Subject: Re: ***UNCHECKED*** Global Multistakeholder Meeting on the Future of Internet Governance

From: SM <[email-masked]>
Date: Thu, 21 Nov 2013 01:21:28 -0800

Hi Jari,
At 11:17 19-11-2013, Jari Arkko wrote:
>However, while the site is coming up, it would 
>be useful to think about the kinds of things 
>that could be usefully discussed. There are 
>obviously many specific issues which belong to 
>already existing organisations. Such as protocol 
>parameter registry topic being an IETF/IAB 
>matter, TLD assignments an ICANN matter, etc. 
>There's little reason to create new places to 
>discuss such topics. On the other hand, it would 
>probably be good to have a place to discuss the 
>overall situation, relate work in different 
>organisations to each other, build more 
>co-operation, etc. What are your thoughts on 
>this? What topics do you think need additional attention?

According to (unconfirmed) news articles the CEO 
of ICANN mentioned that there's now a "coalition" 
of the "I*" groups (ICANN, IETF, etc), big-name 
companies such as Disney, and governments such as 
Brazil, focused on creating multistakeholder 
solutions to problems  such as spam and cyber-bullying.

I have participated in the antispam discussions 
for some time.  I don't recall seeing anyone from 
Disney participating in the discussions 
[1].  According to ICANN there is growing 
pressures to address issues outside its sphere of 
responsibility as a motivating factor in forming 
a high-level panel.  From an IETF perspective I 
have some doubts about whether it is a good idea 
for the IETF to join a coalition where the IETF 
Chair would be signing mission creep [2] statements.

The IETF has been perceived as neutral.  It can 
take a position for or against the interests of 
Country X if there is consensus for that.   I 
don't think that the IETF leaders should rely on 
the consent of the governed in taking such a 
position or create a fait accompli [3].

The IETF leaders [4] have been silent about the 
topic in the subject line; I am excluding the 
help comments about the 1net.org web site.  That 
is not a good omen for openness.

Regards,
-sm

1. discussions which are open
2. the gradual broadening of the original 
objectives of a mission or organization
3. something that has been done and cannot be changed
4. except Jari

---

From: John Curran <[email-masked]>
Date: Thu, 21 Nov 2013 11:19:19 -0300

On Nov 21, 2013, at 6:21 AM, SM <[email-masked]> wrote:

>> However, while the site is coming up, it would be useful to think about the kinds of things that could be usefully discussed. There are obviously many specific issues which belong to already existing organisations. Such as protocol parameter registry topic being an IETF/IAB matter, TLD assignments an ICANN matter, etc. There's little reason to create new places to discuss such topics. On the other hand, it would probably be good to have a place to discuss the overall situation, relate work in different organisations to each other, build more co-operation, etc. What are your thoughts on this? What topics do you think need additional attention?
> 
> According to (unconfirmed) news articles the CEO of ICANN mentioned that there's now a "coalition" of the "I*" groups (ICANN, IETF, etc), big-name companies such as Disney, and governments such as Brazil, focused on creating multistakeholder solutions to problems  such as spam and cyber-bullying.
> 
> I have participated in the antispam discussions for some time.  I don't recall seeing anyone from Disney participating in the discussions [1].  According to ICANN there is growing pressures to address issues outside its sphere of responsibility as a motivating factor in forming a high-level panel.  From an IETF perspective I have some doubts about whether it is a good idea for the IETF to join a coalition where the IETF Chair would be signing mission creep [2] statements.
> 
> The IETF has been perceived as neutral.  It can take a position for or against the interests of Country X if there is consensus for that.   I don't think that the IETF leaders should rely on the consent of the governed in taking such a position or create a fait accompli [3].
> 
> The IETF leaders [4] have been silent about the topic in the subject line; I am excluding the help comments about the 1net.org web site.  That is not a good omen for openness.

I'm not an IETF leader, but have had a ringside seat for some of the recent
developments and figured that providing a summary of events might be helpful 
to folks on this list for context.  I'm simply trying to provide some framework 
in which to consider the recent events (and apologies for length, but it would 
take me weeks to express this all more succinctly.)

As has already been noted and discussed, the leadership of several Internet
organizations (ISOC, ICANN, IAB/IETF, IANA, RIRs, W3C, aka "I*") have been 
getting together periodically for better coordination.  While there have been 
statements issued in the past after such meetings, the "Montevideo Statement" 
issued after this years meeting (i.e. post-Snowden) made some observations 
about the Internet which were fairly obvious but hadn't quite been said in a 
clear and consistent manner previously.  High-level points include:

   - Importance of globally coherent Internet operations 
   - Concern over Internet fragmentation at a national level
   - Strong concern over pervasive monitoring and surveillance
   - Ongoing need to address Internet Governance challenges, 
   - Need for evolution of global multistakeholder Internet cooperation
   - Need for globalization of ICANN and IANA functions
   - Need to allow all stakeholders (inc. governments) to participate equally
   - Need for the transition to IPv6 to remain a top priority globally.
<http://www.internetsociety.org/news/montevideo-statement-future-internet-cooperation>

In some worlds, this might have been the end of it and folks would have all 
gone back to their organizations and worked on various pieces of the above...
For example, the IETF Vancouver discussions on pervasive monitoring/perpass, 
For ISOC, these include issues like evolution of multistakeholder Internet
cooperation; for ICANN, globalization efforts in preparation for all 
governments having an equal role; IPv6 efforts by the RIRs, ISOC, etc.

Many of these issues are of interest to parties not participating today in IETF, 
ISOC, ICANN, the RIRs, W3C; furthermore, the collective "I*" organizations are
seen as a narrow segment of society, i.e. often called the "Internet technical 
community" when characterized by folks and organizations completely unaware of how 
all of this works, but quite aware that the decisions made by these organizations
can affect their use of the Internet.  

As much as we're all comfortable working in the existing organizations, there is a 
strong desire for being able to discuss Internet layer 8+ issues in a forum which 
puts everyone in equal basis (i.e. not within "Internet technical organizations")
There is actually an organization which does a good job of facilitating discussion
(The Internet Governance Forum, or "IGF") which is chartered under UN DESA and has 
been going on for nearly a decade.  One of the frustrations that everyone has with 
the IGF is that it discusses problems, but very intentionally does not attempt to 
drive towards solutions; i.e. it's a forum for sharing views minus any mechanisms 
for developing outcomes.  These means that discussions of "Internet Problems, e.g. 
spam, surveillance, child protection, copyright enforcement, anonymity, botnets/ddos,
privacy, network neutrality, freedom of speech, cybersecurity, privacy, deep packet
inspection, DNS takedowns, user tracking/cookies, etc., are discussed without any
clear roadmap emerging for solutions (it's worth noting that some of these "problems"
are actually features for others folks, all varying based on one's perspective.)  

Ironically, some of these perceived "Internet Governance challenges" actually do 
have solutions (or if not solutions, at least best practices in how to cope with
the present realities), and it's lack of communication outside the Internet orgs
that is really needed to get the word out there.  For example, the IETF has a 
number of BCPs which could help in the mitigation of spam, botnets, and other
problems; unfortunately, availability of these technical solutions is seldom 
mentioned when governments, businesses, civil society get together and discuss
"Internet problems".  The folks at the Internet Society did a great job noting
this situation (see <http://www.internetsociety.org/doc/internet-collaborative-stewardship-framework-tackling-challenges-–-political-technical>) 
on their web site for more details, and it was suggested that we should follow
up the Montevideo Statement with something more collaborative and effective that
the present discussion-without-outcome model of the Internet Governance Forum.
That was the thought behind having a neutral forum to discuss these Internet 
problems, i.e. what is now being called the "1net" initiative.  (To insert a
personal view, I do believe that having a neutral forum where we can better
engage outside of the "Internet Technical community" on Internet issues is a 
very good thing, particularly if it leads to collaboration with governments
rather than having them go elsewhere and make unilateral decisions in this 
areas...)

