Subject: GA-DIGEST V1 #1428
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST         Friday, September 20 2002         Volume 01 : Number 1428

----------------------------------------------------------------------

Date: Thu, 19 Sep 2002 22:35:12 +0000
From: "Roberto Gaetano" <[email-masked]>
Subject: Re: [ga] Fwd: LACTLD comments on Zone Transfers

Jonathan Weinberg wrote:
>
>	I'm impressed by the degree to which everyone has managed to avoid
>talking about the elephant under the bed here.  As the LACTLD message
>below states, and as Karl's message at
><http://www.dnso.org/clubpublic/ga/Arc11/msg00268.html> explains in
>detail, the ICANN position that it needs zone file access "for purposes of
>verifying and ensuring DNS operational stability and performance" seems
>problematic.  On the other hand, I'd guess that zone file access would
>simplify ICANN's task if it chose to redelegate a ccTLD away from an
>operator unhappy with that change.  Anyone want to talk about this
>explicitly?
>

I will give a try.

I doubt that the task of redelegating will be simplified with the copy of 
the zone files, if by this you mean that the zone files will be given to a 
new Registry and they could run the TLD as if they were the old one.
So this is not the purpose, at least in the short term.

What ICANN will achieve if it gets the copy of the zone files is the 
following:
- - an element of pressure on the ccTLD (it is in possession of information 
that is relevant for the operations of the TLD, and even if the information 
held will be insufficient for a smooth redelegation it will constitute 
surely a threat)
- - a political statement of authority (as already noted by Alex, ICANN will 
make clear who is the master, and ccTLDs cannot claim that ICANN is only a 
"service provider")
- - allow the camel to stick its nose under the tent (a precedent will be 
established, and the road is open for ICP-nn that extends the concept, and 
states the "long established policy and practice" that "in the interest of 
the stability of the Internet" complete escrow of all Registry data have to 
be provided to ICANN; somebody might give us a lecture on how this, in 
reality, has always been meant to be part of RFC1590, it just has not been 
clearly spelled out before because the editor made a mistake)

But I would like to highlight a problem on a different level, to explain why 
deNIC (and maybe others) will never give away this information.
The ccTLDs, as they have repeatedly stated, serve their "local community". 
Their legitimation does not come from ICANN.
For good or bad, the principle of having "country" TLDs has been 
established, and in one way or the other the laws of the country hosting the 
ccTLD have to have jurisdiction.
We can debate forever if a government of a country has authority to request, 
for instance, a redelegation of the ccTLD of the country. I personally 
believe it does, but the matter is irrelevant, because given the requirement 
that the contact has be in the country, it is by definition subject to the 
national laws of the country.
All this to say that the local governments have a certain degree of 
authority on the ccTLDs (again, I do believe that they have the ultimate 
authority, but this is irrelevant). Of course, this does not mean that the 
country has direct control or involvment on the operations of the ccTLD, but 
that it has national interests to defend.
Different countries have different "business models", and this is seen in 
other utilities, like water, electricity, telephone, postal service, and so 
on. They might use different approaches (nationalized industry, free 
competition, mixed economy, and what else), but one thing will be the common 
denominator: that it will be decided by them, and not by a private 
corporation in California, what model to use.

Why am I wasting bandwidth with this apparently marginal discussion? Because 
I want to give you the feeling that some ccTLDs will never give up to ICANN 
for the simple reason that their respective governments will not. ICANN is 
not an International Treaty Agency (actually, by any standard of 
"internationalism" ICANN is performing very poorly). Countries have no 
obligation towards it. Moreover, ICANN is directly controlled by one 
country. To give in about this matter is to give away property and control 
from the country that has jurisdiction over the ccTLD to the country that 
has jurisdiction over ICANN. And I can clearly see the reluctance to do so, 
in particular for European ccTLDs.
(incidentally, if the whole matter was regulated by international treaties, 
the situation would be totally different, because ICANN Staff would be 
international civil servants, reporting to the United Nations and not to the 
government of a country, and the transfer of information would be protected 
by international law and not falling under jurisdiction of a country)

