Subject: Why People Should NOT Depend on "Root Servers"

From: "Jim Fleming" <[email-masked]>
Date: Tue, 13 Aug 2002 09:04:36 -0500

http://www.merit.edu/mail.archives/nanog/msg02459.html
gentlemen, stop your engines

  a.. From: Paul Vixie 
  b.. Date: Mon Aug 12 12:07:20 2002 

--------------------------------------------------------------------------------

after six reports that 192.5.5.241's address has been forged as the source
of a tcp "fragmented scan" probe, i'm ready to have it stop.  but just in
case it doesn't, this is fair warning to the community: F's address is in
unlawful use by as-yet-unidentified third parties.

re:

------- Forwarded Message

From: ...
To: "[email-masked]'" <[email-masked]>
Subject: Unauthorized Fragmented Scan
Date: Mon, 12 Aug 2002 06:56:08 -0700

		To whom it may concern,

		The Security Information & Analysis Center has detected an
unauthorized scan against one of our networks that has a possible origin at
192.5.5.241.

		Please review the following initial information:

		IPHalfScan  08-11-2002	 17:34:02 UTC 	192.5.5.241:53
xxx.xxx.xxx.xxx:53	TCP
		IPHalfScan  08-11-2002	 17:28:00 UTC 	192.5.5.241:53
xxx.xxx.xxx.xxx:53	TCP

		Please take action to verify this address on your network
and it's intent to scan our networks.  Thank you for your assistance.

		SECURITY INFORMATION AND ANALYSIS CENTER
		1-877-...

------- End of Forwarded Message

Modern DNS software finds the TLD Clusters, tracks them, and
does not use ANY "root servers" (legacy or alt). People who rely
on a dozen 32-bit IPv4 addresses to be coherently routed are fools,
in my opinion. Any organization that promotes that type of structure
and architecture as "secure" is perpetrating a fraud on unsuspecting
users, who assume the system is stable and secure. Root servers are
out of date, do not always track the TLD Cluster(s), do not support
fail-over to back-up TLD Clusters, in cases of a major corporate
failure. People continue to use them at their peril, yet clearly profit
from telling people to use them.

Jim Fleming
2002:[IPv4]:000X:03DB:...IPv8 is closer than you think...
http://www.iana.org/assignments/ipv4-address-space
http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt

---

From: "todd glassey" <[email-masked]>
Date: Tue, 13 Aug 2002 08:16:19 -0700

Folks -
Paul Vixie is dead on here but the real problem is not DNS, but rather the
routing protocols that allow this type of address forgery to be propagated.
This is the subtle difference here and the biggest criminal here is that
even with a forged DNS service, the real issue is still Cisco and its
brethren for forcing the propagation of routing standards that are
insecurable and indefensible - the other bad-guy here is the IETF for not
being more in control or forcing issues of security to be ingrained into
their protocols that they have or are in the process of making as standards.

This is one of the greatest instances proving that the ICANN and the IETF
themselves with their current management and format, are incompetetent to
build or enforce standards. If they had done their job properly and allowed
external input or review of their efforts, then this never would have
happened.

Just my personal 2 cents here.
Todd Glassey

----- Original Message -----
From: "Jim Fleming" <[email-masked]>
To: "'The IETF'" <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>; "Vittorio Bertola"
<[email-masked]>; "todd glassey" <[email-masked]>; "Richard
Henderson" <[email-masked]>; "Kristy McKee" <[email-masked]>;
<[email-masked]>; "Joop Teernstra" <[email-masked]>; "Joanna
Lane" <[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>; <[email-masked]>;
"Elisabeth Porteneuve" <[email-masked]>; "Alexander
Svensson" <[email-masked]>; "Joe Baptista" <[email-masked]>
Sent: Tuesday, August 13, 2002 7:04 AM
Subject: Why People Should NOT Depend on "Root Servers"

---

From: "Stephen Sprunk" <[email-masked]>
Date: Tue, 13 Aug 2002 10:54:51 -0500

Thus spake "todd glassey" <[email-masked]>
> routing protocols that allow this type of address forgery to be propagated.

Please explain what routing protocol deficiency is responsible for ISPs not
configuring anti-spoofing filters.

> their protocols that they have or are in the process of making as standards.

The IETF responds to its customers' demands.  If ISPs wanted a securable and
defensible routing system (and such a system were possible), we would have one.

> external input or review of their efforts, then this never would have

Last I checked, the IETF was an open standards body that allowed input from
anyone.  If you're unhappy with its products, you're free to write something
better and submit it.

