Subject: Re: Last Call: 'DNS Name Server Identifier Option (NSID)' to Proposed Standard (draft-ietf-dnsext-nsid) (fwd)

From: Dean Anderson <[email-masked]>
Date: Sat, 8 Jul 2006 17:46:53 -0400 (EDT)

I am not against opaque NSID's: As long as the NSID is unique to the
anycast instance. However, lets be clear on what spoofing means:  To
make the NSID different between successive query responses from the same
instance is to spoof the number of instances. Indeed, the reason given
for this behavior is to hide and obscure the number anycast instances to
prevent DOS attackers from knowing how many there are. [though why
having this knowledge would benefit the attacker was never made clear,
nor was it made clear how denying this knowledge from the attacker would
benefit the operator--but this was the reason given for hiding]. This is
fairly and accurately described as "spoofing".

Lets get our terms clear: "Opaque NSID" is ___NOT___ what "Dean calls
spoofing".  Lets start by getting that characterization right.  Lets be
very clear on that: "Opaque NSID"  and "Spoofed NSIDs" are different,
and have different text examples.  "Opaque NSID"s are still unique to
the anycast instance. "Opaque NSID"s still remain the same across
queries to the same anycast instance.  By contrast, "Spoofed NSID"s are
not unique to the anycast instance.  "Spoofed NSID"s change across
subsequent queries to the same anycast instance, and fail to publicly
identify the anycast instance(s) that handled a group of queries.

"NSID Spoofing" is something lately added by persons associated with
root server operators, in the context of a scientific fraud concerning
the stability of stateful anycast, perpetrated by persons associated
with root server operators, particularly RIPE NCC and ISC.  The IESG is
currently investigating this fraud.  "NSID Spoofing" prevents outside
monitoring of root servers using anycast, and prevents outside analysis
of data regarding root server anycast.  "NSID Spoofing" provides no
other features which aren't already addressed by conventional access
controls.

[It seems ironic to me the my GF is currently grading a series of
placement essays for incoming MIT freshmen. One of the tasks given to
them is to write a "literature summary". They are given several papers
with very different views on a scientific subject, and they have to
write an essay summarizing what the papers say. The essay has to be
interesting, readable, and accurate--in other words, a good literature
summary essay. If they fail the several writing tasks given, they are
placed in additional humanities and writing courses--I don't know
exactly what happens but some sort of remediation is required. It seems
to me this skill of "literature summary" should be developed more
broadly. And indeed, there are other universities working with MIT to
implement the MIT program with their incoming freshmen.]

More inline.

		--Dean

On Fri, 7 Jul 2006, Andrew Sullivan wrote:

> On Fri, Jul 07, 2006 at 06:32:08PM -0400, Dean Anderson wrote:
> > 
> > I think that presently 7 of 10 in the DNSEXT WG who previously commented
> > on the spoofing issue now either support or at least accept the proposed
> > wording change:
> 
> [ . . . ]
> 
> >   Andrew Sullivan is not for spoofing.  "To be clear, I am not "for
> > spoofing".  I think I've said enough on the topic, however, so I won't
> > re-hash my arguments here."
> 
> It appears to me that my statements are being (presumably
> accidentally) misrepresented.
> 
> My position is that I am not "for spoofing".  That does not entail in
> any way that I support the formulation Mr Anderson is arguing for. 
> It seems to me to be a little emotionally charged to suggest that
> those who are opposed to the importation of policy into a protocol
> are "for spoofing".

"Emotionally charged"????  What does that mean?  I can see what is meant
by "opposing importation of policy into a protocol"--rather like Bligh's
view, but I can't see any emotional relationship between this view and
being "for spoofing".  How can that possibly be "emotionally charged"?  
Perhaps you are imputing emotion where none exists?  Or perhaps you are
emotionally concerned about your new co-worker (Joe Abley's) involvement
in the underlying scientific fraud of stateful anycast. I can see that.  
But I rather doubt there is any emotional relationship between these
issues. nor any relevance to my summarizing your position.

I originally summarized your position as supporting the spoofing text.  
That is, you supported the current text. You reacted to that summary by
indicating that wasn't your position.  So, I listed you in the other
category, and now you react against that, too.  It now seems you have a
view in a heretofore unknown third category: Those that don't support
spoofing, don't support the current text, and don't support my proposal
for removing that text.

In any case, what exactly are you for, or against? Please don't be
vague.  How is it that you are "against spoofing", but "for" the current
text, which includes spoofing? If you are "against spoofing" (you wrote
'I am not "for spoofing"'), then that seems to indicate that you agree
that the "spoofing" text should be removed from the draft, regardless of
my "formulation". It is hard to imagine how to formulate removal
differently, but I'm willing to listen to a different formulation for
removal, if you have one.

