Subject: GA-DIGEST V1 #763
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST         Saturday, September 29 2001         Volume 01 : Number 763

----------------------------------------------------------------------

Date: Sat, 29 Sep 2001 08:45:23 +0200
From: Jefsey Morfin <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

- --=====================_19179980==_.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed

Dear Roberto,
I agree that we now have to think seriously to a name space management 
strategy (you may remember I have been quite rebuked when I proposed again 
and again to consider the matter globally and not only through what no one 
really knows what the others call an "alt root").

The whole security strategy stays the same question over techniques and 
centuries. Is concentration better to resist and get protected together at 
the risk of losing everything in case of short defeat, or is dispersion the 
only way to minimize the global casualty toll, offer the best resilience 
and never be fully defeated. Cornwallis vs. Insurgents. British vs. IRA. 
John vs. Robin Hood. Chinese last Emperor vs. Mao. US vs. Viet-Cong. etc... 
I will not dispute that.

But everyone agree that the topography of the battle field is of the essence.

So the first thing is to make sure we do not use wide continuous plains 
strategy while the Internet topography is far more than distributed (like 
hills and valleys) and is a myriad of interconnects (like islands). I are 
to be more Mc Arthur than  Eisenhower. I priority is to keep our lines open 
and avoid contamination. More British a strategy than French.

Bind and co make a good system. But the way we use it is costly and non 
protected. To keep with the WWII image, improving the DNS protection is 
good, but it like adding new destroyers to convoys: this actually enlarges 
the target. What is better is to improve the strategy to increase the 
defence capacity of the islands while reducing the number and the 
dependance from the convoys.

We use the DNS today as if we were calling the operator every time we want 
to place a phone call: like 70 years ago. So part of a response can be to 
concentrate all the operators in a strong hold (but what if they blow the 
strong hold?) Another way is to give everyone a phone book.

Do you know how many times a year (or a decade) the root changes?  And how 
many times it changes enough for calls not to get through? Look at the 
IANA/DoC procedure and the delay to get an IP address updated (ask 
Pitcairn). Nearly one year to get .info and .biz. .pro and other are still 
pending.

I do hope you update your anti-virus files more often than they update the 
root!

The root is available on line via ftp://rs.internic.net/domain/root.zone.gz
It is a 14,655 Bytes file today. To manage the Internet Michelle from the 
IANA is enough, and she may even take vacations. The rest is pure job/fee 
protection.

Our true protection is to get a root copy an to use it with our local 
resolver. Bill Gates thinks that the Microsoft strategy is not there? OK, 
until Windows gets shareware alternative resolvers good souls will keep 
helping in providing root mirrors. ccTLDs will eventually agree root 
delivery is part of their duties to their ISP and good business protection. 
I suppose the GAC will require them soon, probably in MdR. In the meanwhile 
you can use my root servers..

Obviously this shows that the main security battle is against ICANN and 
Microsoft. Let help them correct that and let have an ICANN sponsored 
"alternative authoritative root servers systems", to use the ICANN awful 
slang. And then a Windows resolver using the root authoritatively loaded 
and checked by the machine owner.