The subject of escrow has been brought up by a different post. That reminds 
me the initial meeting with the 5 .com testbed registrars, in Washington DC, 
when Louis Touton announced that one of the conditions was escrow of data to 
ICANN or other trusted third party *in the US*. Two Registrars were 
vehemently opposed, and also Melbourne IT was not happy. After much 
discussion the requirement was watered down (in fact, it is still under 
discussion).
So, in summary, I do believe that the maximum that the ccTLDs could allow, 
in an extreme attempt to allow ICANN to go back without losing face, is a 
similar approach to escrow. Something like to provide the zone files to a 
trusted third party, that could preform the checks ICANN states are required 
for the stability of the Internet, but without releasing the information 
outside the legal jurisdiction of the country. I don´t know if Sabine is 
happy about DENIC making this additional effort (and expense, because I 
assume that the trusted third party has also children to feed), but at least 
Kanzler Schroeder would not oppose it.

Sorry for the length, I got carried on.
Regards
Roberto

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 22:42:04 +0000
From: "Roberto Gaetano" <[email-masked]>
Subject: Re: [ga] Cyberspace Security and the Root(s)

Marc Schneiders wrote:

>
>Several independant sets of rootservers are better than just one.
>Naturally these sets do not have to have different information. Ideally
>they carry identical data.
>

Thank you, I could not have used myself better words.

The ideal situation is indeed to have a system of servers that carry 
identical data. In fact, what about 13 copies of the same data, scattered in 
different continents, whose information is guaranteed to be identical by a 
co-ordinated effort of the 13 managers?

Maybe that´s what we need to implement, I wonder why nobody has thought 
about this simple and ideal solution!

Regards
Roberto

_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 16:00:06 -0700 (PDT)
From: Karl Auerbach <[email-masked]>
Subject: Long term registrations - Was: RE: [ga] Fwd: LACTLD comments on Zone Transfers

On Fri, 20 Sep 2002, Steven Heath wrote:

> How would you collect payments/renewals?

For some reason folks seem to presume that we need a system in which names 
are periodically renewed.

Given that the cost of this entire DNS registry/registrar system is hugely
inflated by the cost of performing updates, it would not be inconceivable
for there to be a system in which registrations are sold for long periods,
say 100 years.  I figure that a one time payment of $25 would more than
cover the actual costs of putting such a registration into a zone file, 
particularly if updates were paid for on a per-occurrance fee schedule.

Yes, I know that the ICANN contracts prohibit this, but why?  This has 
never been a topic of public discussion; like much of what ICANN has done, 
it was simply decreed from the Minaret of Truth in Marina del Rey.

There are easy techniques to garbage collect registrations that have been
abandoned - For example, for a fee one could issue a challange to the
purported holder.  If he/she responds within a reasonable, then he/she
gets most of the fee (it makes sense that one should be paid for the
inconvenience of defending one's registration.)  If not, then the name
would go into a holding pattern for a while and eventually become
available.

		--karl--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 20 Sep 2002 11:28:29 +1200
From: Steven Heath <[email-masked]>
Subject: RE: Long term registrations - Was: RE: [ga] Fwd: LACTLD comments  on Zone Transfers

> On Fri, 20 Sep 2002, Steven Heath wrote:
> 
> > How would you collect payments/renewals?

On Friday, 20 September 2002 11:00 a.m., Karl Auerbach wrote:

> For some reason folks seem to presume that we need a system 
> in which names are periodically renewed.

<info about payment approach removed>

I agree that many different ways exist to charge for service. I also am
aware of ccTLD's that charge a 'one time fee' approach. 

However, most don't. .ca (CIRA) and .nz (InternetNZ) are perfect example's
of ccTLD's that have gone from a no fee basis (both used volunteer time of
University staff and systems) to a 'on going fee'. 