I hope this explains a little bit about the Montevideo Statement and "1net"
(at least as I best understand it.)  When someone asks me what "1net" is about,
I believe that it is intended to be a neutral, community-based initiative to
discuss Internet problems towards potential collaborative solutions.  I have
absolutely no idea which topics might get picked up for consideration (and that 
is truly unknowable until there still needs to be a Steering Committee seated)
but it is my expectation that "1net" will help promote existing IETF technical 
solutions (or potentially identify needs for additional IETF technical solutions) 
to the extent that its discussions touch on Internet protocols.  Similarly, it 
should not represent a change in mission for any of the organizations that get 
involved; it's just intended as way of connecting problems and solutions, i.e. 
it's a mechanism "for evolution of global multistakeholder Internet cooperation"

FYI,
/John

Disclaimer:  I am a signatory to the "Montevideo Statement on the Future of 
             Internet Cooperation" (both individually and on behalf of ARIN),
             but the above solely represents my personal views and understanding.

---

From: Jorge Amodio <[email-masked]>
Date: Thu, 21 Nov 2013 09:43:34 -0600

There are two assumptions that I'm not 100% convinced are entirely true

1- That a new supra entity will be ever able to deliver any solutions for
level 8+ issues that please all when on the equal basis argument some will
lobby to be more equal than others

2- That using ICANN as a reference, the multistakeholder model works
reasonably well to be expanded

But I appreciate you taking the time to clarify some concepts and I agree
that better and more coordination is needed but I believe we are trying to
design the roof when we are not still sure if we have the right foundation.

My .02

Regards
Jorge

On Thu, Nov 21, 2013 at 8:19 AM, John Curran <[email-masked]> wrote:

> >> However, while the site is coming up, it would be useful to think about
> the kinds of things that could be usefully discussed. There are obviously
> many specific issues which belong to already existing organisations. Such
> as protocol parameter registry topic being an IETF/IAB matter, TLD
> assignments an ICANN matter, etc. There's little reason to create new
> places to discuss such topics. On the other hand, it would probably be good
> to have a place to discuss the overall situation, relate work in different
> organisations to each other, build more co-operation, etc. What are your
> thoughts on this? What topics do you think need additional attention?
> >
> > According to (unconfirmed) news articles the CEO of ICANN mentioned that
> there's now a "coalition" of the "I*" groups (ICANN, IETF, etc), big-name
> companies such as Disney, and governments such as Brazil, focused on
> creating multistakeholder solutions to problems  such as spam and
> cyber-bullying.
> >
> > I have participated in the antispam discussions for some time.  I don't
> recall seeing anyone from Disney participating in the discussions [1].
>  According to ICANN there is growing pressures to address issues outside
> its sphere of responsibility as a motivating factor in forming a high-level
> panel.  From an IETF perspective I have some doubts about whether it is a
> good idea for the IETF to join a coalition where the IETF Chair would be
> signing mission creep [2] statements.
> >
> > The IETF has been perceived as neutral.  It can take a position for or
> against the interests of Country X if there is consensus for that.   I
> don't think that the IETF leaders should rely on the consent of the
> governed in taking such a position or create a fait accompli [3].
> >
> > The IETF leaders [4] have been silent about the topic in the subject
> line; I am excluding the help comments about the 1net.org web site.  That
> <
> http://www.internetsociety.org/news/montevideo-statement-future-internet-cooperation
> >
>
> this situation (see <
> http://www.internetsociety.org/doc/internet-collaborative-stewardship-framework-tackling-challenges-–-political-technical
> >)

---

From: Jari Arkko <[email-masked]>
Date: Thu, 21 Nov 2013 13:26:43 -0300

SM:

> 2. the gradual broadening of the original objectives of a mission or organization

First, see the helpful and very informative post from John. (Thanks!)

Second, there are many things happening in the world, some with our involvement and some without. We also try to get IETF (or IAB or ISOC) involved where it is necessary, and we try to keep the IETF community informed on everything that is happening around us.

Montevideo, igovupdate BOF, and the creation of a forum for broader discussion ("1net") are examples of activities that we've been directly involved with. Brazil and the creation of ICANN's high-level panel are examples of initiatives that have been taken by others, but which may affect us. For instance, you'll recognize some names in the panel (Olaf, Lynn, Vint). In addition to participation, outcomes from both new and existing efforts may have an impact on our work. And we'll have to develop opinions about relevant topics in those efforts.

Let me address the case of 1net. As explained before, I believe there is a need for a place to discuss broader than, say, just within the IETF. Several names have been given to the effort, but i think the honest description is that it is intended to be an open place for everyone but almost everything else is undecided. Including what its vision is, if there's organisation beyond a mailing list, difference to other organisations such as IGF. As I stated in my previous e-mail, it would be useful if we (the IETF) came up with opinions about how such discussion could be best accomplished and what the more specific goals should be. You could argue that something which is not baked has been brought into light too early. But maybe that is preferred over, say, some leaders in various organisations deciding what the model is.

In any case, from IETF perspective whatever statements there may be about specific countries or companies working together in any new or existing effort - I say more the merrier. We at the IETF at least should participate in efforts that are open for everyone to participate. As far as I am aware, we are not in closed co-operation or agreement with any specific entity (even if we talk with many parties).

As an aside, I am writing this e-mail in Buenos Aires, while attending an ICANN meeting. Their community had an extra plenary session yesterday at 7am to discuss events. The overall feedback to the leadership seemed to be that there is pretty broad agreement about (a) the situation and need for doing more (b) currently confusing state of proposals and the role of various new forums.

Jari

---

From: SM <[email-masked]>
Date: Thu, 21 Nov 2013 08:35:43 -0800

Hi John, Jorge,
>take me weeks to express this all more succinctly.)

Thanks for the substantive response.  I consider it as an individual 
comment; it keeps the conversation easy.

>    - Need for the transition to IPv6 to remain a top priority globally.

I do not have an opinion about the globalization of ICANN.  In my 
opinion the IETF protocol parameter registry topic is an IETF 
matter.  I am aware that there has been calls for globalization of 
the IANA function.  Internet fragmentation at the national level can 
mean many things.  I am not aware of any discussions about that 
within an IETF context.  There has been some discussion about one or 
more countries spying on Internet traffic.

It is doubtful whether transition to IPv6 remains a top priority 
given the uninspiring results.  There has been some related 
discussion within an IETF context (see transition thread on this 
mailing list).

>gone back to their organizations and worked on various pieces of the above...

Yes.

>seen as a narrow segment of society, i.e. often called the "Internet 

Yes.

>can affect their use of the Internet.

The "Internet technical community" tends to be viewed with 
suspicion.  If I tell some people who write code that I participate 
in the IETF I would be viewed with suspicion. :-)

>are actually features for others folks, all varying based on one's 

Thanks for explaining the above.  It might help other people 
understand that there is a frustration out there because of the 
unsolved problems.  On an unrelated note you and I may have different 
values or outlooks when it comes to, for example, privacy.  I don't 
think that you are wrong.

>that is really needed to get the word out there.  For example, the IETF has a

Yes.

>"Internet problems".  The folks at the Internet Society did a great job noting

The problem, if I can call it that, is the technical solutions are 
mentioned from a U.S. mindset.  Instead of thinking of what a great 
job the IETF is doing I would look at it as how can the IETF help out.

>rather than having them go elsewhere and make unilateral decisions in this

Yes.

>it's a mechanism "for evolution of global multistakeholder Internet 

Community-based initiatives do not work if there isn't buy-in from 
the community.  That requires some effort.  It does not work well if, 
in practice, it masks the sponsors to give the appearance that the 
message is coming from disinterested people.

At 07:43 21-11-2013, Jorge Amodio wrote:
>1- That a new supra entity will be ever able to deliver any 
>solutions for level 8+ issues that please all when on the equal 
>basis argument some will lobby to be more equal than others

Yes.

>reasonably well to be expanded

That would be like using the 1net.org web site as a reference. :-)

Regards,
-sm

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 21 Nov 2013 12:46:47 -0500

> I do not have an opinion about the globalization of ICANN.  In my opinion
> the IETF protocol parameter registry topic is an IETF matter.

I disagree.

Everyone has the right to:

1) Connect hosts to the Internet.
2) Make use of any existing Internet application protocol.
3) Develop new application protocols.

Governments do have the duty to police the Internet to prevent behavior
that is legitimately criminal. But that does not include political or
'moral' censorship.