You may have noted that I only considered the ICANN root.
Jefsey

On 18:28 28/09/01, Roberto Gaetano said:
>Hi.
>I concur with Sandy's post, but would also add a comment.
>
>The most spectacular effect that the terrorist attack has created is the 
>collapse of the Twin Towers, and the most sad effect are the thousands of 
>casualties, but there is another effect that has not to be underestimated: 
>the critical situation in which the western economy has been put. I speak 
>about the impact on airline industry, the burden on insurance companies, 
>the drop in the stock market, and other things that will impact us for the 
>years to come (higher insurance premia, higher cost of travel, longer 
>boarding times, etc.).
>
>The terrorists of the new millennium might well concentrate on these kind 
>of damages, that are less likely to create horror for their acts, and 
>therefore less likely to create a consensus front against them.
>Our Net has been built and is being operated in a way that will survive 
>well nuclear attacks, but less well electronic sabotage.
>Somebody has asked in this forum what would have happened if a root server 
>would have been located in lower Manhattan (or, for this purpose, even in 
>the Twin Towers). The answer is, IMHO, "Nothing, the other 12 would have 
>been more than sufficient". In fact, the Net would have suffered under 
>(physical) attack to half a dozen of roots at the same time much less than 
>what it suffered under Kashpureff's electronic attack few years ago.
>
>I do believe that it is a responsible answer from ICANN to address these 
>issues before the terrorists find out how they can attack the DNS and 
>jeopardize its functioning, creating billions of damage to the western 
>economy. The big problem is, IMHO, that a lot of people see the DNS as a 
>milk cow, and are very little motivated to deploy secure procedures (more 
>costly and requiring higher expertise) if they see this as a risk for 
>their profits. Therefore the only way to progress on this is to include 
>security requirements in the contracts ICANN has with the different 
>parties (Registries and accredited Registrars).
>
>I am saddened by the delay that this may have on other issues, on which I 
>am contributing and I would see progressing (like the AtLarge), but I am 
>also looking forward to see an open debate on security, as a vital subject 
>for the survival of the Net as we know it today.
>
>Regards
>Roberto
>(Sandy's excellent post cut for bandwidth)
>
>
>
>_________________________________________________________________
>Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
>
>--
>This message was passed to you via the [email-masked] list.
>Send mail to [email-masked] to unsubscribe
>("unsubscribe ga" in the body of the message).
>Archives at http://www.dnso.org/archives.html

- --=====================_19179980==_.ALT
Content-Type: text/html; charset="us-ascii"