If as per the original comment of Jonathan Weinberg ICANN (or some other
body with the same or greater power) were to use a zone file to 'replace' an
incumbent ccTLD Manager then they would face major issues, one of the
biggest for the current system is income collection. If this new body wished
not to charge for further service this would not eliminate the bigger issue
of how to identify the registrant.

But back to the comments about payments. Back in the early late 80's and
early 90's I recall reading about the cost of recording usage and then
collection costs for long distance calls was a huge amount of the actual
cost of long distance calls. One could say that the equivalent of per minute
billing in the name space is charging for changes to the registry and
compared to the 'all you can eat for a year' approach most ccTLD's have now.

Registries do have a high fixed cost, while a one time fee can set to
recover this fee over the life of the name (or more exact that registrants
usage of that name). The issue is how do you determine a life of a name?

Do we set it at 10 years?
Do we set it at 50 years?
Do we set it at 2 years?

The expected life of the name is one of the major inputs to determine the 1
time fee the other of course is the operational costs.

Now, Karl comments on a OTF of $25 and "particularly if updates were paid
for on a per-occurrence fee schedule.". 

My opinion is any fee that is based on the registrant, or their agent, being
charged to update details would result in lower quality of data compared to
the a fee based on unlimited changes being allowed. Lower quality is not a
good thing.

Steven Heath
.nz news & views
http://radio.weblogs.com/0110729/
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 18:28:23 -0700
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] Cyberspace Security and the Root(s)

Roberto and all assembly members,

Roberto Gaetano wrote:

> Marc Schneiders wrote:
>
> >
> >Several independant sets of rootservers are better than just one.
> >Naturally these sets do not have to have different information. Ideally
> >they carry identical data.
> >
>
> Thank you, I could not have used myself better words.

  Agreed here!  >;)

>
>
> The ideal situation is indeed to have a system of servers that carry
> identical data. In fact, what about 13 copies of the same data, scattered in
> different continents, whose information is guaranteed to be identical by a
> co-ordinated effort of the 13 managers?

No, this would be a very bad idea to continue for obvious security
and integrity reasons that have been stated and re-stated time and
time again.  The USG/Legacy Root Server set of 13 is not what
March was referring to above that you so graciously and rightly
agreed with, Roberto.  He was referring to multiple sets or unknown
number of root servers.

>
>
> Maybe that´s what we need to implement, I wonder why nobody has thought
> about this simple and ideal solution!

  They have.  Except that as stated above the huge difference is that
ICANN only wants one set of 13 root servers, and that is from
a security and functionality stand point dangerous and irresponsible...

>
>
> Regards
> Roberto
>
> _________________________________________________________________
> Send and receive Hotmail on your mobile device: http://mobile.msn.com
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,
- --
Jeffrey A. Williams
Spokesman for INEGroup - (Over 127k members/stakeholders strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 972-244-3801
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 20:05:16 -0400
From: Patricio Poblete <[email-masked]>
Subject: Re: Long term registrations - Was: RE: [ga] Fwd: LACTLD comments on Zone Transfers

On Fri, Sep 20, 2002 at 11:28:29AM +1200, Steven Heath wrote:
> > On Fri, 20 Sep 2002, Steven Heath wrote:
[...]
> 
> My opinion is any fee that is based on the registrant, or their agent, being
> charged to update details would result in lower quality of data compared to
> the a fee based on unlimited changes being allowed. Lower quality is not a
> good thing.

When we at NIC Chile started charging for domain name registrations back in 1997,
we had an initial "registration" fee, plus a yearly "update" fee that you would
only have to pay if you requested a modification during that year (and it
was collected at the time of the first update in a year). The registration fee
provided for "free" updates during the first year.

Users perceived this as complicated system, comparing it to what happened in
.com, where with a periodic renewal payment they could submit modifications
without having to think that they would cost them money. We did observe the
effect Steven predicts: customers avoiding some non-essential updates (and a few
essential ones!), with data becoming stale in our database.