Companies that provide access have the right to recoup costs but not to
collect monopoly rents.

The distinction between application protocols and other protocols is
important. Innovation and diversity in application layer protocols is
productive. Diversity at lower layers in the Internet stack is usually
counter-productive at best.

The IETF protocol registries do not recognize this distinction at present
and many application layer registries are subject to more control than is
necessary. The Internet will break if multiple parties attempt to deploy
incompatible protocols identifying themselves as 'ipv7'.

There is an IETF interest in controlling the parts of the IANA registry
that allocate numbers for the low level Internet infrastructure. But it
should be easier to add application protocols and these should not require
IETF permission or even registration unless a 'friendly name' for the
protocol is desired and thus a registration mechanism is necessary to
prevent accidental collision.

This is an area where the IETF reserved port number scheme collapsed long
ago. The government and civil society interests should ask IETF to provide
an application discovery mechanism that does not rely on IANA/IETF control.

>  I am aware that there has been calls for globalization of the IANA
> function.  Internet fragmentation at the national level can mean many
> things.  I am not aware of any discussions about that within an IETF
> context.  There has been some discussion about one or more countries spying
> on Internet traffic.
>

> It is doubtful whether transition to IPv6 remains a top priority given the
> uninspiring results.  There has been some related discussion within an IETF
> context (see transition thread on this mailing list).

This is where governments can impact change.

The problem with IPv6 deployment is that there are transition costs. Until
very recently the IETF plan for deployment was to try to make IPv6 more
attractive than IPv4 by deliberately hobbling IPv4 features and resist
palliative measures such as NAT. This was a complete feature.

Now we have over a dozen transition proposals and no clear market choice.
And the market is not going to make a choice because the market
stakeholders find NAT works well enough for its needs.

What I would do as a government entity is to get a group of techies to
describe a minimum set of technical capabilities for Internet access
points. The market can decide colour, shape, size, whether the device
supports WiFi or not. But the box should be capable of:

1) Sitting on an IPv4 or an IPv6 network connection plus a defined IPv4
gateway scheme and provide full Internet service to either IPv4 or IPv6
addresses.

2) Rate limiting SYN requests so as to prevent the DDoS attacks from the
network being passed onto the Internet. (No home network needs to create
more than a million TCP/IP channels an hour.)

3) Blocking outbound packets with forced source addresses.

4) Support Port Control Protocol.

5) Passing all necessary DNS records to perform DNSSEC (provided the root
of trust issues are solved).

We could achieve the necessary pre-conditions for transition if just one
large government told ISPs that they planned to require connection boxes to
support such features. Once the manufacturers of the boxes had a clear
direction, they would have no reason not to provide the same feature set in
other jurisdictions.

-- 
Website: http://hallambaker.com/

---

From: John Curran <[email-masked]>
Date: Thu, 21 Nov 2013 15:20:36 -0300

On Nov 21, 2013, at 12:43 PM, Jorge Amodio <[email-masked]> wrote:

> 1- That a new supra entity will be ever able to deliver any solutions for level 8+ issues that please all when on the equal basis argument some will lobby to be more equal than others

I'm not sure its "to deliver solutions" as much as facilitate existing groups to cooperatively
work on solutions, but the point is taken and quite a realistic concern.

> 2- That using ICANN as a reference, the multistakeholder model works reasonably well to be expanded

I do not know whether the "ICANN" implementation of the multistakeholder will be 
used at all, as opposed to its practice in the RIRs, or as it is implemented in the IETF.

> But I appreciate you taking the time to clarify some concepts and I agree that better and more coordination is needed but I believe we are trying to design the roof when we are not still sure if we have the right foundation.

Happy to provide whatever information I can; I myself am unsure of 1net's probabilities
for success, but am keeping an open perspective on it and figure its better than some 
of the possible alternatives that might emerge trying to do the same.

/John

---

From: SM <[email-masked]>
Date: Thu, 21 Nov 2013 10:48:32 -0800

Hi Phillip,
>3) Develop new application protocols.

I commented about the protocol parameter registry instead of the 
above.  I don't disagree with what people can do.

>Governments do have the duty to police the Internet to prevent 
>behavior that is legitimately criminal. But that does not include 
>political or 'moral' censorship.

I am subject to the laws where I am residing.  If the government were 
to decide to implement political or "moral" censorship I doubt that 
IETF participants would bother about that.

>Companies that provide access have the right to recoup costs but not 
>to collect monopoly rents.

Ok.

>The IETF protocol registries do not recognize this distinction at 
>present and many application layer registries are subject to more 
>control than is necessary. The Internet will break if multiple 
>parties attempt to deploy incompatible protocols identifying 
>themselves as 'ipv7'.

IPv7 was discussed within the IETF in 1992.

>There is an IETF interest in controlling the parts of the IANA 
>registry that allocate numbers for the low level Internet 
>infrastructure. But it should be easier to add application protocols 
>and these should not require IETF permission or even registration 
>unless a 'friendly name' for the protocol is desired and thus a 
>registration mechanism is necessary to prevent accidental collision.

Registration is better if the person considers it worthwhile to 
prevent accidental collisions.  I don't require anyone to do it.  I 
am aware that there is a well-known case where the collision is by 
design because of some IETF history ...

>This is an area where the IETF reserved port number scheme collapsed 
>long ago. The government and civil society interests should ask IETF 
>to provide an application discovery mechanism that does not rely on 
>IANA/IETF control.

I'll wait to read the details of the request to form an opinion.

Yes.

>The problem with IPv6 deployment is that there are transition costs. 
>Until very recently the IETF plan for deployment was to try to make 
>IPv6 more attractive than IPv4 by deliberately hobbling IPv4 
>features and resist palliative measures such as NAT. This was a 
>complete feature.

I'll avoid commenting about NAT.

>What I would do as a government entity is to get a group of techies 
>to describe a minimum set of technical capabilities for Internet 
>access points. The market can decide colour, shape, size, whether 
>the device supports WiFi or not. But the box should be capable of:
>
>1) Sitting on an IPv4 or an IPv6 network connection plus a defined 
>IPv4 gateway scheme and provide full Internet service to either IPv4 
>or IPv6 addresses.
>
>2) Rate limiting SYN requests so as to prevent the DDoS attacks from 
>the network being passed onto the Internet. (No home network needs 
>to create more than a million TCP/IP channels an hour.)
>
>5) Passing all necessary DNS records to perform DNSSEC (provided the 
>root of trust issues are solved).

Ok.

>We could achieve the necessary pre-conditions for transition if just 
>one large government told ISPs that they planned to require 
>connection boxes to support such features. Once the manufacturers of 
>the boxes had a clear direction, they would have no reason not to 
>provide the same feature set in other jurisdictions.

That might work if someone went out there to do the work.

Regards,
-sm

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 21 Nov 2013 15:43:22 -0500

On Thu, Nov 21, 2013 at 1:48 PM, SM <[email-masked]> wrote:

> I am subject to the laws where I am residing.  If the government were to
> decide to implement political or "moral" censorship I doubt that IETF
> participants would bother about that.

On the contrary. Many of us are very committed to preventing those types of
censorship and similar political concerns are the reason that the NSA
activities have caused such a degree of anger.

Moral censorship is invariably a pretext for concealing abusive behavior.
The governments that engage in such censorship have the worst records on
human rights, on women's rights, children's rights, lesbian, gay,
transgender rights.

Effecting social change requires powerful communications tools. Everyone
agrees that pornography is a powerful tool for effecting social change. The
only disagreement is over whether the change is positive or not.

The reason for calling this out as a red line is that I believe that
negotiations are much more productive when everyone is willing to put their
real positions on the table. I am more than willing to work to meet
government interests in protecting their access to the net, to prevent the
use of the net by thieves and child abusers and on a wide range of issues.

But censorship is the one issue where we are not going to come to
agreement. And if they try to impose censorship through political means
they will find that they are being defeated through technical means.

> IPv7 was discussed within the IETF in 1992.

The point is that a change like that needs to emerge from prior consensus
but many application layer developments do not.

At the moment we have an imperfect understanding of which registrations
need which type of treatment.

We want people to innovate and use the net creatively. We don't want to
stand in people's way.