<html>
Dear Roberto,<br>
I agree that we now have to think seriously to a name space management
strategy (you may remember I have been quite rebuked when I proposed
again and again to consider the matter globally and not only through what
no one really knows what the others call an &quot;alt root&quot;).<br>
<br>
The whole security strategy stays the same question over techniques and
centuries. Is concentration better to resist and get protected together
at the risk of losing everything in case of short defeat, or is
dispersion the only way to minimize the global casualty toll, offer the
best resilience and never be fully defeated. Cornwallis vs. Insurgents.
British vs. IRA. John vs. Robin Hood. Chinese last Emperor vs. Mao. US
vs. Viet-Cong. etc... I will not dispute that.<br>
<br>
But everyone agree that the topography of the battle field is of the
essence.<br>
<br>
So the first thing is to make sure we do not use wide continuous plains
strategy while the Internet topography is far more than distributed (like
hills and valleys) and is a myriad of interconnects (like islands). I are
to be more Mc Arthur than&nbsp; Eisenhower. I priority is to keep our
lines open and avoid contamination. More British a strategy than
French.<br>
<br>
Bind and co make a good system. But the way we use it is costly and non
protected. To keep with the WWII image, improving the DNS protection is
good, but it like adding new destroyers to convoys: this actually
enlarges the target. What is better is to improve the strategy to
increase the defence capacity of the islands while reducing the number
and the dependance from the convoys.&nbsp; <br>
<br>
We use the DNS today as if we were calling the operator every time we
want to place a phone call: like 70 years ago. So part of a response can
be to concentrate all the operators in a strong hold (but what if they
blow the strong hold?) Another way is to give everyone a phone book.
<br>
<br>
Do you know how many times a year (or a decade) the root changes?&nbsp;
And how many times it changes enough for calls not to get through? Look
at the IANA/DoC procedure and the delay to get an IP address updated (ask
Pitcairn). Nearly one year to get .info and .biz. .pro and other are
still pending. <br>
<br>
I do hope you update your anti-virus files more often than they update
the root! <br>
<br>
The root is available on line via
<a href="ftp://rs.internic.net/domain/root.zone.gz" eudora="autourl"><font color="#0000FF"><u>ftp://rs.internic.net/domain/root.zone.gz</a><br>
</u></font>It is a 14,655 Bytes file today. To manage the Internet
Michelle from the IANA is enough, and she may even take vacations. The
rest is pure job/fee protection.<br>
<br>
Our true protection is to get a root copy an to use it with our local
resolver. Bill Gates thinks that the Microsoft strategy is not there? OK,
until Windows gets shareware alternative resolvers good souls will keep
helping in providing root mirrors. ccTLDs will eventually agree root
delivery is part of their duties to their ISP and good business
protection. I suppose the GAC will require them soon, probably in MdR. In
the meanwhile you can use my root servers..<br>
<br>
Obviously this shows that the main security battle is against ICANN and
Microsoft. Let help them correct that and let have an ICANN sponsored
&quot;alternative authoritative root servers systems&quot;, to use the
ICANN awful slang. And then a Windows resolver using the root
authoritatively loaded and checked by the machine owner.<br>
<br>
You may have noted that I only considered the ICANN root. <br>
Jefsey<br>
<br>
<br>
On 18:28 28/09/01, Roberto Gaetano said:<br>
<blockquote type=cite class=cite cite>Hi.<br>
I concur with Sandy's post, but would also add a comment.<br>
<br>
The most spectacular effect that the terrorist attack has created is the
collapse of the Twin Towers, and the most sad effect are the thousands of
casualties, but there is another effect that has not to be
underestimated: the critical situation in which the western economy has
been put. I speak about the impact on airline industry, the burden on
insurance companies, the drop in the stock market, and other things that
will impact us for the years to come (higher insurance premia, higher
cost of travel, longer boarding times, etc.).<br>
<br>
The terrorists of the new millennium might well concentrate on these kind
of damages, that are less likely to create horror for their acts, and
therefore less likely to create a consensus front against them.<br>
Our Net has been built and is being operated in a way that will survive
well nuclear attacks, but less well electronic sabotage.<br>
Somebody has asked in this forum what would have happened if a root
server would have been located in lower Manhattan (or, for this purpose,
even in the Twin Towers). The answer is, IMHO, &quot;Nothing, the other
12 would have been more than sufficient&quot;. In fact, the Net would
have suffered under (physical) attack to half a dozen of roots at the
same time much less than what it suffered under Kashpureff's electronic
attack few years ago.<br>
<br>
I do believe that it is a responsible answer from ICANN to address these
issues before the terrorists find out how they can attack the DNS and
jeopardize its functioning, creating billions of damage to the western
economy. The big problem is, IMHO, that a lot of people see the DNS as a
milk cow, and are very little motivated to deploy secure procedures (more
costly and requiring higher expertise) if they see this as a risk for
their profits. Therefore the only way to progress on this is to include
security requirements in the contracts ICANN has with the different
parties (Registries and accredited Registrars).<br>
<br>
I am saddened by the delay that this may have on other issues, on which I
am contributing and I would see progressing (like the AtLarge), but I am
also looking forward to see an open debate on security, as a vital
subject for the survival of the Net as we know it today.<br>
<br>
Regards<br>
Roberto<br>
(Sandy's excellent post cut for bandwidth)<br>
<br>
<br>
<br>
_________________________________________________________________<br>
Get your FREE download of MSN Explorer at
<a href="http://explorer.msn.com/intl.asp" eudora="autourl">http://explorer.msn.com/intl.asp</a><br>
<br>
- --<br>
This message was passed to you via the [email-masked] list.<br>
Send mail to [email-masked] to unsubscribe<br>
(&quot;unsubscribe ga&quot; in the body of the message).<br>
Archives at
<a href="http://www.dnso.org/archives.html" eudora="autourl">http://www.dnso.org/archives.html</a></blockquote></html>

- --=====================_19179980==_.ALT--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 03:10:05 -0700 (PDT)
From: Rick H Wesson <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Ross,

As one who sat on the ICANN Escrow committee I can state that the
committee did create a final draft that specified escrow formats and how
escrow would be done. The document was forwarded to ICANN and I have no
clue why they didn't implement it. All ICANN need to do is publish their
requirements on escrow, and start up their service, which they have had
over 9 months to complete.

Also if a registrar was to be "taken out," some service certainly would be
disrupted but we would deal, I'm sure VGRS, as the other registries have
too, a well defined disaster recovery plan. I believe such was required in
their Registry proposal.

Do you know each root server does not answer queries for at lease two
hours twice a day? I am sure the impact of an outage would be less than
what the financial industry felt when the WTC towers were demolished. I
also suggest you read up on what happens when a backhoe severs a
fiber, they happen all the time, some huge ones that will cut out large
chunks of the net and one rarely hears about it.

finally I wish we could focus on the real ICANN issues instead of this FUD.
Using fear to create an environment where our attention is directed away
from what our attention should be focused on only makes me wonder why we
shouldn't be discussing the issues that ICANN is more equipped to discuss.

