Subject: GA-DIGEST V1 #765
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST          Sunday, September 30 2001          Volume 01 : Number 765

----------------------------------------------------------------------

Date: Sat, 29 Sep 2001 15:11:54 -0400
From: Sandy Harris <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Roeland Meyer wrote:

> |> Currently, DNS is almost completely insecure. All the
> |> servers just accept whatever another server tells them as gospel.
> 
> Excuse me. After all that good work, I must object to this. The current
> system is actually quite good and it's all IP-based, not by name. Iff you
> build to run a RFC2870 compliant server,

That is a "best current practises" RFC titled "Root Name Server Operational
Requirements".

> which all zone server operators should at least consider.

So you seem to be saying anyone with primary responsibility for any zone
should adhere to the high standards documented for root servers. I agree,
at least in most cases. (I cannot think of any exceptions, but am not
certain there are none.)

Does ICANN have a role here? 

Do the current Verisign contracts for root server management require that
they adhere to 2870? How is their compliance audited?

What about servers for the TLDs, rather than the root itself? Certainly
security on them is a concern. Should ICANN require RFC 2870 compliance
there? What are the contractual and auditing mechanisms for that? Are
they different for different types of TLD?

Are there security requirements that need to be enforced for registrars?
Could an attacker with sufficient resources set up a bogus registrar, or
subvert a legitimate one. and use its privileges to slip bad data into 
root servers?

> You primary zone servers become non-recursive vaults.
> You should have at least ...
> Your DNS resolvers should be ...
> Updates should only be allowed from ...
> TCP Wrappers should protect ALL systems ...
> Do not take zone updates except ...
> do not allow zone transfers, except ...
> Only use BIND, under *nix, ... 

All good stuff. We agree that these things should be done for at least
most authoritative zone servers.

The question is whether ICANN needs to take steps to ensure that these
are actually done. This is a question of policies and contracts. We
know the technology exists and should be applied, but there may be
work to do getting it applied. 
 
> Now, as to the threat of sniffing, ...
> 
> In order to intercept queries,or any other packets, one must ...
> ... This is a classic man-in-the-middle attack scenario. It is
> amazingly difficult to do.

Yes, but it has been done. Remember the folks who redirected internic.net?

Also note that some of the potential attackers have considerable resources.
One news story I saw estimated bin Laden's personal fortune at $300 million.
Most national gov'ts could bring resources far beyond that to bear if they
decided trashing some other nation's net.infrastructure was a good move.  

> I'm sorry, but it has been standard practice, at MHSC, to outfit an
> ecommerce site with ... Anything less, begs for trouble.

No question, this can be got right, many companies do it well, and some
security consultants offer good services in these areas. 

However, to the extent that ICANN is responsible for the stability of
the DNS, there are still questions worth asking. 
 
> ... Those who don't do this, or something like it, will feel (have felt)
> the Darwin-Effect.

How do we ensure that no such failure will trash critcal infrastructure
that ICANN is responsible for?
 
> ... Personally, I feel that every packet should use strong encryption
> and every session should use reasonably strong authentication.

I agree. I would see DNSsec as an important step toward that.

> Many of us have just about given up on the IETF producing anything useful
> and non-political these days. Short-sighted geeks clash with business
> requirements (and often disregard the latter).

Yes, and business folk sometimes disregard technical issues or introduce
unfortunate biases.

> Besides, running DNS, inside of a VPN, obliviates the need for DNSSEC.

Only partly. Securing the communication and authenticating the partner
is a different thing than authenticating the data you get.

> |> However, methinks ICANN might have a role to play in ensuring that
> |> the registrars actually act on this in a timely fashion, and that
> |> Verisign or others do not attempt to hijack the process into becoming
> |> a marketing scheme for proprietary signature technologies.
> 
> Yes, that is my fear as well. But, I run a CA too<g>.

Methinks this is an issue worth raising in Marina Del Rey.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 15:33:33 EDT
From: [email-masked]
Subject: [ga] Review Task Force report

David,

Almost every single criteria put forth in the Review Task Force document is 
nothing more than Phil Sheppard's re-phrasing of the comments put forth by 
Axel aus der Muhlen on the Review list on 16 Aug.  
http://www.dnso.org/clubpublic/nc-review/Arc01/ 

Those recommendations were criticized not only by Roberto, our Task Force 
representative, but by Milton Mueller who wrote:

I find this list of criteria to be extremely objectionable. The need for an 
individuals' constituency has already been recognized several times over. 
Question 1 has already been answered.  This is just a way for existing 
constituencies to preserve their unjust political advantages by setting up 
huge hurdles for recognition that none of the existing constituencies had to 
face.  If these criteria were applied to existing DNSO constituencies, we 
would immediately be forced to withdraw recognition of the ISP, registrar, 
registry non-commercial and possibly other constituencies.  The ISP, B&C, and 
Trademark constituencies all have tremendous overlap in terms of (potential) 
membership.   All ISPs, registrars, and registries are "businesses."  All the 
members of the trademark constituency are business associations. All ccTLDs 
are registries.  There is now tremendous overlap between the composition
of the registrar constituency and the gTLD constituency, in that all of the 
dominant gTLD delegees - Verisign, Register.com, Melbourne IT, Tucows - are 
or soon will be registry operators.  Many registrars who are not now registry 
operators have applied to be one and may become one in the future.  NC will 
really lose a lot of credibility by reneging on its commitment to recognize 
an individuals
constituency.  http://www.dnso.org/clubpublic/nc-review/Arc01/msg00008.html

Philip ignored these criticisms and the appended his own additional criteria 
to Axel's list:

5.1 Are there alternative means of fulfilling the stated need besides 
recognition of a new constituency? 
5.2 Are there other places within the ICANN structure where this need could 
be fulfilled? 
7.1 What steps have the proponents of the proposed new constituency taken to 
seek support from existing constituencies?

These additional criteria are designed to deny Individual Domain Name holders 
the opportunity to establish a constituency.  

There is no "Task Force".  There is only a slick effort on the part of Phil 
Sheppard to deny you your rights.  If you choose to remain complacent about 
it, that is your prerogative.  I, for one, intend to raise my voice.  

Consider some of their other conclusions:  DNSO working groups as currently 
formed are by construction not a representative sample of DNSO stakeholders 
because they are open to 
participation by anyone who chooses. It is possible but improbable that such 
a group will at any moment in time be so representative. This suggests that 
discussing consensus in such groups is unlikely to be productive and that the 
guidance given to the NC will be poor.  The Names Council is constructed to 
represent DNSO stakeholder interests and, notwithstanding demands by 
individuals to participate, is the best structure we currently have to be 
representative. 

In short, only the Council is a representative body and only Council task 
forces can determine consensus -- this is garbage and an insult to the 
General Assembly.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 12:41:36 -0700 (PDT)
From: Rick H Wesson <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Sandy,

If registrars could effect the functionality of zones under .COM then I
might expect them to do some of the things you enumerate below. the
problem is that 78% of all .COM delegations are in some way misconfigured.

I don't understand why a resources mostly utilized for speculative
purposes should become secured, and if most domains are screwed up in some
way what makes you think the resonsible party for the domain is competent
to implement any of your suggested security features?

- -rick

On Sat, 29 Sep 2001, Sandy Harris wrote:

> Roeland Meyer wrote:
>
> > |> Currently, DNS is almost completely insecure. All the
> > |> servers just accept whatever another server tells them as gospel.
> >
> > Excuse me. After all that good work, I must object to this. The current
> > system is actually quite good and it's all IP-based, not by name. Iff you
> > build to run a RFC2870 compliant server,
>
> That is a "best current practises" RFC titled "Root Name Server Operational
> Requirements".
>
> > which all zone server operators should at least consider.
>
> So you seem to be saying anyone with primary responsibility for any zone
> should adhere to the high standards documented for root servers. I agree,
> at least in most cases. (I cannot think of any exceptions, but am not
> certain there are none.)
>
> Does ICANN have a role here?
>
> Do the current Verisign contracts for root server management require that
> they adhere to 2870? How is their compliance audited?
>
> What about servers for the TLDs, rather than the root itself? Certainly
> security on them is a concern. Should ICANN require RFC 2870 compliance
> there? What are the contractual and auditing mechanisms for that? Are
> they different for different types of TLD?
>
> Are there security requirements that need to be enforced for registrars?
> Could an attacker with sufficient resources set up a bogus registrar, or
> subvert a legitimate one. and use its privileges to slip bad data into
> root servers?
>
> > You primary zone servers become non-recursive vaults.
> > You should have at least ...
> > Your DNS resolvers should be ...
> > Updates should only be allowed from ...
> > TCP Wrappers should protect ALL systems ...
> > Do not take zone updates except ...
> > do not allow zone transfers, except ...
> > Only use BIND, under *nix, ...
>
> All good stuff. We agree that these things should be done for at least
> most authoritative zone servers.
>
> The question is whether ICANN needs to take steps to ensure that these
> are actually done. This is a question of policies and contracts. We
> know the technology exists and should be applied, but there may be
> work to do getting it applied.
>
> > Now, as to the threat of sniffing, ...
> >
> > In order to intercept queries,or any other packets, one must ...
> > ... This is a classic man-in-the-middle attack scenario. It is
> > amazingly difficult to do.
>
> Yes, but it has been done. Remember the folks who redirected internic.net?
>
> Also note that some of the potential attackers have considerable resources.
> One news story I saw estimated bin Laden's personal fortune at $300 million.
> Most national gov'ts could bring resources far beyond that to bear if they
> decided trashing some other nation's net.infrastructure was a good move.
>
> > I'm sorry, but it has been standard practice, at MHSC, to outfit an
> > ecommerce site with ... Anything less, begs for trouble.
>
> No question, this can be got right, many companies do it well, and some
> security consultants offer good services in these areas.
>
> However, to the extent that ICANN is responsible for the stability of
> the DNS, there are still questions worth asking.
>
> > ... Those who don't do this, or something like it, will feel (have felt)
> > the Darwin-Effect.
>
> How do we ensure that no such failure will trash critcal infrastructure
> that ICANN is responsible for?
>
> > ... Personally, I feel that every packet should use strong encryption
> > and every session should use reasonably strong authentication.
>
> I agree. I would see DNSsec as an important step toward that.
>
> > Many of us have just about given up on the IETF producing anything useful
> > and non-political these days. Short-sighted geeks clash with business
> > requirements (and often disregard the latter).
>
> Yes, and business folk sometimes disregard technical issues or introduce
> unfortunate biases.
>
> > Besides, running DNS, inside of a VPN, obliviates the need for DNSSEC.
>
> Only partly. Securing the communication and authenticating the partner
> is a different thing than authenticating the data you get.
>
> > |> However, methinks ICANN might have a role to play in ensuring that
> > |> the registrars actually act on this in a timely fashion, and that
> > |> Verisign or others do not attempt to hijack the process into becoming
> > |> a marketing scheme for proprietary signature technologies.
> >
> > Yes, that is my fear as well. But, I run a CA too<g>.
>
> Methinks this is an issue worth raising in Marina Del Rey.
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
>

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 12:58:47 -0700 (PDT)
From: Rick H Wesson <[email-masked]>
Subject: Re: [ga] Re: "political advantage"

Sandy,

On Mon, 17 Sep 2001, Sandy Harris wrote:

> Mike Roberts wrote:
>
> > Life at ICANN isn't going to be the same either.  Given the military
> > mindset and anti-terrorist measures in Washington and other capitals,
> > there is going to be a much greater stress on operational oversight
> > of the DNS, on stability and on synchronization with related Internet
> > security steps.
>
> The obvious question there would be what steps ICANN will take to get
> secure DNS widely deployed quickly.

ouch, the IETF has been working hard on this for years, what makes you
think ICANN can do it.

> One reference site is:
> http://www.toad.com/dnssec/index.html

yea, I used to live a few blocks from Jon while he write the BSafe
implementation for DNSSEC. That information is a bit dated. do you know
how long it takes to sign the .COM zone? do you know how much memory a
gtld-server for .com, .net, and .org would have to be? Do you know the
security holes that would be created if one pushed out DNSSEC for .COM?

> A closely related, and I think important, question is how the signing
> of zones will work. Methinks there's a risk Verisign will try to tie
> the whole thing to their technology, acquire a big new market. This is
> understandable, but not a good idea.

yes, we have alot to learn. sounds like we need to hold a workshop about
DNSSEC at the ICANN meeting.

> Methinks this raises some policy issues for ICANN.

umm, I'd suggest the IETF not ICANN. Just because security is the catch
word of the day doesn't mean we are expert enought to make decisions about
any of it.

- -rick

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 16:29:30 -0400
From: Sandy Harris <[email-masked]>
Subject: Re: [ga] Re: "political advantage"

Rick H Wesson wrote:

> > The obvious question there would be what steps ICANN will take to get
> > secure DNS widely deployed quickly.
> 
> ouch, the IETF has been working hard on this for years, what makes you
> think ICANN can do it.

I don't think ICANN can do this; to a large extent it isn't their problem.

I just think it is worth asking what role, if any, ICANN should play here.
For example, should there be an ICANN key for signing root zones? Should
ICANN contracts require registrars or operators of major zone servers to
take any action on this?