S

---

From: "Jim Fleming" <[email-masked]>
Date: Tue, 13 Aug 2002 11:22:35 -0500

----- Original Message ----- 
From: "Stephen Sprunk" <[email-masked]>
> 
> Last I checked, the IETF was an open standards body.....

http://www.ietf.org
"The IETF is an organized activity of the Internet Society"
=======

The KKK may **think** they are a "public benefit" organization,
but, freedom-loving-people are not fooled by that.

Jim Fleming

---

From: John Stracke <[email-masked]>
Date: Tue, 13 Aug 2002 13:08:15 -0400

>but, freedom-loving-people are not fooled by that.
OK, I think Godwin's Law applies here.

-- 
/=================================================================\
|John Stracke      [email-masked]                        |
|Principal Engineer|http://www.centivinc.com                      |
|Centiv            |My opinions are my own.                       |
|=================================================================|
|If jumping off a bridge was "the industry standard", would you do|
|it?                                                              |
\=================================================================/

---

From: Jeff Williams <[email-masked]>
Date: Tue, 13 Aug 2002 18:59:02 -0700

Todd and all assembly members, stakeholders or other interested parties,

> routing protocols that allow this type of address forgery to be propagated.

  Well Paul may not participate on here any longer for his long ago
already stated reasons.  But I don't believe he is dead!  >;)

  As far a the rest of your comments/observations, I could not agree
with you more Todd...

  BTW, this was discussed in brief today in Waco at the Presidents
Economic Conference...  I will have more for you on that to put up on
ICANNWatch if you wish later...

> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email-masked]
> For additional commands, e-mail: [email-masked]

Regards,
--
Jeffrey A. Williams
Spokesman for INEGroup - (Over 127k members/stakeholders strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 972-244-3801
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

---

From: Donald Eastlake 3rd <[email-masked]>
Date: Wed, 14 Aug 2002 23:08:45 -0400 (EDT)

On Tue, 13 Aug 2002, todd glassey wrote:

> Date: Tue, 13 Aug 2002 08:16:19 -0700
> From: todd glassey <[email-masked]>
> To: 'The IETF' <[email-masked]>, [email-masked], [email-masked],
>      [email-masked], [email-masked]
> Cc: [email-masked]
> Subject: Re: Why People Should NOT Depend on "Root Servers"
>
> Folks -

You do not understand how the IETF works. It is a voluntary organization
producing voluntary standards.  IETF has no authority over Cisco. As far
as IETF protocols go, as far as I can tell, the IESG is ratcheting up
the level of security in new protocols about as fast as IETF rough
consensus will allow.

> build or enforce standards.

I'm not going to say anything about ICANN but you do not understand how
the IETF works. As an organization producing voluntary standards, it has
no power to "enforce standards", never has, and as far as I can tell,
wisely does not want such power.

>                          If they had done their job properly and allowed

I'm not going to say saything about ICANN but you do not understand how
the IETF works. It is an open organization without defined membership.
As such, who would be "external" to the IETF that is not being allowed
to give "input" (other than one or two abusive individuals)? Since all
drafts and mailing lists are publicly readable, who is it who is not
being allowed to "review" IETF work?

> Just my personal 2 cents here.

I wish you would finally get around to deciding that the IETF is
hopeless so you would devote your efforts to other standards
organizations that you would find more competant.

Donald

---

From: "todd glassey" <[email-masked]>
Date: Wed, 14 Aug 2002 20:46:26 -0700

Donald - don't bother arguing this with me. You have a very old-school idea
of the IETF and its pointless for me to point out where we differ in our
opinions or where I believe you are wrong. But that's OK. The IETF like the
rest of the first pass ideas that didn't really work in the longer term will
get morphed into more stable and structured  environments

Todd

---

From: "Jim Fleming" <[email-masked]>
Date: Wed, 14 Aug 2002 22:34:06 -0500

----- Original Message -----
> organizations that you would find more competant.

http://www.spectrum.ieee.org/select/1098/int.html
POSTEL: It's perfectly appropriate to be upset. I thought of it in a slightly different way--like a space that we were exploring
and, in the early days, we figured out this consistent path through the space: IP, TCP, and so on. What's been happening over the
last few years is that the IETF is filling the rest of the space with every alternative approach, not necessarily any better. Every
possible alternative is now being written down. And it's not useful.

.....Concerning your [Postel's] comment about filling up the space, there is this story about an experiment with an infinite number
of monkeys with an infinite number of typewriters generating the works of Shakespeare. Well, we've done the experiment; we've
deployed an infinite number of typewriters and what they're [generating] is protocol specs.

CERF: We're getting the Shakespearean equivalent of "To be or not to be, that is the grzzornay."