Subject: a new DNS root for the world?

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Mon, 03 Oct 2005 02:04:18 +0200

http://www.neustar.com/pressroom/files/announcements/ns_pr_09282005.pdf
Comments welcome. Is it to be understood as an alt-root? or is it a 
legitimate hower single operator? Where to find the legal agreement 
with the USG or IANA if any?
jfc

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 03 Oct 2005 09:53:06 +0200

JFC (Jefsey) Morfin wrote:
> legitimate hower single operator?

Neither. .gprs appears to be a private pseudo-TLD inside a walled
garden for GPRS operators. It doesn't have anything to do with
the Internet's namespace. .3gppnetwork.org appears to be a
perfectly normal Internet 2LD.

     Brian

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 03 Oct 2005 10:16:37 +0200

> perfectly normal Internet 2LD.

Note that I regard the GSMA board's insistence on ".gprs" as an incredibly 
stupid move.
If someone proposes to register ".gprs" in the global root, ICANN will have 
to do the same thing they did with ".biz" and disregard anyone operating a 
"toy domain" within their own walled garden.

And if they choose to register ".gprs" in the global root, those who have 
depended on accessing information from the GSMA "private root" and the 
global root simultaneously will be in a world of pain.

Until that happens, the only pain felt to the Internet at large will be 
from the usual leakage of private names into global contexts.

                        Harald

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Mon, 03 Oct 2005 13:17:21 +0200

>perfectly normal Internet 2LD.

Dear Brian,
I have difficulty in understanding this. You talk of "Internet's name 
space". I feel difficult to reconcile this with an NGN approach. Also 
with the Internet as the network of the networks of different 
technologies? IMHO there is a single name space for a single world 
digital ecosystem service continuity. May be a good example of the 
difference between a net-centric and a user-centric architecture?

I agree with Harald. However we could imagine to support their so 
created name space through a different class, as suggested by ICANN 
(in ICP-3). Due to the number of users and ubiquity, I tend to think 
their root system may take the lead in many places (small islands, an 
international priority) and as an extranet back-up solution?
jfc

---

From: "Spencer Dawkins" <[email-masked]>
Date: Mon, 3 Oct 2005 09:10:23 -0500

OK, as much fun as this is...

GPRS relies heavily on a tunneling mechanism (called GTP) for cellular 
mobility. It's IP based.

The DNS that users know ANYTHING about is used INSIDE the tunnel - if a GPRS 
user types www.yahoo.com, that's INSIDE the tunnel.

.gprs is used OUTSIDE the tunnel, to find GGSNs for SGSNs, etc.

.gprs is not an alt-root, it's not even the DNS for a "walled garden" that 
any GPRS user will ever see directly, unless you think that SGSNs are "DNS 
users". It is ONLY used for GPRS infrastructure devices to find each other 
inside a GPRS infrastructure IP network.

Some number of GPRS operators ALSO operate DNS for end users in a walled 
garden, but that has nothing to do with .gprs. It would be a serious concern 
if GPRS end users could send untunneled packets directly to GPRS 
infrastructure devices, because, sadly, it's very rare that GPRS operators 
use IPsec to secure the operation of the GPRS infrastructure.

If you don't understand any abbreviation I used in this e-mail, you don't 
know enough about .gprs to have an opinion about it (some people on this 
list do know quite enough about .gprs to have an opinion about it, but that 
doesn't mean that everyone on this list does).

Followups to www.3gpp.org. But thanks for playing.

Spencer

From: "JFC (Jefsey) Morfin" <[email-masked]>
> space". I feel difficult to reconcile this with an NGN approach. Also with 
> the Internet as the network of the networks of different technologies? 
> IMHO there is a single name space for a single world digital ecosystem 
> service continuity. May be a good example of the difference between a 
> net-centric and a user-centric architecture?
>
> I agree with Harald. However we could imagine to support their so created 
> name space through a different class, as suggested by ICANN (in ICP-3). 
> Due to the number of users and ubiquity, I tend to think their root system 
> may take the lead in many places (small islands, an international 
> priority) and as an extranet back-up solution?
> jfc
>
>
>
>
>

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 03 Oct 2005 10:34:58 -0400

In message <[email-masked]>, "Spencer Dawkins"
>use IPsec to secure the operation of the GPRS infrastructure.
And exactly how does abusing the DNS stop people from sending them 
packets?  In the security world, we have a phrae for this: security 
through obscurity.  It's not a compliment....

I see absolutely no technical justification for .gprs in this 
application.  And yes, I understand what it's for.  I also think that 
Neustar should know better.  My working assumption is that after 
"creating new facts on the ground", to quote a phrase from Middle East 
politics, the GSMA folk will start marketing walled garden content to 
their users under that domain.  (Not that any other generic TLD has 
really caught on, but that doesn't stop folks from trying.)  There are 
also the usual issues of leakage (hint: how do resolvers learn where 
the real root servers live?), confusion if one of operators needs yet 
another pseudo-TLD, and what answers a DNSSEC should give for this 
tree's root.