I feel like ICANN does not want to deal with its important naming issues
in the US, as there will be no meetings in the USA next year. I also feel
ICANN, its staff, and the constituencies are illequiped to discuss
security or stability with over 78% of .COM zones misconfigured [1]

ICANN just doesn't draw the folks that work on the issues of stability and
security, so I can's see any value coming out of a meeting dedicated in
its entirety to discussing such.

As for topics we can wrap our arms around, now would be an excellent time
to enumerate just what "security and stability of the naming and
addressing systems and of their operational implementation globally"  [2]
means, because this just sounds like FUD to me.

to me 'security and stability of the naming system' means DNSSEC and
'security and stability of the addressing systems' means IPSEC and IPv6
and '... of their operational implementation globally' leads me to think
about coordination.  I just can't fathom how what is usually a marketing
and personal networking oppertunity can be billed as anything close to a
NDSS [3] confrence.

- -rick

[1] http://www.miceandmen.com/6000/61_recent_survey.html
[2] http://www.icann.org/announcements/announcement-26sep01.htm
    5th paragraph.
[3] http://www.isoc.org/isoc/conferences/ndss/02/index.shtml

On Fri, 28 Sep 2001, Ross Wm. Rader wrote:

> > I have no argument with the concepts. I just think the ICANN board meeting
> is
> > simply an inappropriate forum to discuss the issues.  I would think IETF
> risks
> > being a waaaaaaay better place. The net has existed for years with its
> 'dirty
> > little secrets' surving on the basis that those with sufficient knowledge
> could
> > do damage in one way or another (like kashpuref did) but chose not to out
> of
> > some form or reverence or spirit of cooperation.
>
> Dan,
>
> Did you know that if NSI-Registrar was put out of business in a permanent,
> WTC sense (god forbid), that there are currently no defined process for
> recreating the service records for some 16 million or so registrants? I'd
> say that fact alone makes ICANN an appropriate forum to discuss the issue.
> We might not be able to wrap our arms around a lot of topics, but the ones
> that we can are fairly important.
>
> Thanks,
>
> -rwr
>
>
>
> Tucows Inc.
> t. 416.538.5492
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
>

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 12:13:14 +0200
From: Jefsey Morfin <[email-masked]>
Subject: RE: [ga] We can't be against it?

On 03:12 29/09/01, Cade,Marilyn S - LGA said:
>hmm, so some don't consider business registrants/others
>a constituency?  We think we are represented by one of the ICANN DNSO
>constituencies. And the non commercial registrants are engaged through the
>N-C Constituency.
>
>...and that security and data escrow are a priority, and should become even
>more so.

Sure, domain name protection is of the essence.

But is the escrow of bugged systems and tables the only system to protect 
us. I doubt it. Let be clear: would NSI be blown up, burnt or flooded, what 
would you make with the 24,000,000 DN data they have or not in a vault? You 
would need their system to be rebuilt in the same way, in the very hour.
- - millions of DN on hold? It would be worst that starting it anew? It would 
be thousands USRPs...
- - do you know that to register a name server IP you have to send a fax 
(anyone can fake) and wait for a week? Rebuilding the NSI Sytem would asj 
for months. As Roberto explained it, it would never happen as NSI or the 
world would have gone down before.

The best escrow is a title you can hold and show and a smart card you can 
use on every registry system. May be large businesses with legal staff and 
business enough may accept other solutions. May be individual or NonCom may 
accept temporary patches or loss of access. SMEs cannot: our live depends 
more an more on a tiny something undefined, not protected, not... this not 
... that, costing $9. Makes the life of our entreprises worth less than a 
pizza. This is not serious.

Jefsey

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 14:41:04 +0200 (CEST)
From: Marc Schneiders <[email-masked]>
Subject: Registration data backup? (RE: [ga] We can't be against it?)

Jefsey

Are you *sure* there is no decent backup system in place at NSI? I
have no idea, but would be surprised if not.