On Sat, 8 Jul 2006, Alex Bligh wrote:

> 
> 
> --On 07 July 2006 18:32 -0400 Dean Anderson <[email-masked]> wrote:
> 
> >   Alex Bligh does not think there should be a prohibition on opaque NSID
> > (i.e. in am in favour of removing the prohibition), but does not think
> > the ability to use them needs to be expressly authorised in the standard
> > (does not objecting to it doing so per se, I just think its otiose and
> > understands the argument that we shouldn't be seen to encourage it).
> > [the new proposed change does not prohibit opaque NSID, but requires
> > that it be unique per anycast instance. -Dean]
> 
> While the above is true, 

It should be true. You said it:
=======================================================
Date: Wed, 28 Jun 2006 09:34:23 +0100
From: Alex Bligh <[email-masked]>

[...]
What I said (well what I meant to say) is that I do not think there
should be a prohibition on opaque NSID (i.e. I am in favour of removing
the prohibition), but I do not think the ability to use them needs to
be expressly authorised in the standard (I'm not objecting to it
doing so per se, I just think its otiose and I understand the argument
that we shouldn't be seen to encourage it).

Alex
=======================================================

I just changed your text from first person to second person.

> I did also (I think) point out that despite the fact that particular
> bit of draft-ietf-dnsext-nsid wasn't how I would have phrased it
> myself, I was happy with the document going forward in the current
> form, that being the nature of compromise, as all the document has now
> in my view is "a few unnecessary words". I thought this was perhaps
> evident from my original contribution, which was to say that we should
> NOT prohibit opaque NSID (what Dean calls spoofing) though we need not
> encourage it. In any case, I think the point is sufficiently minor
> that it doesn't merit going back to the w/g, and for the record I
> think Olaf made the right call.

Repeat for clarity: "Opaque NSID" is ___NOT___ what "Dean calls
spoofing". Lets be clear on that: "Opaque NSID" and "Spoofed NSIDs" are
different, and have different text examples.  "Opaque NSID"s are still
unique to the anycast instance.  "Spoofed NSID"s are not unique to the
anycast instance.

> Alex

On Sat, 8 Jul 2006 [email-masked] wrote:

> Dean Anderson <[email-masked]> wrote on 2006-07-07 23:32:08:
> 
> > Strongly for spoofing:
> >   Peter Koch
> >   Ed Lewis
> >   [email-masked]
> 
> To be clear, I'm persuaded there are "legitimate", non-detrimental
> uses for returning encrypted responses containing values that don't
> persist between responses.  The term "spoofing" probably inaccurately
> characterises these uses.

I did summarize that. Perhaps, though, you could elaborate on what those
"legitimate" uses might be.  We've still not heard of any truly
legitimate uses.

> I'm very reluctantly responding to your most recent message, but I fear
> that if I (and others) remain silent, that some observers with incomplete
> information may interpret this as acquiescence, or -- worse -- agreement,
> to your charactarisations.

I accurately characterized your position as "for spoofing".  But do
agree absolutely, that if you do not agree with my characterization,
then you should speak up.

> Geoff

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Andrew Sullivan <[email-masked]>
Date: Sun, 9 Jul 2006 15:06:24 -0400

Hi Dean,

I'm extremely leery of going down this conversational path, since I
think I have already explained my views adequately on the WG list. 
But since you ask for clarification, here it is.

>From my point of view, that is the meaning of "spoofing" only in your
ideolect.  Everywhere I ever use the term "spoofing", I use it to
mean one thing pretending to be another, not one thing delivering
answers to identity questions which do not confirm the identity to
the asker.

> "Emotionally charged"????  What does that mean?  

It's a term that people who study arguments (which is what I did in a
previous life) use to describe the use of words that have negative
connotations, when a more neutral term is available.  You can read
more about this issue at <http://www.philosophypages.com/lg/e04.htm>.

For instance, in this case, the term "spoofing" suggests that the
practice is some sort of malicious activity.  In addition, the I-D as
currently written is simply silent about the nature of the name
server identifier.  You could describe it more neutrally, therefore,
as "strong opacity", as opposed to the "weak opacity" that you seem
to want.

> in the underlying scientific fraud of stateful anycast. I can see that.  

No, and I resent the _ad hominem_ attack.  Please don't do that.

> I originally summarized your position as supporting the spoofing text.  

No, you summarized my position as being "for spoofing".  I am not for
spoofing.  I'm not sure that anyone would be in favour of spoofing.

> spoofing, don't support the current text, and don't support my proposal

I do support the current text.  It seems to me to strike the right
balance of making possible a potentially desirable behaviour (where
clients can figure out what node has replied to them) while yet not
imposing policy decisions about how people run their servers.  I
might like it that people put a meaningful and consistent identifier
string in there, because it might make my life easier.  But protocol
documents are not in the business of dictating the policies of server
operators; so I am opposed to any addition to the document of
anything that waters down the statement, "Choosing the NSID content
is a prerogative of the server administrator."

(BTW, nit: I just noticed that "choosing" there is spelled "chosing"
in the document.)

> text, which includes spoofing?

My claim is that this document is not "for spoofing".  Neither am I. 
This document allows server operators to set policy.  I think that's
a good thing.  I am opposed to any changes to that.

I hope this clarifies things for you.  If not, I reluctantly conclude
that I am unable to make my position clear to you.  In either case, I
will not discuss this on list any more.

Best regards,
A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                        +1 416 646 3304 x4110