> Registration is better if the person considers it worthwhile to prevent
> accidental collisions.  I don't require anyone to do it.  I am aware that
> there is a well-known case where the collision is by design because of some
> IETF history ...

There are three approaches to allocating identifiers

1) Registration in a finite name space
    (e.g. IP port numbers)
2) Registration in an essentially infinite name space
     (e.g. SRV names, DNS names, URIs, OIDs)
3) choosing identifiers at random with a negligible chance of collision)
     (e.g. PGP fingerprints, UUIDs)

At present we use approach 1 far too often. It is simple but lazy.

We should insist that application layer protocols support approaches 2 and
3 and that approach 2 should require as little effort as possible to
reserve names and prevent collisions.

I will make some more detailed proposals in the apps area later on.

> That might work if someone went out there to do the work.

Brazil is planning to spend a couple of million dollars on a conference.
The set of proposals I describe would cost them considerably less.

People in IETF space are thinking about this process in completely the
wrong way. This is not a threat, it is an opportunity. Here we have a group
of people who have turned up wanting to do something. They don't write
code, they don't write technical specifications. But they are very very
good at getting corporations to move in a single direction when they put
their minds to it.

Isn't that something we need?

Many governments have improved technical specifications to benefit
consumers. The US is actually very poor at this. So I spend $650 for a
telephone that is locked to a single carrier in the US but in most of the
rest of the world the carriers and the vendors are told that they will be
slapped will billion dollar fines and their CEO put in pokey if they engage
in that type of anti-competitive behavior.

The reason cell phones have SIM cards in them is because the European and
Japanese govts. passed regulations that required them.

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 22 Nov 2013 11:37:25 +1300

On 22/11/2013 06:46, Phillip Hallam-Baker wrote:
...
> Now we have over a dozen transition proposals and no clear market choice.

Actually there has been a clear market choice among many ISPs for years:
straightforward dual stack. It works very well. We also have a plethora
of tunnelled solutions, some better than others, which apply to various
different scenarios where the provider's view is that OPEX for dual stack
is higher than OPEX for tunnels. The service to the application software
is still dual stack (in most cases).

I'm no happier than anyone else about the mess in the softwire WG, which
is finally showing some signs of getting resolved, but don't be confused
by that. We don't actually need a single market choice for the tunnels,
and we won't get one.

Just sit back, be happy, and IPv6 will continue to deploy progressively.

> stakeholders find NAT works well enough for its needs.

And when it doesn't, they will switch to IPv6.

> points. 

Please don't. The history of government mandates for IPv6 is, to say the
least, chequered. Best practices are emerging for IPv6 now, as they did
for IPv4 twenty years ago.

    Brian

---

From: Chris Grundemann <[email-masked]>
Date: Thu, 21 Nov 2013 16:26:40 -0700

On Thu, Nov 21, 2013 at 3:37 PM, Brian E Carpenter <
[email-masked]> wrote:
On 22/11/2013 06:46, Phillip Hallam-Baker wrote:
[...]

> for IPv4 twenty years ago.
What I would do as a technologist is to get the operator community to
define a set of Best Common Operational Practices that government types can
point to if and when they feel the need to (and that everyone can use in
the mean time). Well, to be fair, that's not what I WOULD do, it's what I'm
helping to actually DO: http://www.internetsociety.org/deploy360/about/bcop/
.

Cheers,
~Chris

-- 
@ChrisGrundemann
http://chrisgrundemann.com

---

From: John C Klensin <[email-masked]>
Date: Thu, 21 Nov 2013 18:29:32 -0500

--On Friday, November 22, 2013 11:37 +1300 Brian E Carpenter
<[email-masked]> wrote:

>...
> Actually there has been a clear market choice among many ISPs
> for years: straightforward dual stack. It works very well. We
> also have a plethora of tunnelled solutions, some better than
> others, which apply to various different scenarios where the
> provider's view is that OPEX for dual stack is higher than
> OPEX for tunnels. The service to the application software is
> still dual stack (in most cases).

Brian,

Keeping in mind that, with respect to this question, I'm just an
apps guy, but my impression is quite different, mainly:

(1) Unless the service levels between the endpoint machines are
always equivalent when IPv4 and IPv6 are both present and there
are no circumstances in which a choice between IPv4 and IPv6
would make a service difference, there is no such thing as
"straightforward dual stack".

(2) The non-straightforward version requires that applications,
at least TCP-based applications, be able to make rather complex
route optimization decisions about which protocol and addresses
to use and make those decisions in a way that completely
violates clean layering models.  We have, in general, never
figured out how applications are supposed to do that, nor how to
make the needed information available to them.

(3) If one is going to have dual stack on the applications
(generally "client") machines, they need either wired-in
simplistic preference models (e.g., "always prefer IPv6") or
protocols for getting information from and controlling border
routers to which they have default routes.  The former has not
served us well and we haven't done the protocol work for the
latter.  Another alternative would be to actually do routing
from the applications machines with either packets source-routed
through the border routers or the latter being completely
transparent.  As far as I know, the Internet has not worked that
way in a very long time and no one has seriously proposed
changing the way it does work.

Now I'm obviously missing, or misunderstanding, something that
allows you to assert that straightforward dual stack is the
clear market choice and works well despite the above.   Could
you explain what it is?

>> And the market is not going to make a choice because the
>> market stakeholders find NAT works well enough for its needs.
> 

Or they will build bigger NATs or invent a latter-day version of
X.75 gateways at peering points or national boundaries.  It
isn't clear to me that IPv6 is the only remaining choice when
the easiest-to-deploy NAT technologies turn out to be
insufficient or too hard to operate.  If it is not, then we have
no guarantees that IPv6 will be chosen over options and most of
us would consider worse.

>> What I would do as a government entity is to get a group of
>> techies to describe a minimum set of technical capabilities
>> for Internet access points. 
> 
> Please don't. The history of government mandates for IPv6 is,
> to say the least, chequered. 

Indeed.  Just like the history of government mandates for other
networking technologies.

    john

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 22 Nov 2013 13:19:18 +1300

>From the apps point of view, that's true; hence we end up with
heuristics such as Happy Eyeballs. I was referring to ISP
(or campus) infrastructure, where people have been running
dual stacks for many years.

> make the needed information available to them.

Probably because there is no general solution to that problem,
but IMHO you can't fix that without a time machine that takes
you back to about 1977.

> changing the way it does work.

Actually, in the MIF/Homenet world you will find a lot of discussion
of the need for source/destination based routing.

> clear market choice and works well despite the above.   Could

As I said, I'm talking about ISP infrastructure, where the issue
is how to deliver both v4 and v6 service to the customer side
of the CPE box. For years, ISPs that do this by simply running
both protocols have been saying that it's straightforward.

The problems you describe are ones that occur when a host sees
more than one IP service. They don't depend (or very little)
on how those services are carried inside the ISP infrastructure.

On the other hand, I haven't noticed any particular user
issues from this, whether my dual service has come from my ISP,
a campus, or the IETF network.  I'm not sure my wife knows
that she's using IPv6 for a lot of what she does. The problems,
though real, are not blocking for most current users. Also,
IMHO, they have nothing specific to do with IPv6; they are
intrinsic to running two network layer protocols.

   Brian

---

From: Randy Bush <[email-masked]>
Date: Fri, 22 Nov 2013 09:26:37 +0900

> dual stacks for many years.

as the saying goes, it sucks less

>> (2) The non-straightforward version requires that applications, at
>> least TCP-based applications, be able to make rather complex route
>> optimization decisions about which protocol and addresses to use and
>> make those decisions in a way that completely violates clean layering
>> models.  We have, in general, never figured out how applications are
>> supposed to do that, nor how to make the needed information available
>> to them.
> Probably because there is no general solution to that problem, but
> IMHO you can't fix that without a time machine that takes you back to
> about 1977.

it sucks really badly

> of the need for source/destination based routing.

"this is a really steaming pile.  let's shovel more dren on top of it to
cover it up."