- -- 
[email-masked]

On Sat, 29 Sep 2001, at 12:13 [=GMT+0200], Jefsey Morfin wrote:

> On 03:12 29/09/01, Cade,Marilyn S - LGA said:
> >hmm, so some don't consider business registrants/others
> >a constituency?  We think we are represented by one of the ICANN DNSO
> >constituencies. And the non commercial registrants are engaged through the
> >N-C Constituency.
> >
> >...and that security and data escrow are a priority, and should become even
> >more so.
> 
> Sure, domain name protection is of the essence.
> 
> But is the escrow of bugged systems and tables the only system to protect 
> us. I doubt it. Let be clear: would NSI be blown up, burnt or flooded, what 
> would you make with the 24,000,000 DN data they have or not in a vault? You 
> would need their system to be rebuilt in the same way, in the very hour.
> - millions of DN on hold? It would be worst that starting it anew? It would 
> be thousands USRPs...
> - do you know that to register a name server IP you have to send a fax 
> (anyone can fake) and wait for a week? Rebuilding the NSI Sytem would asj 
> for months. As Roberto explained it, it would never happen as NSI or the 
> world would have gone down before.
> 
> The best escrow is a title you can hold and show and a smart card you can 
> use on every registry system. May be large businesses with legal staff and 
> business enough may accept other solutions. May be individual or NonCom may 
> accept temporary patches or loss of access. SMEs cannot: our live depends 
> more an more on a tiny something undefined, not protected, not... this not 
> ... that, costing $9. Makes the life of our entreprises worth less than a 
> pizza. This is not serious.
> 
> Jefsey
> 
> 
> 
> 
> 
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sun, 30 Sep 2001 00:39:36 +1200
From: Joop Teernstra <[email-masked]>
Subject: Re: [ga] DNSO Review Task Force

At 11:07 29/09/01 +1200, DPF wrote:

Thanks David, for the call for Action. And thanks , Roberto, for providing 
the path.
May I again implore our Chair to chair this constructive work  and assist 
in keeping the growth of this document focused?

> >
> >1. Need
> >1.1 What need would the proposed new constituency fill?

The need for representation of Individual Domain Name Holders, a unique 
segment of DNS stakeholders that generally lacks the resources to work for 
the security of their Domain Names individually.

> >1.2 What would the proposed new constituency bring to the DNSO that is now
> >lacking?
> >

A better balance between constituencies of Domain Name Suppliers' 
representatives and Domain Name Registrant representatives.

> >2. Common interest
> >2.1 What commonality of interest would the members of the proposed new
> >constituency share?
> >

The personal concern of  an Individual Domain Name Holder for 
his/her  Domain Name.
This is distinct from the bond between a corporation or a non-commercial 
organization and their Domain Name.

> >3. Distinction
> >3.1 How much overlap in membership is there likely to be between the
> >proposed new constituency and existing constituencies,

Since the other constituencies do not accept Individual Membership, there 
is no overlap.
However, any of the other constituencies can  and will send their 
representatives into the new Individuals' Constituency in an effort to 
dominate it.
Therefore some safeguard must be drawn up to make sure that the new 
constituency really speaks for the typical interests of Individuals.

>  the General Assembly

Many of the future members of the Individuals' Constituency are now 
gathered in the General Assembly, proving their strong interest in the 
ICANN processes.

> >and other parts of ICANN?
> >

There is no current representation of Individual Domain Name Holders 
elsewhere in the ICANN structure.

> >4. Representation
> >4.1 How representative of the stated common interest would the proposed new
> >constituency be?

Only a geniune democratic structure and a large number of geniune members 
can guarantee that. If the representatives do not work for the shared 
common interest, they are not (re)elected.

> >4.2 What steps have the petitioners taken to establish a hierarchy of
> >representativeness and openness within the proposed new constituency?
> >

They have created a Charter with an elected Executive Committee and other 
elective positions.
They have a website where the process of nominations and elections is 
detailed.