It's a bad idea, no matter what the excuse.  .local can cause trouble, 
but at least it has some justification.  I see no valid reason for this 
stunt.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: "Marshall Eubanks" <[email-masked]>
Date: Mon, 03 Oct 2005 11:58:32 -0400

Wouldn't it at least make  sense to require that the .gprs
"pseudo-TLD" be reserved by IANA under Section 4 of RFC 2860 ("technical work items" and
"assignments of domain names for technical uses"), with the proviso that 
this TLD must not be resolved, except locally ?

This is under the theory that anything that looks like a tld and is used in IP DNS 
will eventually leak into the public infrastructure.

Regards
Marshall  Eubanks

On Mon, 03 Oct 2005 10:34:58 -0400

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 3 Oct 2005 09:59:52 -0700

>this TLD must not be resolved, except locally ?

Absolutely not. There are already literally dozens (if not hundreds) 
of such local tlds, some of which have the same names for different 
purposes.

--Paul Hoffman, Director
--VPN Consortium

---

From: "william(at)elan.net" <[email-masked]>
Date: Mon, 3 Oct 2005 10:27:22 -0700 (PDT)

On Mon, 3 Oct 2005, Marshall Eubanks wrote:

> "pseudo-TLD" be reserved by IANA under Section 4 of RFC 2860 
> ("technical work items" and "assignments of domain names for technical 
> uses"), with the proviso that this TLD must not be resolved, except locally ?

I don't think registering local TLDs with IANA is a good idea. But if
they want to be certain are no conflicts, potentially they could switch
to using different CLASS (i.e. like HESIOD is locally used in MIT) and 
request some kind of provisional registration for that class in IANA.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 03 Oct 2005 13:28:34 -0400

In message <p0623091dbf6713a37c2a@[10.20.30.249]>, Paul Hoffman writes:
>>("technical work items" and
Yup.  And if ICANN were to create a real .grps TLD, they'd be in 
trouble, which is yet another reason why pseudo-TLDs are a bad idea.

---

From: Jeroen Massar <[email-masked]>
Date: Mon, 03 Oct 2005 19:32:59 +0200

{sort-of IETF off-topic but we have RFC3675}

> of such local tlds, some of which have the same names for different 

You don't want .sms, .wap, .wap2, .gprs2, .turbogprs ??? :)
There is already a .mobi coming up too, another useless domain.
http://www.icann.org/tlds/stld-apps-19mar04/mobi.htm
Will we also get .computer for computer manufacturers, .toy, for toys?
I don't see any reason why they could not have sticked their .mobi
under, something odd; like say: mobi.corp.com, aren't they doing the
mobile stuff in the first place? But the reasoning for this domain is
really great: stakeholders -> money.

http://www.domainbank.net/mobi/index.cfm also lists an excellent things:
"As many companies were beaten in the rush to acquire desired .com
domain names, the .mobi sTLD is a new channel to differentiate your
business from the sea of .coms and .nets and to protect your brand
name."

and I really wonder who is going to deliver the news for all the mobile
users:
"Further attributes of the .mobi sTLD include personal names (e.g.
User_name.name.mobi) and location-based services (e.g.
NewYork.news.mobi) utilizing the .mobi sTLD."

IMHO there should have been only:
 - cc-tld which each contain:
   - gov.cc - for goverment organisations (including military)
   - <name>.cc : for companies and others, first come, first serve
                 no products, no movies, only organisations/lastnames.
 - int for global organisations/companies

Indeed way less than what everybody else seem to want.
But unfortunately we got the mil/gov/net/com stuff as legacy, which sort
of breaks the hierarchy. New domains though are uncalled for IMHO.

DNS is there for name esolution, not for finding a company or a product.
hamburger.int is useless imho, as it is sold by company X, if they want
that in the dns then do it hierarchically: hamburger.foodcorp.int,
unless the shop is only there in one country: foodcorp.cc
If you want to find this hamburger, you will use a search engine, they
nicely index it for you, dns doesn't index anything in that way.

But apparently that is not how all the domain-selling cash cows are
thinking, they just see $$$....

Greets,
 Jeroen

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 03 Oct 2005 13:46:09 -0400

On Mon, 2005-10-03 at 13:27, william(at)elan.net wrote:
> potentially they could switch
> to using different CLASS (i.e. like HESIOD is locally used in MIT) 

Actually, MIT switched to class IN for Hesiod data years ago because
multiple-class support didn't work as well as hoped.  With the data in
class IN hesiod became a simple overlay over the existing DNS with no
mods required to the DNS infrastructure code (resolvers or servers).