>> Now I'm obviously missing, or misunderstanding, something that allows
>> you to assert that straightforward dual stack is the clear market
>> choice and works well despite the above.  Could you explain what it
>> is?
> As I said, I'm talking about ISP infrastructure, where the issue is
> how to deliver both v4 and v6 service to the customer side of the CPE
> box. For years, ISPs that do this by simply running both protocols
> have been saying that it's straightforward.

i thought this fantasy was killed a decade or more ago.  it requires an
ipv4 address for every cpe.  welcome to a+p, it sucks too.

randy

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 22 Nov 2013 13:46:59 +1300

> ipv4 address for every cpe.  welcome to a+p, it sucks too.

Of course, the dual stack model only works while you still have enough
v4 space for one-per-customer. I wasn't intending to deny that. It still
boggles my mind that major ISPs failed to grok this in time. The ISPs that
did grok it are the ones happily running dual stack.

    Brian

---

From: "John Levine" <[email-masked]>
Date: 22 Nov 2013 00:49:45 -0000

>v4 space for one-per-customer.

Why can't you run dual stack with CGN?

---

From: Randy Bush <[email-masked]>
Date: Fri, 22 Nov 2013 10:05:39 +0900

> v4 space for one-per-customer.

i.e. when you do not need it.  that's a real seller.

> It still boggles my mind that major ISPs failed to grok this in
> time. The ISPs that did grok it are the ones happily running dual
> stack.

we deployed dual stack in 1997.  i would not color us happy about this.

randy

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 22 Nov 2013 15:16:49 +1300

> i.e. when you do not need it.  that's a real seller.

Understood, but how else were we going to make the world operate?
If people don't make long term plans and investments, they tend
to end up in crisis mode.

> we deployed dual stack in 1997.  i would not color us happy about this.

And don't imagine I'm happy that it's 19 years since we started this
thing.

   Brian

---

From: Robin Whittle <[email-masked]>
Date: Fri, 22 Nov 2013 13:27:37 +1100

Short version:  Nothing has changed in the last 15 years or more:
                The IPv4 Internet is separate from the IPv6 Internet.
                There is not enough impetus to develop and test the
                protocols, end-user device software, server software
                and to deploy the servers required to make IPv6-only
                connectivity sufficiently useful to most, or any,
                users that there is a real demand for it.

                If an end-user device already has IPv4 connectivity,
                included behind NAT, there's little or no advantage in
                also having IPv6 connectivity, since everything of
                importance can already be done via IPv4.

                Finally, some pertinent quotes from Eric Fleischman
                and Noel Chiappa.

The problem with IPv6 deployment and utilization is not so much the
costs but the fact that the IPv6 Internet is a separate Internet from
the IPv4 Internet.  A computer with only an IPv6 address cannot
communicate directly with any computers which have only IPv4 Internet
addresses.

Indirect communications via a protocol such as SMTP will work because
the protocol does not involve direct end-user computer to end-user-
computer communications.  Messages go via mail servers and as long as
the sender's or the recipient's mail server has both IPv4 and IPv6
connections, the message will be delivered.

Other messaging protocols which rely on servers could be - and in some
cases have been - made to work with the end-points being on different
Internets.  Likewise file storage systems such as Dropbox - though a
year ago it didn't:

  http://www.forwardingplane.net/2012/12/a-day-with-only-ipv6/

A web server with IPv4 and IPv6 addresses can be controlled from either
Internet and serve pages to clients on both Internets.

IPv4 with NAT works well enough that there's little or no attraction for
providing an Internet service which has an IPv6 address but no IPv4 address.

The only way I can imagine there being sufficient impetus to giving
large numbers of users IPv6-only connectivity would be if, for some
reason, such a body of users could have many, most or maybe all their
communication needs met by IPv6-connected servers, including those which
transacted the users' communication with IPv4-only end-points.

One way would be via the end-user's applications running IPv4, in which
case the so-called IPv6-only connectivity is just being used as a
tunnelling mechanism to a global unicast IPv4 address, or more likely a
behind-NAT IPv4 address.  This is not really IPv6 adoption.  I am trying
to find reasons why an end-user would be happy with IPv6 only
connectivity and applications, or even a reason why they would want IPv6
apps and connectivity when they already have IPv4 apps and NATed IPv4
connectivity.

Maybe, if there was a language or cultural group somewhere who didn't
care to (or was not allowed to) access any of the web servers which are
currently not IPv6 connected, and if there was some economic or
political advantage in not giving them even NATed IPv4 addresses, a
large enough body of IPv6 end-users might emerge that there was impetus
for some or many currently IPv4-only servers to gain IPv6 connectivity
in order to communicate with this body of users.

Maybe in China or North Korea an IPv6-only service might be launched,
for instance due to the government preferring a NAT-less service where
every user has a unique IP address, so their activities can be more
reliably monitored.  It hasn't happened yet, because such a service
would not be much use to people who expect to be able to access any web
server in the world - and as far as I know most of the web servers are
connected only to the IPv4 Internet.

For years IPv6 promotion has been along the lines of the impending
disaster of running out of IPv4 addresses, coupled with IPv6 being
something like the next version of "the Internet" with boundless address
space.  I do not recall these efforts at promotion explicitly stating
the truth that the IPv6 Internet is a separate Internet from the IPv4
Internet.

Some communication protocols can handle this and make the differences
between the two Internets irrelevant for all users.  To do this I think
three conditions must be met:

  1 - The client protocols must be defined and work well for IPv4, IPv4
      with NAT and IPv6.  This includes situations in which
      connectivity changes rapidly between IP addresses, such as
      when a mobile device connects to a different 3G/4G/WiFi
      system and the device gets a different IPv4 or IPv6 address
      including switching between NATed and unNATed IPv4 addresses.

      Ideally sessions would survive these changes, including between
      IPv4 and IPv6 if (as is not currently the case) a significant
      number of users' devices are sometimes connected only to IPv6.
      The client protocols and the client software itself has to cope
      with this and with having both IPv4 and IPv6 connectivity at the
      same time.  There must be no need for end-user decisions,
      adjusting settings etc.

      (See John C Klensin's message in this thread regarding similar
      difficulties in developing protocols and software.)

  2 - The client software needs to be written for all the relevant
      operating systems including at least: x86 Windows, x86 GNU/Linux,
      ARM iOS and ARM GNU/Linux/Android.

      It also needs to be tested and debugged on all these OS's in
      all the combinations of connectivity mentioned above so that
      it is reliable in all these settings without any end-user
      intervention.

  3 - The communications need to take place via one or more
      intermediate servers which collectively interwork between
      the IPv4 and IPv6 Internets.

There are nested chicken-and-egg problems in the above.  Why would
anyone bother to develop both IPv4 and IPv6 client protocols and all the
end-user and server software for both Internets, especially considering
the demands of developing and testing on multiple operating systems?
They would need extraordinarily strong motivation.  They would not be
able to achieve this level of testing and robustness without a
substantial body of users and probably a year or two's work.

This at cannot be achieved at present because there are no users
anywhere (as far as I know) whose Internet access is IPv6 only.

This is because, with the exception of email and I guess some other
messaging protocols, the major communication protocols have not achieved
all three steps above - making IPv6-only connectivity not worth having.

The answer to the IPv4 address shortage is NAT for end-user devices.
Servers need global unicast IPv4 addresses.  Client protocols need to
work in some way behind NAT - outfoxing the NAT system in some way to
communicate end-user-device to end-user-device and/or by communicating
via a server.

Every widely used end-user protocol, application or whatever needs to
cope with these IPv4 requirements, and be developed and tested for three
or four operating systems.

It would take extraordinary extra effort to extend this to the three
points above which are necessary to make the protocol or service work
seamlessly for end-user devices with IPv4 only, IPv6 only or both kinds
of connectivity.  With the exception of email and I guess a few other
protocols, there has never been sufficient reason to do this extra work.

As far as I can tell, nothing I wrote here is new compared to the
situation 15 years ago, except that end-user device NAT is now
ubiquitous whereas perhaps it was not so then.

The widespread adoption of billions of Internet-connected mobile devices
and the exhaustion of fresh, never-used, paddocks of IPv4 addresses
doesn't alter the situation for end-users, ISPs or protocol/application
developers materially from what it was in the late 1990s:

   There is a separate IPv6 Internet, but there's no compelling reason
   to use it.

