Subject: Re: Who owns this Internet thing anyhow...

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 23 Oct 1998 21:08:06 -0400

In message <[email-masked]>, Masataka Ohta wr
ites:

>So, unless you are trying to have a large number of root servers,
>larger than can be contained in the entire IPv6 address space,
>propagation time is not a problem.

Correct me if I'm wrong, but last time I checked, the limit on the number
of root servers was set by the size of the maximum legal DNS packet.  Sure,
we can increase it, but it will take a long time till the old code dies off.

---

From: Dave Crocker <[email-masked]>
Date: Sat, 24 Oct 1998 09:39:37 +0800

>we can increase it, but it will take a long time till the old code dies off.

It would not take all that long to update the root servers, themselves, to
handle a larger set.

At that point, the clients of the servers could choose a subset of the
total, so that we'd get a degree of load sharing, albeit by manual
configuration rather than automated selection.

d/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Dave Crocker                                       Tel: +60 (19) 3299 445
<mailto:[email-masked]>             Post Office Box 296, U.P.M.
                                         Serdang, Selangor 43400 MALAYSIA
Brandenburg Consulting                                          
<http://www.brandenburg.com>                       Tel: +1 (408) 246 8253
Fax: +1(408)273 6464              675 Spruce Dr., Sunnyvale, CA 94086 USA

---

From: Dave Crocker <[email-masked]>
Date: Sat, 24 Oct 1998 09:39:37 +0800

d/

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 11:18:27 JST

Steve;

> we can increase it, but it will take a long time till the old code dies off.

Good question. I'm happy to have purely technical/operational
discussion in the IETF list.

The well-known solution is to assign administratively scoped
unicast addresses to (some or all of) root servers.

Then, there can be a lot of root servers in each administrative
domain sharing the same set of addresses.

Each clients can have bi-directional communication with the
root servers uniquely within an administratively domain.

The root servers should also have globally unique IP addresses
(with different DNS name, if we need reverse lookup consistency)
for zone transfer between them.

For a possible operational concern to have such scoped addresses,
I think everyone can agree that it is far easier to have
administratively scoped unicast addresses than multicast ones,
management of which is already a BCP.

The other possible operational concern is that we may need some
time for a new set of root server addresses (root.cache) propagate.
The possible solutions are 1) just wait or 2) ask (or may have
to force, if they don't think renumbering easy) the organizations
currently operating root servers abandon the globally routable
address ranges containing the address of the root servers.

Shall I write an Internet Draft or an INET'99 paper?

							Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 11:18:27 JST

Steve;

							Masataka Ohta

---

From: Bill Manning <[email-masked]>
Date: Fri, 23 Oct 1998 20:50:31 -0700 (PDT)

> unicast addresses to (some or all of) root servers.

	Discussed at the joint Inet'96/IETF in Montreal
	Considered by folks that understand DNS and 
	determined to be too open to abuse in the 
	current environment.  Once DNSSEC is available
	in a stable release, this option becomes viable.

> Shall I write an Internet Draft or an INET'99 paper?

	Already done that. DNSSEC code ought to be
	ready by INET'99 and have some testing completed.
	Then it would be reasonable to consider touching
	the roots in such a fashion.

-- 
--bill

---

From: Bill Manning <[email-masked]>
Date: Fri, 23 Oct 1998 20:50:31 -0700 (PDT)

-- 
--bill

---

From: Bill Manning <[email-masked]>
Date: Fri, 23 Oct 1998 20:58:28 -0700 (PDT)

> configuration rather than automated selection.

Methinks you have lost track here Dave. Of any of the services used by 
Internet users, the root servers are arguably the most sensitive to
change.  The issue is not the size of a DNS packet, its the size of a UDP
packet. Now if you think we can change the minimum size of a UDP packet,
in this restricted scope, then I'm very interested in learning how this
is to be done.

--bill

---

From: Bill Manning <[email-masked]>
Date: Fri, 23 Oct 1998 20:58:28 -0700 (PDT)

--bill

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 12:53:49 JST

Bill;

> 	Discussed at the joint Inet'96/IETF in Montreal

I think it was in IEPG there. But, I did not join it.

> 	current environment.

Irrelevant.

It is merely that DNS today as is is too open to abuse in the current
environment.

Without any global agreement, anyone who get (leagally or through
cracking) control routing can override routes to the current
shared root servers with local administratively scoped ones
today with DNS as is.

But, so what?

>  Once DNSSEC is available

To make DNSSEC available, the problem of who controls the root
key must be solved.

The key must be protected from any government, especially USG,
of course.

It is a political problem and I personaly think UN security concil
must be involved.