Note that, in contrast with .gprs, and regardless of which class it
used,
hesiod data at MIT was always stored in a subzone of mit.edu rather than
in
an unregistered & uncoordinated TLD.

						- Bill

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Oct 2005 14:51:30 -0400

> will eventually leak into the public infrastructure.

IMHO it would make a lot more sense to distribute the (ICANN signed)
root zone by multicast (or what the heck, even BGP) so that resolvers
would never refer queries to the root.

Keith

---

From: Sam Hartman <[email-masked]>
Date: Wed, 05 Oct 2005 16:23:28 -0400

>>>>> "JFC" == JFC (Jefsey) Morfin <[email-masked]> writes:

    JFC> On 09:53 03/10/2005, Brian E Carpenter said:
    >>> Comments welcome. Is it to be understood as an alt-root? or is
    >>> it a legitimate hower single operator?
    >>  Neither. .gprs appears to be a private pseudo-TLD inside a
    >> walled garden for GPRS operators. It doesn't have anything to
    >> do with the Internet's namespace. .3gppnetwork.org appears to
    >> be a perfectly normal Internet 2LD.

    JFC> Dear Brian, I have difficulty in understanding this. You talk
    JFC> of "Internet's name space". I feel difficult to reconcile
    JFC> this with an NGN approach. Also with the Internet as the
    JFC> network of the networks of different technologies? IMHO there

You know, I have to agree with Jefsey here, at least up to this point.
I was not able to understand the rest of the message.  But his point
is valid: walled gardens will leak.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 6 Oct 2005 09:35:51 +0200

On Wed, Oct 05, 2005 at 02:51:30PM -0400,
 Keith Moore <[email-masked]> wrote 
 a message of 18 lines which said:

> root zone by multicast (or what the heck, even BGP) so that
> resolvers would never refer queries to the root.

It is distributed (and it is signed, by the real manager) by FTP,
which is more than enough for a file where it takes months to have
even a trivial change.

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Thu, 06 Oct 2005 10:00:10 +0200

>which is more than enough for a file where it takes months to have

You are right. RIPE documented the figures we all know (see ISOC 
site). Less than 70 changes a year in the root. Up to 3 months delays 
or more.  The compressed version roughly 3 times smaller than the 
ISOC main page.

Should _every_ Internet user (let count one billion) receive a 
personal copy of the root file every month, the decrease of root 
related traffic on the Internet would be by 90%. That the root server 
system works well, does not implies that the root servers system 
concept is still the best solution. We now have 1.5 billions (most of 
the Internet users and many more) who will access the NewStar root file.

jfc

---

From: "Thomas Gal" <[email-masked]>
Date: Thu, 6 Oct 2005 17:33:56 -0700

> Should _every_ Internet user (let count one billion) receive 
> a personal copy of the root file every month, the decrease of 
> root related traffic on the Internet would be by 90%. That 
> the root server system works well, does not implies that the 
> root servers system concept is still the best solution. We 
> now have 1.5 billions (most of the Internet users and many 
> more) who will access the NewStar root file.
> 
> jfc
> 

Is that the case? I think in fact you'd have a lot more data being
transmitted because everyone would be getting information they won't use as
opposed to just polling through various levels of DNS cache, which would
make it seem like very little traffic to the roots in the case of the
records which do not change.

-Tom

---

From: "Nick Staff" <[email-masked]>
Date: Thu, 6 Oct 2005 19:03:41 -0700

> related traffic on the Internet would be by 90%. That the 
> root server > system works well, does not implies that the root servers
system 
> the Internet users and many more) who will access the NewStar root file.
The last time I had a reason keep a copy of the root file locally was back
around 1999 and I think .com alone weighed in at over 3 gigs (I think that
was uncompressed, but I've been hit in the head a lot in the last six years
so I don't quite remember).  I know you weren't serious, but at it's
uncompressed size in 1999 it would be bandwidth cost efficient to send the
root file to someone only if they were to perform approximately 6.3 million
queries per version of root file (which would of course become outdated
during transfer).  Now lets say it's only a one time transfer and after that
only updates are sent.  Well forgetting the bandwidth generated by the
updates, if a person performed 200 queries a night it would take them about
86 years to reach the 6.3 million needed to make the initial transfer cost
effective.