   An IPv6-only service would be of so little value that customer
   support calls would devour whatever revenue might be gained from
   selling it.

Finally, here are two quotes from discussions on the IRTF Routing
Research Group list regarding IPv6 adoption:

On 2013-11-20, Eric Fleischman wrote:

    It's currently a lonely job in many large corporations to be an
    IPv6 specialist.  I can't help but wonder how many large
    corporations have plans to migrate away from IPv4?

    The view from my knothole is that RFC 1687 is as true today as
    it was in 1993 when I first wrote it.  It's more than just
    inertia – it's also a very strong perception that IPv4 serves
    us very well.

On the same day, Noel Chiappa wrote, quoting Scott Brim:

    > the IETF has said it doesn't want to come up with any more clever
    > ways to help organizations continue to squeeze more life out of
    > IPv4 addresses.  It will help with transition away from IPv4.

    Just like with NAT.  The IETF would rather stick its head in the
    ground - thereby ensuring that whatever happens, it will be done
    by individual actors, in an incoherent way.

    Like the Bourbons, the IETF has learned nothing, and forgotten
    nothing.

  - Robin         http://www.firstpr.com.au/ip/ivip/

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 22 Nov 2013 15:54:04 +1300

On 22/11/2013 15:27, Robin Whittle wrote:

> A computer with only an IPv6 address cannot

A more relevant version is: a computer that only speaks IPv4 cannot
communicate end-to-end with any computer that doesn't speak IPv4.

That's what we'd fix in 1977 if we had a time machine.

No news here, pass along please.

   Brian

---

From: John Curran <[email-masked]>
Date: Fri, 22 Nov 2013 00:08:37 -0300

On Nov 21, 2013, at 7:37 PM, Brian E Carpenter <[email-masked]> wrote:
> least, chequered.  

Government mandates are not the same as government involvement. For example, 
you'd think at this late point in the game, US education institutions and
networking industry would further along in enabling IPv6 for their public 
facing servers, particularly when compared to the US government...

Compare: <http://fedv6-deployment.antd.nist.gov/cgi-bin/generate-edu>
         <http://fedv6-deployment.antd.nist.gov/cgi-bin/generate-com>
to 
this one: <http://fedv6-deployment.antd.nist.gov/cgi-bin/generate-gov>

(or via charts - http://fedv6-deployment.antd.nist.gov/snap-all.html)

The difference: there is an actual mandate for US federal agencies to 
deploy IPv6 for their public facing services.  This isn't something 
telling anyone else what to do, it's just affecting how the USG buys
its services (and has had a material effect on the IPv6 deployment 
plans of major ISPs as a result)

Personally, I would be very concerned about any desire by governments 
to get involved in mandating IPv6 for Internet service providers of 
any kind, because ISPs are widely different in equipment choices,
architecture, deployment strategies, services offered, etc.  The odds
of anyone directing outcomes top-down and getting it right for all of 
situations is rather low, and the chance of governments doing it with 
success is even lower, approaching nil...

IMHO, if governments _really_ want to help out, it would be nice if they 
themselves deployed IPv6 for their public services (underway in the US), 
if they bought dual-stack Internet connectivity when they buy Internet 
services (not generally happening, yet) and if they discouraged claims 
of "Reach us on the Internet at www.example.com!" when the "Internet"
website is actually only reachable via IPv4.  Indirect support in these 
areas could help the demand side for IPv6 services and increase the 
content that is reachable via IPv6; i.e. outcomes that ISPs can actually 
relate to and which help them support their IPv6 business cases.

FYI,
/John

Disclaimer:  My views alone.

---

From: "Michel Py" <[email-masked]>
Date: Thu, 21 Nov 2013 21:23:21 -0800

Robin,

> Robin Whittle wrote:
> Nothing has changed in the last 15 years or more:

Although I agree with most of what you wrote and won't comment on it (not worth the time going back into our collective past mistakes in detail), I do not agree with you on that one sentence:

> Robin Whittle wrote:
> Nothing has changed in the last 15 years or more

A lot has changed.

- 15 years ago, there was all this capital money pouring down from the sky if you could barely spell "Internet". Gone with the dotcom bust. Darn. Can't make millions from the IPO of an obscure startup that has nothing but vaporware. Dang, a get-rich-quick idea, anyone?

- 15 years ago, IPv6 had a solution for problems that don't exist anymore, such as autoconfiguration. Not saying that DHCP is perfect, but the bottom line is that today anyone can walk into any cybercafé in the world with a WiFi laptop and get connected to the Internet without knowing anything about IP. The most annoying part to me is that, in some countries, they ask for your passport. If there was such thing as a license to operate a computer, many patrons at McDonalds or Starbucks would not pass it (not regarding _our_ criteria of computer geeks). Geez, they can't install the operating system or write a script on their own. They're out there now.

- 15 years ago, IPv6 could scare the heck out of deciders by predicting the end of the world because of a shortage of addresses. Hey, it worked with Y2K. No more; IPv4 addresses have mostly expired, the world did not end, and these days not only people are not adopting IPv6 but they are gearing towards GCN instead.
 
-15 years ago, some people started to pile up IPv4 addresses. They're laughing their bottom off right now. 10 bucks a pop, got a class A to sell? 160 million bucks. Smaller player, a class B. Still 6 million bucks. A class C from the swamp? Too small. But for $10K plus fees, one can find a /22.

-15 years ago, IPv6 was all about getting rid of NAT. Now there are countless IPv6 NAT mechanisms, much more than IPv4.

-15 years ago, some people thought that some level of US government backing would insure deployment success. How do you define success? GOSIP? ADA?

-15 years ago, IPv6 promised a small DFZ because it would have a better multi-homing mechanism (my favorite) (don't get me started on that one).

-15 years ago, nobody would have doubted that IPv6 would be (today, end of 2013) the main protocol in use and we all believed that IPv4 would be in the same league as IPX, Appletalk, Decnet, and so on.

So, 15 years after, IPv6 is nowhere for the reasons you described. One more paper about why IPv6 failed is not going to deploy it. Everyone has tried for the last 15 years, and everyone has failed. Why waste more energy on this? Move on.

It is going to take another 5 or 10 years before the IETF finally acknowledges that IPv6 is a failure. But your IVIP thing is not worth jack crack. You are not even to the point where you realize why. When you have something more that yet-another-miracle, come back to us.

Michel.

---

From: SM <[email-masked]>
Date: Thu, 21 Nov 2013 23:21:59 -0800

Hi Robin,

Yes.

Yes.

>Research Group list regarding IPv6 adoption:

[snip]

>     Like the Bourbons, the IETF has learned nothing, and forgotten

The IETF never learns from its mistakes.  It hides its lack of 
imagination by mitigating the awkward questions.  It's a natural 
feeling; nobody likes to admit failure.

Regards,
-sm

---

From: joel jaeggli <[email-masked]>
Date: Fri, 22 Nov 2013 00:54:02 -0800

> feeling; nobody likes to admit failure.

Ascribing properties of sentience to an organization  isn't going to get
you very far.

It's not unreasonable to expect more failure than success as part of the
human enterprise. If anything the structure of incentives around IETF
activities tend (imho) to cause  us to spend more time dwelling on the
failures, the things that turned out to be a bad idea, and so forth then
simply moving on.

---

From: SM <[email-masked]>
Date: Fri, 22 Nov 2013 01:49:53 -0800

Hi Joel,

Ok.

I would look at the institutional memory angle instead of sentience.

>failures, the things that turned out to be a bad idea, and so forth then

I agree that it is not unreasonable to expect more failure than 
success.  It is likely difficult to have the short discussion about 
why X failed and what could be learned from that.

Regards,
-sm

---

From: John C Klensin <[email-masked]>
Date: Fri, 22 Nov 2013 09:04:30 -0500

--On Friday, November 22, 2013 00:54 -0800 joel jaeggli
<[email-masked]> wrote:

> It's not unreasonable to expect more failure than success as
> part of the human enterprise. If anything the structure of
> incentives around IETF activities tend (imho) to cause  us to
> spend more time dwelling on the failures, the things that
> turned out to be a bad idea, and so forth then simply moving
> on.