Also, we didn't have back then an instant payment system, and we issued bills
that were due in 30 days. When bills went unpaid, what were we supposed to do...
reverse the update?

Well, finally we decided to abandon that system and switch to the usual renewal
fees.

Patricio Poblete
NIC Chile
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 20:29:47 -0400
From: Patricio Poblete <[email-masked]>
Subject: Re: [ga] Fwd: LACTLD comments on Zone Transfers

On Thu, Sep 19, 2002 at 01:16:31PM -0400, Jonathan Weinberg wrote:
>
> [...]  On the other hand, I'd guess that zone file access would
> simplify ICANN's task if it chose to redelegate a ccTLD away from an
> operator unhappy with that change.  Anyone want to talk about this
> explicitly?

First of all, let me say that NIC Chile currently allows access to
its zone file by IANA, and also that we are in full agreement with the
LACTLD statement that says that IANA is wrong in making this access a
precondition to processing urgent technical updates for a ccTLD.

When discussing this with colleagues in the ccTLD community, a couple of
them have warned us that, by letting IANA access our zone, we are making
ourselves vulnerable to a hostile redelegation. ICANN's FAQ actually hints
as such a use in <http://www.iana.org/faqs/tld-zone-access-faq.htm#Q8>,
when it says that their copy of the zone file could be used to maintain
DNS service in case of a delegation dispute.

We, on the other hand, think that it is just not realistic to think
that anything resembling normal operation of a ccTLD could be attempted
using the zone file alone. So, fears and hopes about what can be done
with the zone file in terms of forced redelegations are, in our view,
greatly exaggerated.

Patricio Poblete
NIC Chile
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 17:41:09 -0700 (PDT)
From: Karl Auerbach <[email-masked]>
Subject: RE: Long term registrations - Was: RE: [ga] Fwd: LACTLD comments  on Zone Transfers

On Fri, 20 Sep 2002, Steven Heath wrote:

> Now, Karl comments on a OTF of $25 and "particularly if updates were paid
> for on a per-occurrence fee schedule.". 
> 
> My opinion is any fee that is based on the registrant, or their agent, being
> charged to update details would result in lower quality of data compared to
> the a fee based on unlimited changes being allowed. Lower quality is not a
> good thing.

If someone doesn't bother to update their list of DNS servers, eventually
their domain becomes unusable, so there is more than a bit of
self-interest in keeping things up to date.  (Not updating one's DNS
delegation information is sort of like not putting oil into your airplane
motor - yes, you can skip it, but eventually bad things happen.)

As for whois data - I personally have yet to see what I believe to be a
compelling argument why the generic "I" should be required to publish "my"
personally identifiable information for the generic "your" convenience.

If we assume the challange mechanism I posited in a previous message, if
contact information is bad, and someone pays the registry to perform a
challange operation, and no reply is received in response, then losing the
registration is kind of a rather strong incentive for folks to make sure
that the registry has up-to-date contact information.

(Notice that in the challange mechanism that I propose, the name and
contact information of the registrant is not made available to the
challanger.)

		--karl--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 20:45:40 -0400
From: Allan Liska <[email-masked]>
Subject: Re: [ga] Cyberspace Security and the Root(s)

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: MD5

Hello Jeff,

Thursday, September 19, 2002, 9:28:23 PM, you wrote:

JW>   They have.  Except that as stated above the huge difference is that
JW> ICANN only wants one set of 13 root servers, and that is from
JW> a security and functionality stand point dangerous and irresponsible...

I know one should never argue with a troll, but it is painfully
obvious that you have no concept of good network security practices,
and I feel the need to point that out.

The situation you describe would mean one of two things:

1. The multiple roots would have to pull their information from the
primary root.  Which is the same situation that exists now...so you
are not providing any benefits.  Remember, each of the current root
nameservers is maintained by a separate organization -- and not
controlled by ICANN.