I'm sorry, one should never answer angry and I'm well...okay I just think
it's stupid to do away with the root and I think dns delegation has
exquisite scalability and near absolute empowerment to the people.  Any
possibility that the Internet might not be able to support DNS resolver
traffic because of a root server bottleneck is beyond my concept of reality.
If it truly is a bottleneck then maybe we need to seek the advise of some
adult webmasters and ask them how they manage to serve multiple terabytes of
porn a day without breaking a sweat or bringing down their ISP.  Considering
that when two technical people have a discussion you end up with 3 opinions
that neither one agrees with I feel somewhat better not "letting everyone
play" in the root.  In fact I'm all for fairness but I'm not about to agree
to tearing down a genius system just so foreign nationalists can have their
ego satisfied by sticking their finger in the pot (Jefsey the foreign
nationalist comment IS NOT directed at you at all - it's directed at the
politicians and delegates who live life like it's a game of push and
pushback).

My apologies for the rant, I'm sure I'll regret it when someone who knows
more than me replies explaining why I'm wrong.

nick.

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Fri, 07 Oct 2005 03:11:25 +0200

>records which do not change.

We did the computation during a diner at the ICANN meeting in 
Luxembourg, with people of different origins. Using the RIPE data 
they had on a leaflet there. You can do the computation yourself 
again. And use other sources.

Obviously the DNS is not the traffic. But when you recall that the 
problem with the Hosts file was the traffic load, it shows that time 
have changed, and what had to change once may have to change twice.

jfc

---

From: "'Stephane Bortzmeyer'" <[email-masked]>
Date: Fri, 7 Oct 2005 09:19:57 +0200

On Thu, Oct 06, 2005 at 07:03:41PM -0700,
 Nick Staff <[email-masked]> wrote 
 a message of 45 lines which said:

> The last time I had a reason keep a copy of the root file locally 
...
> I think .com alone weighed in at over 3 gigs

So what? We're talking about the root zone, not about ".com".

> I know you weren't serious, but at it's uncompressed size in 1999 it
> would be bandwidth cost efficient to send the root file to someone
> only if they were to perform approximately 6.3 million queries per
> version of root file

Are *you* serious? The root zone is 62459 bytes, uncompressed. This is
a few hundreds of typical DNS requests.

> (which would of course become outdated during transfer).

Again, you're not serious. The root zone is modified every two-three
days in average.

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 07 Oct 2005 12:21:02 +0200

> is valid: walled gardens will leak.  

What may leak are attempts to resolve .gprs names in the Internet,
which will generate bogus queries to a root server. I don't think
this is a good thing, obviously. But it isn't catastrophic.

     Brian

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Sun, 9 Oct 2005 10:25:17 +0200

On 6 okt 2005, at 10.00, JFC (Jefsey) Morfin wrote:

> We now have 1.5 billions (most of the Internet users and many more)  
> who will access the NewStar root file.
>

As Spencer pointed out - you won't. .gprs is for the infrastructure  
that the users are connected to.

Besides that walled-gardens will leak and are not a good thing (tm).

- kurtis -

---

From: Jaap Akkerhuis <[email-masked]>
Date: Sun, 09 Oct 2005 17:57:17 +0200

> perfectly normal Internet 2LD.
    
    Note that I regard the GSMA board's insistence on ".gprs" as
    an incredibly stupid move.  If someone proposes to register
    ".gprs" in the global root, ICANN will have to do the same thing
    they did with ".biz" and disregard anyone operating a "toy
    domain" within their own walled garden.
    
    And if they choose to register ".gprs" in the global root, those
    who have depended on accessing information from the GSMA "private
    root" and the global root simultaneously will be in a world of
    pain.
    
    Until that happens, the only pain felt to the Internet at large
    will be from the usual leakage of private names into global
    contexts.

To illlustrate how stupid, this is the second .gprs running within
a walled garden I hear about. A couple of years ago one was running
in europe as well, next to the .umts domain. It might still be
running as far as I know.

	jaap

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Mon, 10 Oct 2005 00:00:30 +0200

Dear Jaap,
Full agreement, but this does not address my concern.

I fully understand that Internet designers tell what "should" be. As 
trying to use the Internet solutions in continuity with others 
management tools of the common digital ecosystem, I am more 
interested in what "can" be. And how to practically protect stability 
and to address my needs.

The real concern is a PathFinder II. The users shown they liked 
PathFinder. If NeuStar introduces it on mobiles, to pay for its 
service, it will quickly leak. Two lines more in the loading script 
of the already disputed NTIA root file. In addition to the Chinese 
TLDs may already add. Whatever the size of a pollution, if the users 
like it, it will become a service easily documented by "how to make 
your PC compatible with your Mobile" every where.

- either the IETF stays dogmatic about it and we run into the risk 
that the DNS root governance is no more an ICANN/UN contest.
- or the IETF can propose the innovative solution PathFinder shown 
users are waiting for a long.

In both cases the only chance to delay the risk is to expose it. This 
is what I do, as I did for RFC 3066 bis. May be will I be PR-actioned 
for that too?

jfc
"an Internet user on the IETF mailing lists"