> 	the roots in such a fashion.

That is a false reasoning to promote unnecessarily complex protocols.

DNSSEC is not a solution.

							Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 12:53:49 JST

Bill;

Irrelevant.

But, so what?

							Masataka Ohta

---

From: Randy Bush <[email-masked]>
Date: Fri, 23 Oct 1998 21:22:38 -0700 (PDT)

> The key must be protected from any government, especially USG,

no.  they're irrelevant.  and, as they are irrelevant, they're harmless.
not to worry.  they're here to help.

randy

---

From: Randy Bush <[email-masked]>
Date: Fri, 23 Oct 1998 21:22:38 -0700 (PDT)

randy

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 13:16:23 JST

Randy;

> no.  they're irrelevant.  and, as they are irrelevant, they're harmless.

Our agreement is that they are technically unimportant.

They, however, can be politically harmful.

> not to worry.  they're here to help.

I admit that we must rely on "them" collectively as UN.

						Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 13:16:23 JST

Randy;

						Masataka Ohta

---

From: [email-masked]
Date: Sat, 24 Oct 1998 00:48:46 -0400

(Trimming the cc: list back - I don't THINK I removed any names likely
to be in any filters....)

> It is a political problem and I personaly think UN security concil

Unfortunately, Randy's people who are here to help have veto power
on the security council.

Looks like we're back where we started then....

/Valdis

---

From: [email-masked]
Date: Sat, 24 Oct 1998 00:48:46 -0400

/Valdis

---

From: Dave Crocker <[email-masked]>
Date: Sat, 24 Oct 1998 13:57:20 +0800

>in this restricted scope, then I'm very interested in learning how this

Sorry, folks.  I was too cryptic.

My point was to use a hack along the lines that AOL has used for quite some
time, to work around the UDP limit.

That is, make the changes necessary to get the roots to know about each
other and keep each other up to date.  so, then, we have more roots.

As to getting access to them by clients, keep that mechanism the same, but
give out different subsets of roots to different clients.

d/

---

From: Dave Crocker <[email-masked]>
Date: Sat, 24 Oct 1998 13:57:20 +0800

d/

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 19:39:11 JST

Valdis;

> Unfortunately, Randy's people who are here to help have veto power

Veto is granted to a contry, not because of its high moral standard
(you know why Clinton attacked Bin Laden), but because of its
ability to destroy any agreement along with the rest of the
world.

So, to let the security council grant (defact) veto to some party,
the party should demostrate its ability to be able to destroy the
world.

The demostration of an explosion of atomic bomb or two is known
to be good enough.

But, if Randy so wish, we may try a demonstration of hackers
capability to defeat USG and NSI.

						Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 24 Oct 98 19:39:11 JST

Valdis;

						Masataka Ohta

---

From: "David R. Conrad" <[email-masked]>
Date: Sat, 24 Oct 1998 14:53:20 -0700

>(you know why Clinton attacked Bin Laden)

Presumably, as this is the IETF list, it was because Bin Laden kept using
unregistered protocol numbers?

Regards,
-drc

---

From: "David R. Conrad" <[email-masked]>
Date: Sat, 24 Oct 1998 14:53:20 -0700

Regards,
-drc

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 25 Oct 98 9:54:44 JST

David;

> unregistered protocol numbers?

???

Are you saying you, IETF, IESG, IAB or ISOC should attack those who
are using unregistered protocol numbers?

I think so many protocols (if I remember correctly, including X window)
are or was doing so and such chaos is an important property of the
Internet.

How is the procedure? Can one be given fair chances of couter arguments?

Or, are you just trying to redirect people's attention from your
losing fight to innocent, or, equivalently, not yet proven to be
not innocent, Bin Laden?

							Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 25 Oct 98 9:54:44 JST

David;

???

							Masataka Ohta

---

From: "Perry E. Metzger" <[email-masked]>
Date: Sun, 25 Oct 1998 03:19:17 -0500

> are using unregistered protocol numbers?

What do you think the Secretariat does with all that money they get
from the meetings?

The IESG and IANA collectively control about three hundred megatons of
tactical (not strategic) nuclear weapons. They are used exclusively to
destroy installations using unregistered protocol numbers. The old
methods of sending in demolitions crews or snipers just weren't
sufficiently effective, as once the operation began the offending
software was often sent out over the net itself before there was a
chance to stop it. Nuclear weapons not only vaporize the offending
installation, but also send out a nice EMP burst that knocks out all
the routers in the area, preventing the spread of the contagion. They
used to be hard to get a hold of, but now thanks to all the IETFers
from the former Soviet block, its been much simpler.