I had hoped that the next paragraph of your note would explain
what "simply moving on" would mean for this particular case, but
the note seems to have ended before you got to that paragraph.
For example, from my perspective, CGNs look at lot more like
"IPv4 forever" (and the end for even reinterpreted end-to-end
services) than they do like a reasonably-short-term IPv6
transition strategy.  Is that "moving on"?

    john

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 22 Nov 2013 10:10:41 -0500

> failures, the things that turned out to be a bad idea, and so forth then

Correction, spend a lot of time dwelling on the failures, identify the
cause and then decide that nothing should be done that might change the way
the organization works because as we all know it works so effectively.

The IETF does learn from its mistakes but the management processes are
purposely designed to ensure it never acts on them.

---

From: Ted Lemon <[email-masked]>
Date: Fri, 22 Nov 2013 11:36:31 -0500

> transition strategy.  Is that "moving on"?

CGNs are expensive.   Why would people prefer to maintain them if the IPv6 infrastructure was working?   I don't get the impression that anybody wants CGNs around forever.

---

From: "John Levine" <[email-masked]>
Date: 22 Nov 2013 16:52:28 -0000

> CGNs are expensive.  Why would people prefer to maintain them if the
> IPv6 infrastructure was working?  I don't get the impression that
> anybody wants CGNs around forever.

I don't think anyone wants Windows XP around forever either, but even
though you can argue that newer versions are better, it works well
enough for many purposes, and the switching costs are significant.

Anyone who claims that IPv6 works as well as v4 needs to get out more.
Over in applications land, we still have only the dimmest idea of how
we'll do abuse management on IPv6 mail.  (If you're about to respond
with something that starts "you just ...", see the first sentence in
this paragraph.)

R's,
John

---

From: SM <[email-masked]>
Date: Fri, 22 Nov 2013 15:00:00 -0800

>Why can't you run dual stack with CGN?

This takes you [1] down a path which goes against architectural 
assumptions.  A CGN creates fractions of the addressing space.  As 
the addressing space per customer diminishes the Internet service 
vendor will have to reduce the level of access sold to the customer.

At 08:36 22-11-2013, Ted Lemon wrote:
>CGNs are expensive.   Why would people prefer to maintain them if 
>the IPv6 infrastructure was working?   I don't get the impression 
>that anybody wants CGNs around forever.

It's not that people want CGNs around for a long time.  It's an 
irrational choice [2] as people might feel that they are wasting what 
they have paid for.

Regards,
-sm

1. Used in the general sense
2. http://www.oxfamblogs.org/fp2p/wp-content/uploads/rational_choice.jpg

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 23 Nov 2013 08:40:46 +1300

On 22/11/2013 21:54, joel jaeggli wrote:
...
> failures, the things that turned out to be a bad idea, and so forth then

That's true enough. However, I'm not sure that a protocol whose usage rate
has grown by a factor of ~5.5 relative to total Internet traffic in the
last two years, at one significant content provider, is ready to be declared
a failure. That would normally be considered a success.

(Data from http://www.google.com/ipv6/statistics.html)

Ditto for a protocol whose usage has grown by a factor of ~5
since May this year at another significant measurement point.

(Data from http://www.akamai.com/ipv6)

http://www.worldipv6launch.org/measurements/ for more data.

   Brian

---

From: Ross Finlayson <[email-masked]>
Date: Fri, 22 Nov 2013 11:57:22 -0800

> - 15 years ago, IPv6 could scare the heck out of deciders by predicting the end of the world because of a shortage of addresses. Hey, it worked with Y2K. No more; IPv4 addresses have mostly expired…

According to Wikipedia, "GCN" may refer to:
	• Nintendo GameCube, a video game console
	• Gamma Ray Burst Coordinates Network, a system by which Gamma-Ray Burst information is relayed from the first responding observatory to the rest of the GRB community
	• Genesis Communications Network
	• Grand Canyon National Park Airport, according to the International Air Transport Association airport code
	• Global Christian Network, a religious broadcaster on AMC4 satellite television, a station in New York City and EICB TV across the US
	• Gay Christian Network, nonprofit organization and its associated social networking site
	• Gay Community News (Dublin), Ireland's longest running gay newspaper, published since 1988 by the National Lesbian and Gay Federation
	• Gay Community News (Boston), a weekly journal published in Boston from 1973 to 1992
	• Graphics Core Next Gen, AMD's GPU architecture.

Which of these are you referring to? :-)

	Ross.

---

From: Ted Lemon <[email-masked]>
Date: Fri, 22 Nov 2013 15:55:11 -0500

On Nov 22, 2013, at 6:00 PM, SM <[email-masked]> wrote:
> It's not that people want CGNs around for a long time.  It's an irrational choice [2] as people might feel that they are wasting what they have paid for.

I don't think this is realistic with respect to a typical network operator.   It's generally expected that equipment needs to be replaced on some kind of schedule.   I would hope that by the time the next replacement time rolls around for the CGN hardware, it would simply not be replaced.   But this is easier to do with stateless-in-the-core NATs.

---

From: SM <[email-masked]>
Date: Fri, 22 Nov 2013 15:42:53 -0800

Hi Ted,
At 12:55 22-11-2013, Ted Lemon wrote:
>I don't think this is realistic with respect to a typical network 
>operator.   It's generally expected that equipment needs to be 
>replaced on some kind of schedule.   I would hope that by the time 
>the next replacement time rolls around for the CGN hardware, it 
>would simply not be replaced.   But this is easier to do with 
>stateless-in-the-core NATs.

There are multiple factors which would be relevant to the 
decisions.  Noel Chiappa and John Klensin commented about some of 
them.  The equipment replacement might be incremental.  There have 
been changes in the (hardware) market.  Those changes can affect the 
incremental replacement.

Regards,
-sm

---

From: Robin Whittle <[email-masked]>
Date: Sat, 23 Nov 2013 17:49:32 +1100

In short:  Responding to Michael Py and to Geoff Huston's 2011-08-28
           APNIC presentation which Richard Barnes cited.

           Will the responses to IPv4 address space shortage (other
           than everyone moving to IPv6) tie up the IPv4 Internet in a
           swamp of degradations from which we may never escape?

           If not, then there's no advantage to using IPv6 over IPv4,
           since it seems (others have suggested this - I haven't
           researched it) that some or many IPv6 hosts will be behind
           the end-user's (individual's, company's, university's etc.)
           NAT for reasons of security and/or local convenience.  Still
           every mobile device could have its own /64, and any of its
           dependent devices could still have their own global unicast
           IP addresses.

Hi Michael,

In "IPv6 deployment [was Re: Recent Internet governance events]" You
wrote, in part:

> Although I agree with most of what you wrote and won't comment on it
> (not worth the time going back into our collective past mistakes in
> detail), . . .

OK, as long as the mistakes are widely enough acknowledged and IPv6 is
not promoted in ways which are unrealistic about the barriers to
widespread adoption.

> . . . I do not agree with you on that one sentence:
>

I meant that the fundamental fact of IPv4 and IPv6 being separate
Internets, with only a handful of protocols interworking between the two.

You wrote GCN but I think you meant CGN - Carrier Grade NAT.

I think your mention of Y2K is pertinent.  Though some organisations did
work on it and avoided worse outcomes, people who blew off the dire
warnings and did nothing were rewarded.  They saved themselves a lot of
fuss and now have reason for generalised thinking along the lines: "I
can ignore techies jumping up and down about imminent disaster because
surely the great technical edifice of the modern world will not be
allowed to crumble."  So far, (in general) they have been similarly
rewarded by ignoring warnings about the disaster of IPv4 address run-out
and the need to adopt IPv6.  They will continue to think this way and
consider themselves rewarded even if the Net turns to crap over a period
of years without them realising, due to complexifying responses to the
IPv4 address shortage.

Next time make a negative value judgement in public about someone's
proposal I suggest you do better than this content-free dismissal
garnished with an attempt at condescension:

> But your IVIP thing is not worth jack crack. You are not even to the
> point where you realize why. When you have something more that
> yet-another-miracle, come back to us.

With your experience and ability to analyse and write in detail, a
statement like this might give the impression that you are being lazy or
unpleasant.