> >5. Alternatives
> >5.1 Are there alternative means of fulfilling the stated need besides
> >recognition of a new constituency?
> >5.2 Are there other places within the ICANN structure where this need could
> >be fulfilled?
> >
> >6. Organisation on a global scale
> >6.1 What steps have the proponents of the proposed new constituency 
> taken to
> >organise the proposed new constituency?
> >6.2 Has the proposed new constituency demonstrated the capability to 
> command
> >the financial and human resources required by a constituency?
> >
> >7. Support within the DNSO
> >7.1 What steps have the proponents of the proposed new constituency 
> taken to
> >seek support from existing constituencies?
> >
> >8. Impact assessment
> >8.1 What would be the impact of the proposed new constituency on existing
> >constituencies?
> >8.2 What would be the impact of the proposed new constituency on the
> >finances and administration of the DNSO?
> >8.3 What would be the impact of the proposed new constituency on policy
> >formation within the DNSO?
>
>--

It is past midnight here. This is just for starters and needs further 
fleshing out, of course.
I gladly give others the opportunity to jump some of the other hurdles.

- --Joop

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 10:13:33 -0400
From: "L Gallegos" <[email-masked]>
Subject: Re: Registration data backup? (RE: [ga] We can't be against it?)

Data escrow is not simply a good back up.  It is a third party 
location to ensure safety and availability in case of disaster.  It is a 
matter of contract.  Whether this is being done or not is the 
question and it is something that ICANN should ensure under its 
contract enforcement for .com/net/org, IMO.

Leah

On 29 Sep 2001, at 14:41, Marc Schneiders wrote:

> Jefsey
> 
> Are you *sure* there is no decent backup system in place at NSI? I
> have no idea, but would be surprised if not.
> 
> -- 
> [email-masked]
> 
> 
> On Sat, 29 Sep 2001, at 12:13 [=GMT+0200], Jefsey Morfin wrote:
> 
> > On 03:12 29/09/01, Cade,Marilyn S - LGA said:
> > >hmm, so some don't consider business registrants/others
> > >a constituency?  We think we are represented by one of the ICANN
> > >DNSO constituencies. And the non commercial registrants are engaged
> > >through the N-C Constituency.
> > >
> > >...and that security and data escrow are a priority, and should
> > >become even more so.
> > 
> > Sure, domain name protection is of the essence.
> > 
> > But is the escrow of bugged systems and tables the only system to
> > protect us. I doubt it. Let be clear: would NSI be blown up, burnt
> > or flooded, what would you make with the 24,000,000 DN data they
> > have or not in a vault? You would need their system to be rebuilt in
> > the same way, in the very hour. - millions of DN on hold? It would
> > be worst that starting it anew? It would be thousands USRPs... - do
> > you know that to register a name server IP you have to send a fax
> > (anyone can fake) and wait for a week? Rebuilding the NSI Sytem
> > would asj for months. As Roberto explained it, it would never happen
> > as NSI or the world would have gone down before.
> > 
> > The best escrow is a title you can hold and show and a smart card
> > you can use on every registry system. May be large businesses with
> > legal staff and business enough may accept other solutions. May be
> > individual or NonCom may accept temporary patches or loss of access.
> > SMEs cannot: our live depends more an more on a tiny something
> > undefined, not protected, not... this not ... that, costing $9.
> > Makes the life of our entreprises worth less than a pizza. This is
> > not serious.
> > 
> > Jefsey
> > 
> > 
> > 
> > 
> > 
> > 
> > --
> > This message was passed to you via the [email-masked] list.
> > Send mail to [email-masked] to unsubscribe
> > ("unsubscribe ga" in the body of the message).
> > Archives at http://www.dnso.org/archives.html
> > 
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga-full" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 07:42:15 -0700
From: Kent Crispin <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

On Sat, Sep 29, 2001 at 03:10:05AM -0700, Rick H Wesson wrote:
> 
> Ross,
> 
> As one who sat on the ICANN Escrow committee I can state that the
> committee did create a final draft that specified escrow formats and how
> escrow would be done. The document was forwarded to ICANN and I have no
> clue why they didn't implement it.

Because they have to spend lots of time and money on other things, and 
time and money are in short supply.

> All ICANN need to do is publish their
> requirements on escrow, and start up their service, which they have had
> over 9 months to complete.

There have been other things with what were thought to be higher
priority going on, such as new TLDs.
> 
> Also if a registrar was to be "taken out," some service certainly would be
> disrupted but we would deal, I'm sure VGRS, as the other registries have
> too, a well defined disaster recovery plan. I believe such was required in
> their Registry proposal.