> > One reference site is:
> > http://www.toad.com/dnssec/index.html
> 
> yea, I used to live a few blocks from Jon while he write the BSafe
> implementation for DNSSEC. That information is a bit dated.

Yes, but I didn't know a better site, other than the IETF WG URL which
I also included. Can you suggest one?

> do you know how long it takes to sign the .COM zone? do you know how
> much memory a gtld-server for .com, .net, and .org would have to be?

I haven't a clue, but would welcome pointers to information on this.

If there are serious issues in these areas, methinks that is another
good reason for ICANN to look at policy questions around overuse of
.com, deployment of new TLDs, etc.

> Do you know the security holes that would be created if one pushed
> out DNSSEC for .COM?

No. Would they be even worse for in-addr.arpa? An Internet Draft I'd
like to see implemented relies on that:
http://search.ietf.org/internet-drafts/draft-richardson-ipsec-opportunistic-02.txt
 
> > A closely related, and I think important, question is how the signing
> > of zones will work. Methinks there's a risk Verisign will try to tie
> > the whole thing to their technology, acquire a big new market. This is
> > understandable, but not a good idea.
> 
> yes, we have alot to learn. sounds like we need to hold a workshop about
> DNSSEC at the ICANN meeting.

Fine idea.
 
> > Methinks this raises some policy issues for ICANN.
> 
> umm, I'd suggest the IETF not ICANN.

Mostly, yes.

> Just because security is the catch word of the day doesn't mean we are
> expert enought to make decisions about any of it.

No, but if we're going to make policy, write contracts and provide
'governance' we cannot help making decisions that either have an impact
on security issues or are impacted by them.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 16:33:17 EDT
From: [email-masked]
Subject: [ga] Re:  We can't be against it?

Rick Wesson wrote:

"Marilyn, please define the context you wish to discuss security, and 
stability.  They are great words to be thrown around and I encourage real 
discussion on just what you mean by stability."

On behalf of the Business Constituency, Marilyn drafted the August 2001 
Position Paper on Alternate Roots wherein she writes:

"The BC notes that confusion between naming schemes within the DNS and roots 
operated outside of the DNS, pose a severe threat to the stability of the 
Internet and it's ability to ensure reliability and integrity in supporting 
global electronic commerce and communications.  Any threat to the stable and 
reliable resolvability with uniqueness in the naming system of the Internet 
will cause user confusion, raise new opportunities for consumer fraud, and 
cause potential harm to all users of the infrastructure worldwide.  Alternate 
roots, and mechanisms which create confusion related to the authoritative 
nature of the root with its assurance of global uniqueness, may represent 
destabilizing factors to the global uniqueness of the Internet's naming 
system."

It would be fair to ask if Marilyn is now invoking "security and stability" 
as a thinly veiled means to once more attack the alternate roots.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 16:31:12 -0400
From: Joanna Lane <[email-masked]>
Subject: Re: [ga] November 12

Dear Danny and Diane,

On a point of clarification regarding the word "agenda", I refer you to
Diane Schroeder's letter to colleagues, copied below for your convenience,
and in particular the second paragraph, in which the word "agenda" is used
three times, with at least two different meanings.

Each part of ICANN, the SOs, Task Forces, GA and so on, would be working on
a "normal agenda" for MdR had recent events not occurred. That is now being
reconsidered in the light of the Board's request for a "security agenda".
The result, certainly for the GA, will probaly be a combination of the two
agendas, whereby, "pressing issues" include some "normal agenda items" as
well as new security issues.

The Board has lead us to believe that it's time will be focused entirely on
security matters at MdR, or will it? Diane goes on to say, " You may recall
from the announcement that the Board may decide to take up items where "time
is of the essence"."

While I appreciate it's probably too early for the Board to determine
exactly how its time will be spend at MdR, the community is expressing
concern that "normal agenda" items are not treated by the Board in a way
that then forces a "time is of the essence" decision by the Board, either at
MdR or later, that would exclude community input, the ALSO being a case in
point.

In these exceptional circumstances, could the Board please clarify exactly
where it stands on dealing with "pressing issues" at MdR, meaning those that
do not fall into the category of "security", but are still considered as
being "time is of the essence"?