2. Alternatively, each root would maintain a primary database of their
own, which leads to the possibility that one set of root servers would
have different information than the other set of root servers.  Which
lowers the integrity of the information, and is, by definition,
insecure.

Also, consider that these alternate roots could possibly be maintained
by people like yourself who obviously have no concept of the meaning
of information security, therefore could be a massive security threat.

As an aside, my understanding of the purpose of this list is that it
is a forum for domain name holders to voice their opinions on ICANN
policy etc (I may be wrong about that, if so I apologize).  Since Jeff
Williams does not have a domain name, should he be allowed to
participate on this list?

Just a thought

allan
- - --
Allan Liska
[email-masked]
http://www.allan.org

- -----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUAPYpvtn+n87oa5a9VAQHDowP9G6BlHqwagikNQuaC5cmI46HmMrNqqCXh
XYlNVY2b/gq8cmv5x2kdj2/ZExP00coHLQ4aRFLhIAL9MEQE6I/yW4knUgOV6/m0
iWqzK8dDoagiSfqkE8xh6VJDUCqph+YAKrgdad9hCpVAcLVxtyOnTEtPOPyXnv6h
KuR5kuzX364=
=kGkZ
- -----END PGP SIGNATURE-----

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 20:54:44 EDT
From: [email-masked]
Subject: [ga] mp3:  Andy on ICANN

Andy Mueller-Maguhn's comments at H2K2 are now online at 
http://www.h2k2.net/media/h2k2FuckingUpTheInternetAtICANN.mp3

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 17:54:45 -0700 (PDT)
From: George Kirikos <[email-masked]>
Subject: Re: Long term registrations - Was: RE: [ga] Fwd: LACTLD comments on Zone Transfers

Hello,

- --- Karl Auerbach <[email-masked]> wrote:
> Given that the cost of this entire DNS registry/registrar system is
> hugely
> inflated by the cost of performing updates, it would not be
> inconceivable
> for there to be a system in which registrations are sold for long
> periods,
> say 100 years.  I figure that a one time payment of $25 would more
> than
> cover the actual costs of putting such a registration into a zone
> file, 
> particularly if updates were paid for on a per-occurrance fee
> schedule.

I proposed a similar scheme during the WLS debate, namely that we be
able to acquire non-expiring .COM domain names, like .EDU names, and
pay fees for updates as they were made. I think it would be a quite
popular offering. Verisign calls WLS "innovation", mocking the English
language and common sense as they do so, when it hasn't a clue what
consumers really want.

By the way, Karl, any news on the the WLS appeal/reconsideration filed
by Dotster? Perhaps it's something you can find out about (being a
director), as you have access to ICANN documents as per your
lawsuit....

Sincerely,

George Kirikos
http://www.kirikos.com/

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 20 Sep 2002 13:36:03 +1200
From: Joop Teernstra <[email-masked]>
Subject: Re: [ga] Update On Whois Enforcement

At 01:52 p.m. 19/09/2002 -0400, John Berryhill Ph.D. J.D. wrote:

>Yes, this works very well as expected.  Exactly 15 days, too...
>
>Step 1:
>
>http://www.icann.org/correspondence/touton-letter-to-beckwith-03sep02.htm
>"7. visosite.com: On 15 May 2002, we forwarded to you a report concerning
>inaccurate data for visosite.com."

One wonders who helps ICANN pick the Domains singled out for such exemplary 
"treatment".
Is there perhaps a TIPS hotline?

>Step 2:
>
>http://www.icann.org/correspondence/mitchell-letter-to-touton-11sep02.htm
>"We also have deleted 3 of the domain name registrations for not timely
>complying [...]"

This is the truly frightening part.
How much chance are registrants given for "timely" complying?

>Step 3:
>
>Domain Name: visosite.com
>Registrant: John Berryhill
>Date Registered: Sep 18 2002
>
>Any questions?