> Do you know each root server does not answer queries for at lease two
> hours twice a day? I am sure the impact of an outage would be less than
> what the financial industry felt when the WTC towers were demolished. I
> also suggest you read up on what happens when a backhoe severs a
> fiber, they happen all the time, some huge ones that will cut out large
> chunks of the net and one rarely hears about it.

I suggest that you are missing the point entirely.  It's not dns that is
the issue, it is registrant data.  If opensrs were taken out in a
WTC-type incident, the fact that ar.com was registered to you would be
lost, and you would have to go through some process to prove that it had
been registered to you, instead of one of the flock of cybervultures
that would instantly materialize.  If NSI registrAR were taken out the
ownership of every single domain they had registered would be unknown;
there would be no way to verify any domain modifications; no way to know
who the contacts were.  The effects wouldn't be immediate, but they
would be enormous. 

[...]

> to me 'security and stability of the naming system' means DNSSEC and
> 'security and stability of the addressing systems' means IPSEC and IPv6

There is more to it than that.

- -- 
Kent Crispin                               "Be good, and you will be
[email-masked]                           lonesome." -- Mark Twain
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 11:30:20 -0400 (EDT)
From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Is this ICANN escrow committee document on line please?  URL?

I agree, by the way, that the vagueness of ICANN's announcement is very
insulting.  It gives us nothing to work with, and no way to tell if there
is something there, or this is a hijack to prevent the critical mass of
opposition from attending LA, as the Annual Meeting (and US location) are
most likely to draw people not on expense accounts.

On Sat, 29 Sep 2001, Rick H Wesson wrote:

> 
> Ross,
> 
> As one who sat on the ICANN Escrow committee I can state that the
> committee did create a final draft that specified escrow formats and how
> escrow would be done. The document was forwarded to ICANN and I have no
> clue why they didn't implement it. All ICANN need to do is publish their
> requirements on escrow, and start up their service, which they have had
> over 9 months to complete.
> 
> Also if a registrar was to be "taken out," some service certainly would be
> disrupted but we would deal, I'm sure VGRS, as the other registries have
> too, a well defined disaster recovery plan. I believe such was required in
> their Registry proposal.
> 
> Do you know each root server does not answer queries for at lease two
> hours twice a day? I am sure the impact of an outage would be less than
> what the financial industry felt when the WTC towers were demolished. I
> also suggest you read up on what happens when a backhoe severs a
> fiber, they happen all the time, some huge ones that will cut out large
> chunks of the net and one rarely hears about it.
> 
> finally I wish we could focus on the real ICANN issues instead of this FUD.
> Using fear to create an environment where our attention is directed away
> from what our attention should be focused on only makes me wonder why we
> shouldn't be discussing the issues that ICANN is more equipped to discuss.
> 
> I feel like ICANN does not want to deal with its important naming issues
> in the US, as there will be no meetings in the USA next year. I also feel
> ICANN, its staff, and the constituencies are illequiped to discuss
> security or stability with over 78% of .COM zones misconfigured [1]
> 
> ICANN just doesn't draw the folks that work on the issues of stability and
> security, so I can's see any value coming out of a meeting dedicated in
> its entirety to discussing such.
> 
> As for topics we can wrap our arms around, now would be an excellent time
> to enumerate just what "security and stability of the naming and
> addressing systems and of their operational implementation globally"  [2]
> means, because this just sounds like FUD to me.
> 
> to me 'security and stability of the naming system' means DNSSEC and
> 'security and stability of the addressing systems' means IPSEC and IPv6
> and '... of their operational implementation globally' leads me to think
> about coordination.  I just can't fathom how what is usually a marketing
> and personal networking oppertunity can be billed as anything close to a
> NDSS [3] confrence.
> 
> -rick
> 
> 
> [1] http://www.miceandmen.com/6000/61_recent_survey.html
> [2] http://www.icann.org/announcements/announcement-26sep01.htm
>     5th paragraph.
> [3] http://www.isoc.org/isoc/conferences/ndss/02/index.shtml
> 
> 
> On Fri, 28 Sep 2001, Ross Wm. Rader wrote:
> 
> > > I have no argument with the concepts. I just think the ICANN board meeting
> > is
> > > simply an inappropriate forum to discuss the issues.  I would think IETF
> > risks
> > > being a waaaaaaay better place. The net has existed for years with its
> > 'dirty
> > > little secrets' surving on the basis that those with sufficient knowledge
> > could
> > > do damage in one way or another (like kashpuref did) but chose not to out
> > of
> > > some form or reverence or spirit of cooperation.
> >
> > Dan,
> >
> > Did you know that if NSI-Registrar was put out of business in a permanent,
> > WTC sense (god forbid), that there are currently no defined process for
> > recreating the service records for some 16 million or so registrants? I'd
> > say that fact alone makes ICANN an appropriate forum to discuss the issue.
> > We might not be able to wrap our arms around a lot of topics, but the ones
> > that we can are fairly important.
> >
> > Thanks,
> >
> > -rwr
> >
> >
> >
> > Tucows Inc.
> > t. 416.538.5492
> >
> > --
> > This message was passed to you via the [email-masked] list.
> > Send mail to [email-masked] to unsubscribe
> > ("unsubscribe ga" in the body of the message).
> > Archives at http://www.dnso.org/archives.html
> >
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga-full" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 
> 

