the single root approach that stuart lynn advcated and established
as icann policy is a bit lame for todays high speed web servers.

Of course I always appreciate your views on this.

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Sun, 24 Nov 2002 10:56:51 -0500 (EST)

> Do you have independent estimates or some rough data?

No - and I can confirm that non exists or at least i have not seen any in
the public arena.

But I would not discount new.net's claims.  I'm sure they can support
their claims.  At the very least they do have market share in root server
operations irrespective of the means used to calculate it.

I've cc'ed new.net on this - let's see if they respond.

regards
joe baptista

---

From: Måns Nilsson <[email-masked]>
Date: Sun, 24 Nov 2002 08:58:02 +0100

- --On Saturday, November 23, 2002 23:02:15 -0500 "Michael Froomkin - U.Miami
School of Law" <[email-masked]> wrote:

>> assure that even the modestly sized root zone file is correctly
>> distributed to all root servers accurately and in a timely fashion. 
> 

There is a certain amount of work required to keep a large number of
servers in sync. Developements such as IXFR, Notify and TSIG all help in
speeding up convergence and assuring correctness of data. Still, if the
ship is to be run as tight as can be, one needs to perform a significant
admin and monitoring work to ensure that these functions actually function. 

I agree with Valdis that this is not IETF list material; it should be taken
to the operations community ASAP. 

Måns, running DNS servers for fun and public benefit. 
- -- 
Måns Nilsson    http://vvv.besserwisser.org

---

From: [email-masked]
Date: Sun, 24 Nov 2002 15:51:16 -0500

> No - and I can confirm that non exists or at least i have not seen any in

So there's *NO* public data to back it up that you know of..  They claim to
have several times more customers/users/whatever than even AOL, and *there is
no data* to back that up?

The truly interesting question would be: How much of their traffic is
"value-added", and not just acting as a caching name server for the current
root?  If they have 150M users, but only 379 of them use it as anything other
than a cache for the existing root, they're no more interesting than any
of the other alt.roots that you label "peanuts".

But I doubt we'll get any hard data of *that* detail when they haven't even
quantified how many users they have.

> operations irrespective of the means used to calculate it.

No data, but they want you to believe them anyhow.

It's called "Snake Oil", Joe....
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 24 Nov 2002 14:47:34 -0700 (MST)

> From: [email-masked]

> ...
> ...

It seems likely for several reasons that spammers would be among the
organizations most likely to buy names from the other roots if they were
usable or even just popular.  Every day I read several 100 unsolicited
bulk mail messages that land in spam traps while looking domain names to
add to my blacklists.  Since I don't use the fraudulent roots,
non-colliding names in the fraudulent roots are undefined for me.  I rarely
find undefined names and do not recall ever seeing a name in ".love" or
other bogus top level domain.   Almost all of the undefined names I do
see are either obvious typos or develop definitions via odd registrars
within a day or two.  In the last month or two, I've seen only one name
that might be in an "alternate" .com universe, and I suspect it is a typo.

Because SMTP servers that reject undefined domain names in the
Mail_From command, are extremely common, you would expect that not
even spammers are likely to be stupid enough to buy a name in one
of the fraudulent roots for use with email.

It's possible that the "other" domain names would be useful if
confined to HTTP, but I suspect that's only a little more likely
than the possibility that there is any substance to IPv8.
(Note that the names I check in spam are mostly in URLs, and that
my traps do collect mail from bogus SMTP sender domains.  I check
the advertised URLs to ensure that they are not being attacked with
a "joe job.")

In other words, I think you ought to adjust your kook filters.

Vernon Schryver    [email-masked]

---

From: Joe Baptista <[email-masked]>
Date: Sun, 24 Nov 2002 17:23:13 -0500 (EST)

> organizations most likely to buy names from the other roots if they were

oh no spam.  no one was talking about spam.  were just talking about root.
your the first to mention spam and your right no one would buy domains in
the alt universe for smtp service.  http for sure is used today.  the
alternative roots have spam free domains on the internet.

but then how many spammers use ficticious domain names in the USG
internet.  Alot!

And I take exception to you claiming these roots are ficticious.  They are
the future of root service.

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Sun, 24 Nov 2002 18:17:15 -0500 (EST)

> no data* to back that up?