Yes. Are you now offering to sell it back to the old registrant?   :(

- --Joop

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 20 Sep 2002 13:50:39 +1200
From: Steven Heath <[email-masked]>
Subject: RE: Long term registrations - Was: RE: [ga] Fwd: LACTLD comments  on Zone Transfers

On Friday, 20 September 2002 12:41 p.m. Karl Auerbach wrote:

> If someone doesn't bother to update their list of DNS 
> servers, eventually
> their domain becomes unusable, so there is more than a bit of
> self-interest in keeping things up to date.  (Not updating one's DNS
> delegation information is sort of like not putting oil into 
> your airplane
> motor - yes, you can skip it, but eventually bad things happen.)

I understand the logic but you have now replaced a regular planned known
billing event with billing instead being ad hoc. Both of our approaches have
billing, one is planned and known (to both parties) and the other isn't.

Most Internet related 'things' are access to the well and not per bucket...
this makes it easier  to determine costs for the user and income for the
supplier. For good and for bad.

> As for whois data - I personally have yet to see what I 
> believe to be a
> compelling argument why the generic "I" should be required to 
> publish "my"
> personally identifiable information for the generic "your" 
> convenience.

Lets assume that no private data is in whois. The registry still has to have
up to date information on the registration for the ad hoc billing to occur.
It also must record, for both accounting and for customer service reasons
all the activities (eg to prove to a registrant that in fact a change was
made and ergo a charge was raised).

> If we assume the challange mechanism I posited in a previous 
> message, if
> contact information is bad, and someone pays the registry to perform a
> challange operation, and no reply is received in response, 
> then losing the
> registration is kind of a rather strong incentive for folks 
> to make sure
> that the registry has up-to-date contact information.
> 
> (Notice that in the challange mechanism that I propose, the name and
> contact information of the registrant is not made available to the
> challanger.)

The entire challenge approach has merit but it does seem to push toward a
thick registry model. This is not bad just needs good explicit agreement
that this is better for key stakeholders.

And of course the challenge process needs a billing process :-)

Steven Heath
.nz news & views
http://radio.weblogs.com/0110729/
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 22:11:18 -0400
From: "L. Gallegos" <[email-masked]>
Subject: Re: [ga] Cyberspace Security and the Root(s)

On 19 Sep 2002, at 22:42, Roberto Gaetano wrote:

> Marc Schneiders wrote:
> 
> >
> >Several independant sets of rootservers are better than just one.
> >Naturally these sets do not have to have different information. Ideally
> >they carry identical data.
> >
> 
> Thank you, I could not have used myself better words.
> 
> The ideal situation is indeed to have a system of servers that carry 
> identical data. In fact, what about 13 copies of the same data, scattered
> in different continents, whose information is guaranteed to be identical by
> a co-ordinated effort of the 13 managers?
> 
> Maybe that´s what we need to implement, I wonder why nobody has thought
> about this simple and ideal solution!

Where did you get the idea that no one has thought of it before?  There 
is little tolerance on this list for such discussions, but it has been 
discussed for years.  In acutality, that is precisely what the roots 
attempt to do now - at least the major roots.  There is even a mail list for 
root managers hosted by Abraham Sinclair.  That list is meant for just 
such coordination and cooperation.  Further development along those 
lines would certainly enhance root operations world wide.  However, the 
major roots will include all the known TLDs as opposed to just the few 
that ICANN deems accepatable in its eyes.  All that means, however, is 
that there is really a great deal more for the public than what is included 
in the USG root.  

As long as ICANN is not willing to even communicate along these lines, 
there will be more of the status quo and precedents set for problem 
causing decisions such as duplication of TLDs.  That's a bandwagon 
many people are jumping on as a result of what ICANN did.  ICANN 
wants total control of what people on the internet can access via TLDs 
and as long as this is true, there will be little the rest of the root 
managers can do.  While they seem to be willing to cooperate with one 
another, ICANN is not willing to even come to the table.