  (BTW, Ivip aims to to provide mobility and scalable routing for IPv4
   and IPv6 without changes to routers, current NAT arrangements,
   operating systems, TCP/IP or application protocols or end-user
   application software.  It is not a solution for the IPv4 address
   space shortage.)

Richard Barnes wrote:

> . . . see Geoff Huston's presentation on IPv6 and CGNs at APNIC 32
> all the way back in 2011 (trust me, it's entertaining, as Geoff
> usually is):

  http://labs.apnic.net/presentations/store/2011-08-30-exhaustion.pdf
  http://webcast.apnic.net/meetings/32/opening-hinted.mov

Here's a quote from Geoff Huston's 30 minute presentation:

    . . . we are not going to transition (to IPv6) when there are
    heaps of IPv4 addresses around, we are going to wait until
    there are no more addresses.  We are going to make this transition
    mind bogglingly hard.

    We are going to stress an industry that makes us money by mindless
    process by forcing it to be creative.  You don't want this.

    Because all of a sudden, we are going to make an excursion in
    transition (the slide shows a path from IPv4 to IPv6 via a loop
    involving CGNs, CDNs and ALGs) by instead of making our networks
    simpler, clearer, cleaner, cheaper, we are going to re-equip them
    with the same paraphernalia as we had in virtual circuit worlds.
    We are going to start equipping our networks with a whole bunch of
    novel technologies that we only ever tried before at the edge.

    Carrier Grade NATs are certainly wonderful things.  We've never
    really had any experience at how they load.  We have no real idea
    of what the compression factors are going to be - not now, but in
    four or five years time.

    All of a sudden we are going to start erecting *stuff* in the
    network - and that stuff is actually rationing devices, scarcity
    devices, apertures which *dim* your vision of the network, that
    reduce the clarity of the conversation between one user and another.

    And then, to make things worse, folks are going to say "That's not
    good enough.  I want to get my content close to those users."

This is at 14:30 - he discusses networks changing shape due to Content
Delivery Networks and Application Level Gateways rearing their ugly
little heads.

    At some scale the CGNs won't scale and if we are still in a state
    of denial, we will head into a world of ALGs.

I have no reason to think otherwise than that Geoff Huston's concern is
well founded: different operators adopting different band-aid approaches
to keeping IPv4 alive, in various degraded forms, leading to further
divergences in the type of connectivity offered to customers and so, I
guess, to pressure on protocol/application developers to write more and
more tricky things to cope with various degraded, diverse and not so
well connected aspects of the IPv4 Internet.

Indeed it would be easiest and best in the long term to adopt IPv6
quickly, rather than invest in bogging the entire global communications
network - and its most widely used operating system and client and
server software - in incompatible and/or complexifying patches.

I know next to nothing about Carrier Grade NAT but it sounds costly and
scary: customers running their own one or two levels of NAT (in a home
DSL router, or in a 3G/4G to WiFi box) where the top level NAT box and
the host applications behind it are expecting that NAT box to have a
complete IP address and (I guess) be able to forward specific ports to
specific IP addresses behind the NAT, or the CGN giving special
treatment to that top customer NAT box's service due to the CGN box
analysing packets going in both directions.  Then then these customer
NAT boxes find themselves behind CGN and so not always able to forward a
port or support a "P2P" protocol from the one or more global unicast
IPv4 addresses the CGN box has access to.

Still more worrisome is Geoff Huston's mention of Application-Level
Gateways at the ISP.  Even without an understanding of them, the
specific, current application specific, nature of such things is at odds
with the open, elegant and efficient communications we rightfully desire.

If widespread installation of CGNs and ALGs is the inevitable result of
IPv4 address depletion in the absence of any alternative (the only
alternative being everyone magically being connected to IPv6 with all
their applications working just fine, which would require massive effort
on the part of all application programmers) then we may well be headed
for the permanently entrenched degradation Geoff Huston fears.

If so, then it would be a blessing for a magic genie to appear and
promise to destroy every device which sends an IPv4 packet after
2018-01-01 - or at least convince everyone that he or she would do this.
 Then there's a real chance that all users, protocol/application
developers, equipment manufacturers, operating system developers and
ISPs would knuckle down to the task of a complete change to IPv6.

IF NAT (broadly speaking) could cope with IPv4 address depletion without
tangling the Net in pervasive and entrenched degradation (I guess Geoff
Huston is right to fear that it can't), then here would be my attempt at
a truth-in-advertising footnote for any future "we must all hurry up and
adopt IPv6 because it will soon be essential" IPv6 awareness campaign.

  The IPv4 Internet is separate from the IPv6 Internet.  An IPv4-only
  computer cannot exchange packets with an IPv6-only computer.  Some
  messaging protocols - most prominently, email - which rely on
  intermediate servers can work fine between computers on the two
  different networks.   However the most widely used protocols don't
  and will never be able to.

  Even for protocols and application software which can work with
  IPv6 there are continuing difficulties with ensuring that this
  works reliably, without user intervention, when the computer has
  access to both Internets, including when the connectivity to these
  Internets frequently changes, as it does for many mobile devices.

  The IPv4 Internet was intended to provide a direct any-to-any
  connectivity for all hosts.  It uses what at the time seemed like
  a suitably large ~4 billion address space with a 32 bit address
  field, which stretched the capabilities of many computers of the day.

  Since the 1990s - due to concerns about security, for reasons of
  convenience and/or due to shortage of address space - many or most
  IPv4 connected devices have been behind NAT.  This enabled them to
  initiate and maintain sessions with non-NATed hosts - as all
  public servers are - but it largely prevented one NATed host from
  communicating with another.  NAT and potential NAT traversal
  techniques have never been properly standardized - they are
  widely regarded as a kludge which is at odds with the democratic
  egalitarian goal of a flat network in which all hosts can communicate
  freely with all other hosts.

  IPv6's vastly greater address space ensures that NAT would never
  be needed for reasons of address shortages.  IPv6 has not been
  adopted widely, but there are reports that NAT is frequently
  used with IPv6 for reasons of convenience and/or security.

  IPv4 protocols, applications and patterns of use have developed
  to form a two-class approach - hosts with coveted global unicast
  addresses, as every public server needs - and hosts (which can't
  be servers, and therefore must function only as clients) which don't
  need this and are typically behind one or more layers of NAT.

  This two-class arrangement works, but it is at odds with the
  goals of the designers of both IPv4 and IPv6, who for good reason
  desire a flat network structure in which every host can communicate
  directly with every other host.

  NAT is widely deployed to the point of ubiquity for "client" computers
  - those in the hands and on the desks of most users.  Increased use of
  NAT will enable the IPv4 Internet to function indefinitely within the
  constraints of its 32 bit address system.  [This may not be true!]

  IPv6 is the only developed technology which would be capable of
  achieving a global flat network for the billions of devices which
  are now used for Internet communications.

  However there is little reason for users to adopt it or for
  developers to create software which works with it as long as
  few people use it and as long as the IPv4 Internet serves the
  needs of billions of people, as they develop within the constraints
  of the NAT-based two-class approach.

  If IPv4 had used a 48 bit address, NAT would never have been needed
  for reasons of address space shortage.  Whether NAT would have been
  widely adopted for reasons of convenience and or security cannot be
  known, but IF NAT would have been adopted for these reasons, the
  failure of IPv4 to achieve the designer's initial and still
  desirable goals of a flat network cannot be ascribed to anything
  inherent in IPv4 or its address space limitations.  If this is the
  case, then even if IPv6 was universally adopted, the flat network
  goal (which would enable all protocols to function directly without
  having to be written with the expectation of one or more layers of
  NAT) may never be achieved due to the number of hosts which would
  still be behind NAT.

  - Robin

---

From: Jari Arkko <[email-masked]>
Date: Wed, 27 Nov 2013 20:51:58 +0200

The ICANN met last week, and had obviously many discussions around Internet governance in general, as well as on their more specific tasks. I thought that Markus Kummer's blog contained useful summary of discussions around Brazil conference, the ICANN Internet governance panel, and 1net. Here's the link:

http://www.internetsociety.org/blog/2013/11/wrap-internet-governance-discussions-icann-48-buenos-aires

Jari