I accept their claim.  Much like I accept most data I get on the net -
including my own.  Basically I feel most data - including public - can be
challenged.  Postel once described the net as a very big space.  And i
feel the "space" is very hard to quantify.  I've seen many attempts and
i'm not that confident of their accuracy - at best the methodologies
employed show trends.

If I had time i'd investigate the claim myself.  But if you go to their
web page you will see the isp's who they pay to carry their part of the
namespace universe - which see www.new.net.  There are some big names
there and i'm sure a poll of those companies on their user bases can
validate or invalidate new.net's claims.

> of the other alt.roots that you label "peanuts".

Exactly.  I'm in 100% agreement overall here.  The .god and .satan top
level domain registries have over 8,000 domains registered this past year.
And most of them are parked.  They have been paid for but only a few
hundred resolve.  And this considering we have over 1000 users and a
majority of domains are registered to two bulk users.

And much of the same applies to most of the domains in the alt.root
universes.  alot of domains at namespace seem to be attached to something
- usually a web site - but most of those are web spaces set up by
namespace or namespace friends.

> quantified how many users they have.

Well the one thing that really bother me about new.net is that they don't
do more.  OK - so let say their 156 M figure is bullshit.  I can live with
that.  But still whatever figure it is - I still think it's significant.
Even if they just have a 10% market share - it's still significant.

But the users of these ISP's are mainly ignorant of the fact that these
additional namespace options exist.  I find it surprising they have not
effectively marketed themselves through their existing user population.
Maybe i'm missing something here.  156 M people could easily start a
trend.

> It's called "Snake Oil", Joe....

it's all snake oil Valdis.  I see no difference between the ICANN or
new.net snake oil.  it's simply a snake oil of a different colour.

regards
joe baptista

---

From: Dave Crocker <[email-masked]>
Date: Sun, 24 Nov 2002 18:20:08 -0600

Valdis,

Sunday, November 24, 2002, 2:51:16 PM, you wrote:
>> No - and I can confirm that non exists or at least i have not seen any in

Valdis> So there's *NO* public data to back it up that you know of..  They claim to

There is also no data to support continuance of this denial of service
attack on the ietf list.

d/
-- 
 Dave Crocker  <mailto:[email-masked]>
 TribalWise <http://www.tribalwise.com>
 t +1.408.246.8253; f +1.408.850.1850

---

From: Keith Moore <[email-masked]>
Date: Sun, 24 Nov 2002 23:59:06 -0500

> or to fire them. 

Exactly correct.  Of course, various people in the USG may be deluded 
to the point of believing that USG has the authority.  The USG thinks
it has the authority to decide who can or cannot rule other countries,
so it's hardly surprising it thinks it can decide who runs the DNS root.

Keith

---

From: Paul Vixie <[email-masked]>
Date: 23 Nov 2002 18:00:06 +0000

vint, the thing you're not including in your analysis is that mr. baptista
is a dns pirate and his article in circleid was entirely self-serving and
politically based.

> to all root servers accurately and in a timely fashion.

that's our issue.  mr. baptista's issue is that he wants everyone on the net
to have their own unique root, each with a set of tld's seasoned to local
tastes, ideally with many of them pointing at tld's he controls.  this is no
different in its end result from what new.net wants, it's just a different
method of achieving it.

the thing that surprised me was that circleid actually published his article,
including URL at the end (http://www.dot-god.com/resources/ROOT.html) which
points to mr. baptista's activism/piracy site.  i had not thought of circleid
as a tabloid until yesterday.

(what's worse, i think that we are both now guilty of feeding the trolls.)
-- 
Paul Vixie

---

From: Joe Baptista <[email-masked]>
Date: Mon, 25 Nov 2002 11:17:43 -0500 (EST)

> is a dns pirate and his article in circleid was entirely self-serving and

Paul baby - it's a honour to get such recognition from you.  But where's
your Proof?

Now Paul - I find it somewhat entertaining that you would crawl out of
your wintering hole and growl at me and make false accusation i can use
againts you.  Thats not nice Paul.  And frankly it's my opinion that such
baseless jibberish is below you.  Your a recognized leader in this
community.  A root server operator.  You even went along with postel
on the hi-jacking (or was that test) if the root servers.  Paul your a
legend in internet history.  What you have to say carries weight here.
Yet your so quick to anger and libel.  I ask that you refrain from this
shameful conduct.

or give me proof of your claims?