Leah

> 
> Regards
> Roberto
> 
> 
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 20 Sep 2002 04:20:10 +0200 (CEST)
From: Marc Schneiders <[email-masked]>
Subject: Dotted Toiletpaper (Re: [ga] Cyberspace Security and the Root(s))

On Thu, 19 Sep 2002, at 22:42 [=GMT-0000], Roberto Gaetano wrote:

> The ideal situation is indeed to have a system of servers that carry
> identical data. In fact, what about 13 copies of the same data,
> scattered in different continents,

Some continents missing, one very overrepresentated.

> whose information is guaranteed to be identical by a
> co-ordinated effort of the 13 managers?

Why is that more ideal than 3 times 13 managers (or 2 times 10)? 39 (or
20) servers are more difficult to kill than 13. The distance of many users
to them would be shorter. Co-ordination need not be more complicated.

> Maybe that´s what we need to implement, I wonder why nobody has thought
> about this simple and ideal solution!

Because we are all entrenched in some form of root-religion and (ab)using
technical issues to argue politics/governance? And thus avoiding the
question that really matters: Who governs these important structures of
the internet? And to whose benefit? And since nearly all people govern for
their own benefit, it is best that nearly all people are represented in
the governing body. Unless we are willing to assume, that the 15 or 20
people on a Board are all selected from the small percentage of humans
that can be called saints.

There are people who argue from the principle 'more is better' that
multiple roots are good, and thus try to legitimize something completely
different and principally unrelated: Multiple roots carrying different
data are OK. Not a valid conclusion naturally.

There are other people who try to show that multiple roots are evil in
themselves, because they believe in the greatness of ICANN (or another
organization they hope will develop from/after ICANN): one authority over
the Names and Numbers. Any technical change that alters the root status
quo is feared, because it might call forth questions of who have authority
over the Holy List. And why. And whether or not they keep it in good
shape.

That is of course what we should be talking about here. Another sort of
zonetransfers than some major ccTLDs refuse to ICANN/IANA.

Another sort of discussion, or rather fight, than the one Stuart Lynn is
forcing upon all, the grab for power by mere assertion:

"We are King ICANN, so if it is our royal pleasure, we should be allowed
to determine what design the toiletpaper has that you at DENIC use.

And we have determined, it is in fact Old Internet Practice, going back to
the days of Postel (we call it IPC-2), that dots are not allowed on
toiletpaper.

So, we order each ccTLD to send us for inspection an (unused!) sheet of
the paper they use in the little room, labelled with their Country Code in
the top left corner (assuming portrait as the perceived shape of the
sheet).

Please, do not put it in any other corner, since we also have to ask you,
_not_ to put the customary dot before your Country Code. So we cannot make
out whether we might be reading your Country Code upside down, if it could
be in any corner. (If the possible writing of the two characters from top
to bottom should also be taken into account, we might also mistakenly read
ZX for XN. And IL could become LI, if writing from right to left would
have to be expected. In the example just quoted of great relevance, as
anyone only faintly familiar with the scripts used in IL and LI can
attest.)

So no dots needed, and no dots wanted, since we intend to use the samples
you send us after inspection ourselves. So they cannot have dots. Not
that we mind breaking our own rules.

Don't forget to add the accompanying fee: $20,000.00. We cannot start
before we have the money. And only after this matter is settled we can
have a look at your requests for changes in the Holy List. You have to
deliver first. Because we have the Holy List. Because we are King."

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 19:40:23 -0700
From: [email-masked]
Subject: [ga] ccTLD whois data base

The Whois data base for a ccTLD is sacrosanct to the country and its'
determination on how to use it.
Any infringement on this concept and even little me will file a lawsuit.

Sovereignty of a ccTLD must remain a constant.  Just because some want
to sell them, .la and .ws, does not change the sanctity and right for
the rest of them to control their own security, reliability and
accessibility.

Could it be blackmail as suggested a week ago?  Hell I do not know but I
could make a case.