- -- 
		Please visit http://www.icannwatch.org
A. Michael Froomkin   |    Professor of Law    |   [email-masked]
U. Miami School of Law, P.O. Box 248087, Coral Gables, FL 33124 USA
+1 (305) 284-4285  |  +1 (305) 284-6506 (fax)  |  http://www.law.tm
                 -->It's very hot and humid here.<--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 08:59:40 -0700 (PDT)
From: Rick H Wesson <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Kent,

On Sat, 29 Sep 2001, Kent Crispin wrote:

> I suggest that you are missing the point entirely.  It's not dns that is
> the issue, it is registrant data.  If opensrs were taken out in a

all registrars are required to keep off site backup and it is a simple
thing for a registrar to do. Devoting an entire ICANN meeting to decide if
registrars are keeping their backups is foolish.

If ICANN wishes to implement its escrow policy it has a framework to do
so.

- -rick

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 12:43:57 EDT
From: [email-masked]
Subject: [ga] November 12

Dear Diane,

In the letter that Stuart posted to the Council (cited below), he indicates 
that there is no reason that November 12 cannot still be made available to 
those constituencies ,SO's and other ICANN
committees or task forces that want to hold meetings to consider other 
pressing items on their agendas.

Please consider this a formal request from the GA to convene a six-hour 
session on Nov. 12.

Best regards,
Danny Younger

> Dear colleagues:
>
> As you know, ICANN announced two days ago that the annual ICANN
> meeting would indeed occur on November 13-15 inclusive, and that the
> meeting would focus on security and stability of the Internet's
> naming and addressing systems.
>
> The original meeting, of course, was scheduled to start on November
> 12, not November 13. There is no reason that November 12 cannot still
> be made available to those constituencies ,SO's and other ICANN
> committees or task forces that want to hold meetings to consider
> other pressing items on their agendas. Apart from these agenda items,
> such meetings might also be useful for shaping input on any items
> that are on the Board agenda. You may recall from the announcement
> that the Board may decide to take up items where "time is of the
> essence".
>
> Making use of November 12 for these or other purposes would help to
> ensure that we can all focus on the core security agenda the
> following three days. Once the details of this core agenda are firmed
> up, constituencies and SO's may also want to use the November 12
> opportunity for advance consideration of the "security agenda". There
> will, however, be times set aside during the three days of the
> security focus for constituency and other meetings to address
> specific security considerations.
>
> Any constituency, SO or other ICANN committee or task force wishing
> to hold a meeting on November 12 should advise Dianne Schroeder so
> that she can work with the unit involved to schedule meeting space.
>
> Stuart
> --
>
> __________________
> Stuart Lynn
> President and CEO
> ICANN
> 4676 Admiralty Way, Suite 330
> Marina del Rey, CA 90292
> Tel: 310-823-9358
> Fax: 310-823-8649
> Email: [email-masked]

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #763
************************