> different in its end result from what new.net wants, it's just a different

I'll tell you what mr. baptista wants.  he wants a zone file that
is simular to the .com file.  A place where everyone can get their own
tld.  The roots are irrelevant to the issue - they are simply a false
monopoly obstacle in a game where the end user is in charge.  The current
USG root monopoly is built on ignorance and mr. baptista wants to see that
ignorance evaporate.

> as a tabloid until yesterday.

Paul - there's no other place to put it.  You'll notice in my other
articles published at circleid that i use lists.

example:

http://www.circleid.com/articles/2539.asp

in this case i linked to an ipv6 list of isp's as the story was on ipv6.

it's important that my readers have references to investigate.  something
i don't find in many articles these days.

but i do appreciate your concern.  i'll suggest to my editor that any
lists i use he feel free to duplicate on circleid.  now paul i can't make
any promisses.  means more work - but at least your feedback will be
heard.

> (what's worse, i think that we are both now guilty of feeding the trolls.)

well if i'm a troll then you've been a tasty nibble.

but paul - let's try to get along here.  the ietf list is one of the few
lists i'm on which is civilized.  let's try to work towards that together.

kindest regards
joe baptista

---

From: Melinda Shore <[email-masked]>
Date: Mon, 25 Nov 2002 11:51:48 -0500

>I ask that you refrain from this shameful conduct.

Ahem.

As amusing as all this isn't, operational issues really
don't belong on the ietf mailing list.  Let me add my voice
to the growing chorus of people who have asked you to take
it elsewhere.

Melinda

---

From: Joe Baptista <[email-masked]>
Date: Mon, 25 Nov 2002 12:44:33 -0500 (EST)

> to the growing chorus of people who have asked you to take

melinda - my appoligies.  i've been ignoring the regular insults which are
to be expected when one challenges the establishment.  However one can not
ignore paul vixie when he comes out and calls one a dns pirate.  That
borders on slander and liable - after all mr. vixie is worshipped far and
wide.  his pebbles of wisdom are scattered on the masses infrequently.

paul and i also enjoy a very long history.  unfortunately as far as the
history is concerned for much of that time paul has been a very unappy
camper.

now i appreciate this group.  very little sillyness goes on here.  i
personally am no longer responding to the thread - unless of course some
other net god cares to make libelous statements.  i am no dns pirate - i
consider myself and am a dns pioneer.

cheers
joe baptista

---

From: Joe Touch <[email-masked]>
Date: Mon, 25 Nov 2002 10:20:53 -0800

> or give me proof of your claims?

How about proof of the hi-jacking? (sauce for the gander)

Until then, please keep your attacks those who are still able to defend 
themselves.

Joe Touch
Director, Postel Center for Experimental Networking
USC/ISI

---

From: Joe Baptista <[email-masked]>
Date: Mon, 25 Nov 2002 13:50:23 -0500 (EST)

> Until then, please keep your attacks those who are still able to defend

I always support my allegations.  Proof of Hi-jacking GO HERE

the email:

	http://www.law.miami.edu/~froomkin/articles/icann-notes.htm#F175

the event:

	http://www.law.miami.edu/~froomkin/articles/icann-body.htm#B175

Gordon Cook I understand can attest to this.  He trolls here from time to
time.  He overheard Postels end of the conversation.  This of course is
well know internet history.

Gordon Cook also has reported on it - see his home page -
www.cookreport.com.

regards
joe baptista

---

From: Joe Touch <[email-masked]>
Date: Mon, 25 Nov 2002 11:08:34 -0800

> 	http://www.law.miami.edu/~froomkin/articles/icann-body.htm#B175

Jon's original note is insufficient to assert that it was anything other 
than at a test.

The subsequent analyses cited are the _opinions_ of others. While 
everyone is entitled to his opinion, those who actually spoke to Jon got 
quite a different story.

> well know internet history.

It's as well known that Gore invented the Internet. While opinions often 
drive what people call history, they do not drive what is known as fact.

>> Ira Magaziner released his Green Paper in the midst of what Jon
>> Postel called a test of the ability of root servers to point elsewhere
>> than NSI. Critics called Postel's "test" a hi-jacking

Again, "what critics call". Your assertion that this was hijacking isn't 
substantiated by the facts; the facts only indicate that it was the 
opinion of a subset of critics.

Joe