But we must object to this derelict attempt to usurp power and cheat the
right of international citizens.
The way Peter taught me to act and my own involvement with ccTLDs makes
my blood boil at the thought of infringement.  Here it may not be
tolerated.

Sincerely,
eric

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 23:37:20 -0400 (EDT)
From: Jonathan Weinberg <[email-masked]>
Subject: Re: [ga] Fwd: LACTLD comments on Zone Transfers

On Thu, 19 Sep 2002, Elisabeth Porteneuve wrote:
> Dear Jon,
> Could you elaborate more what do you mean by ICANN "to chose 
> to redelegate a ccTLD" ? Upon request ? By whom and to whom ?
> I am unaware of any elephant under the .DE bed, neither .AT
> nor .GR. They all operate for the benefit of their Local Internet
> Community, private and public sector alike (the public institutions
> including governmental ones are registered under .de, .at or .gr),
> and within their jurisdiction. 
> Could you be more explicit ?

Elisabeth -- 

	I meant to cast no aspersions on the three ccTLDs you mention, or
indeed on any ccTLDs.  My thought was simply this:  Part of the
longstanding debate over documents like the GAC principles has been the
fear that ICANN would support hostile redelegations of ccTLDs at the
behest of national governments.  To the extent that zone access would make
it easier for ICANN to do that, it seemed to me this was a quite important
matter, which people were choosing for diplomatic reasons not to discuss.  
I referred to it as an "elephant under the bed" because an elephant under
the bed is ostensibly hidden but nonetheless very difficult to ignore; it
seemed to me that this issue was much the same.

	Since I posted my message, though, David, Roberto, Steven and
Patricio have all pointed out that zone file access, by itself, won't be
enough to enable a hostile redelegation; the recipient of the file would
still be missing most of the registry data.  That's a good point; I should
have thought of that.  So the true connection between zone file access and
redelegation is only the more attenuated one that Roberto describes in his
message.

Jon

Jonathan Weinberg
[email-masked]

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 19 Sep 2002 21:18:40 -0700 (PDT)
From: Karl Auerbach <[email-masked]>
Subject: RE: Long term registrations - Was: RE: [ga] Fwd: LACTLD comments   on Zone Transfers

On Fri, 20 Sep 2002, Steven Heath wrote:

> And of course the challenge process needs a billing process :-)

I'm not so sure that I'd agree that that conclusion is a universal truth.

I'm working on an anonymous registration system - it uses 
cryptographically signed digital certificates, a kind of "bearer bond" 
that represents ownership of a domain.

(There would have to be a transfer agent to sign certificates upon 
transfer so as to prevent repudiation of transfers.  However this agent 
need not be aware of what the certificates represent.)

The only reason to have a billing process is if the initial registration
fee is so thin that it doesn't have any room to absorb the costs of
challanges or other such processes.  However, it is possible to make such
procedures very inexpensive - for example a challange can be a sequence of
emails to the e-mail address given in the SOA record.  These e-mails could
use the typical kind of random number challange/response mechanism that is
used in many e-mail subscription systems.  Any valid response would
constitute a sucessful rebuff of the challange.  The cost of this kind of
system could be sufficiently small that some providers could easily decide
to accomodated it in the basic registration fee.

The point is that we have many options - but many of them have been 
arbitrarily ruled out of bounds by ICANN.  Why does ICANN place a 10 year 
limit on registrations?  What is the rationale?  Where was the debate and 
decision?  Who were parties to that debate and decision?

ICANN has become anti-innovation.  For example, suppose a *TLD operates
its DNS servers that provide the proper public query interfaces but use
internal transfer protocols that are quite different than AXFR.  Yet, as
we have seen, ICANN demands the right to do an AXFR.  That is sort of like
the requirement that was imposed by the railroad unions in the 1950's and
1960's that diesel locomotives on railroads retain an expensive and
useless fireman alongside the engineer/driver.

		--karl--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #1428
*************************