Generally, the IANA makes the request, with the IESG deciding on the
final details of how the offending protocol is to be dealt
with. There's a crack team from the Security Area Directorate that
carries out most of the work in the field.  Unfortunately, the recent
increase in workflow has necessitated the addition of a second
Security Area Director.

See RFC 715 for details, including the rules of engagement.

Perry

---

From: "Perry E. Metzger" <[email-masked]>
Date: Sun, 25 Oct 1998 03:19:17 -0500

Perry

---

From: Kyle George <[email-masked]>
Date: Sun, 25 Oct 1998 13:31:47 -0500

> losing fight to innocent, or, equivalently, not yet proven to be

Masataka - 

Umm .. I think it was a joke :).  Masataka, [email-masked] != a list
about the discussion of world politics.  I don't understand why you are
trying to relate internet standardization procedures to Bin Laden.  And
what is this nonsense about "losing fight to the innocent"; what are you
talking about? (I have a strong inclination to believe that your recent
comments represent your prejudice towards Americans, but that's just my
opinion).

- Kyle George

-- 
+++++++++++++++++++++++++++++++++++++++++++++++++
+ Kyle George                                   +
+ [email-masked]                          +
+++++++++++++++++++++++++++++++++++++++++++++++++

---

From: Kyle George <[email-masked]>
Date: Sun, 25 Oct 1998 13:31:47 -0500

Masataka - 

- Kyle George

---

From: "David R. Conrad" <[email-masked]>
Date: Mon, 26 Oct 1998 11:37:02 -0800

Ohta-san,

Sorry, didn't mean to go over your head.  In the future, I'll be sure to
clearly mark my attempts at humor so you won't get lost again.

Just so you know, I was attempting to gently and humorously point out that
discussions of world politics are probably not appropriate for the IETF
list.  There may be more appropriate lists for such discussons (e.g.,
<joke>alt.i.hate.the.us, alt.the.us.is.evil.incarnate</joke>, etc.).

Regards,
-drc

---

From: "David R. Conrad" <[email-masked]>
Date: Mon, 26 Oct 1998 11:37:02 -0800

Ohta-san,

Regards,
-drc

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 27 Oct 98 7:29:20 JST

David;

> list.

As long as politics do not attempt to interfere IETF activities,
true.

And, it's you who said USG involvment were important.

> There may be more appropriate lists for such discussons (e.g.,

Or, if you are gently and humorously pointing out that USG GP or
WP is a joke to be discussed in appropriate newsgroups only, I
have no problem to recognize it an IETF consensus.

						Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 27 Oct 98 7:29:20 JST

David;

						Masataka Ohta

---

From: Fred Baker <[email-masked]>
Date: Mon, 26 Oct 1998 17:23:14 -0800

>are using unregistered protocol numbers?

No, I think he's saying this is not a technical topic, and is not related
to IETF/IESG/IAB/etc policy, direction, or discourse. So this is an
off-topic discussion.

---

From: Fred Baker <[email-masked]>
Date: Mon, 26 Oct 1998 17:23:14 -0800

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 27 Oct 98 11:21:17 JST

Fred;

> to IETF/IESG/IAB/etc policy, direction, or discourse. So this is an

David was saying that purely technical result that USG involvement
is unnecessary were politically incorrent.

						Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 27 Oct 98 11:21:17 JST

Fred;

						Masataka Ohta

---

From: "David R. Conrad" <[email-masked]>
Date: Mon, 26 Oct 1998 20:10:15 -0800

Ohta-san,

Would appreciate it if you did not try to represent me or my words.

>is unnecessary were politically incorrent.

No.  I felt comments regarding US Government actions towards Osama Bin
Laden were not appropriate for the IETF list and attempted to point this
out in an indirect way (as I'm told certain cultures prefer indirect
approaches to confrontation).

As I mentioned in a previous message, I have no further comment on your
stated position that  the US Government's actions on Internet governance
were or are "not important".  I stated my position and felt it pointless to
continue the thread.  If you want to continue to claim the USG's actions
are unimportant with respect to Internet governance despite obvious
evidence to the contrary, enjoy yourself.   I'd simply suggest
irrelevancies such as the US's actions in Afghanistan or the number of
nuclear weapons detonated are unrelated to any technical points you might
be trying to make on the issue and tend to imply you want to bash the US
rather than contribute usefully to any technical discussion.

Feel free to contact me (privately) if any of this is unclear, I'll be
happy to clarify.

Regards,
-drc

---

From: "David R. Conrad" <[email-masked]>
Date: Mon, 26 Oct 1998 20:10:15 -0800

Ohta-san,

Regards,
-drc