Regards,
Joanna

on 9/29/01 12:43 PM, [email-masked] at [email-masked] wrote:

> Dear Diane,
> 
> In the letter that Stuart posted to the Council (cited below), he indicates
> that there is no reason that November 12 cannot still be made available to
> those constituencies ,SO's and other ICANN
> committees or task forces that want to hold meetings to consider other
> pressing items on their agendas.
> 
> Please consider this a formal request from the GA to convene a six-hour
> session on Nov. 12.
> 
> Best regards,
> Danny Younger
> 
> 
> 
>> Dear colleagues:
>> 
>> As you know, ICANN announced two days ago that the annual ICANN
>> meeting would indeed occur on November 13-15 inclusive, and that the
>> meeting would focus on security and stability of the Internet's
>> naming and addressing systems.
>> 
>> The original meeting, of course, was scheduled to start on November
>> 12, not November 13. There is no reason that November 12 cannot still
>> be made available to those constituencies ,SO's and other ICANN
>> committees or task forces that want to hold meetings to consider
>> other pressing items on their agendas. Apart from these agenda items,
>> such meetings might also be useful for shaping input on any items
>> that are on the Board agenda. You may recall from the announcement
>> that the Board may decide to take up items where "time is of the
>> essence".
>> 
>> Making use of November 12 for these or other purposes would help to
>> ensure that we can all focus on the core security agenda the
>> following three days. Once the details of this core agenda are firmed
>> up, constituencies and SO's may also want to use the November 12
>> opportunity for advance consideration of the "security agenda". There
>> will, however, be times set aside during the three days of the
>> security focus for constituency and other meetings to address
>> specific security considerations.
>> 
>> Any constituency, SO or other ICANN committee or task force wishing
>> to hold a meeting on November 12 should advise Dianne Schroeder so
>> that she can work with the unit involved to schedule meeting space.
>> 
>> Stuart
>> --
>> 
>> __________________
>> Stuart Lynn
>> President and CEO
>> ICANN
>> 4676 Admiralty Way, Suite 330
>> Marina del Rey, CA 90292
>> Tel: 310-823-9358
>> Fax: 310-823-8649
>> Email: [email-masked]
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 18:02:29 -0400
From: "L Gallegos" <[email-masked]>
Subject: Re: [ga] Review Task Force report

On 29 Sep 2001, at 15:33, [email-masked] wrote:

> 
> In short, only the Council is a representative body and only Council
> task forces can determine consensus -- this is garbage and an insult
> to the General Assembly.
> 
> --

Raising your voice is okay, Danny, if only it would do any good.  
Since the NC happens to be what the board listens to and GA is 
for most purposes spitting into the wind, why is the result of the so-
called task force any more of a surprise than the change of agenda 
for the MDR meetings?  I want to know what it will take to change 
the balance of power.  So far, it looks as though those who have 
and covet more will siimply take it while the US government rubber 
stamps the coup.

Not only will the individual not have any voice in policy decisions, 
but I suspect that soon it will be illegal in the US for them to even 
have their own networks unless they conform to some ICANN 
badly stated policy/law.  How far will this go?

Leah

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sun, 30 Sep 2001 00:38:15 +0200
From: Jefsey Morfin <[email-masked]>
Subject: Re: [ga] Re:  We can't be against it?

Dear Danny,
as you know the document you quote does not represent the DNSO/BC positions 
as it has been published in violation of every DNSO/BC rules.( 
http://www.bizconst.org/bcmain.htm )..

A reconsideration procedure is pending.

But you are right the agenda is to take advantage from the 11th Sept. 
Incident to declare inclusive roots terrorists, probably @large activists 
too. The GAC will also be pushed towards a better control of the ccTLDs.

This is sad and much unprofessional. Most of the "single authoritative 
root" integrists never read a DNS file and never the less "commit" 
themselves, their county and the world to the most stupid risk out of their 
pure and only pride to know better what they ignore.  .

The MdR meetings will be quite boring (talking during three days about the 
ICANN as the single point of BS (bad security) of the Internet). Under that 
circumstances ....

Jefsey

On 22:33 29/09/01, [email-masked] said:
>Rick Wesson wrote:
>
>"Marilyn, please define the context you wish to discuss security, and
>stability.  They are great words to be thrown around and I encourage real
>discussion on just what you mean by stability."
>
>On behalf of the Business Constituency, Marilyn drafted the August 2001
>Position Paper on Alternate Roots wherein she writes:
>
>"The BC notes that confusion between naming schemes within the DNS and roots
>operated outside of the DNS, pose a severe threat to the stability of the
>Internet and it's ability to ensure reliability and integrity in supporting
>global electronic commerce and communications.  Any threat to the stable and
>reliable resolvability with uniqueness in the naming system of the Internet
>will cause user confusion, raise new opportunities for consumer fraud, and
>cause potential harm to all users of the infrastructure worldwide.  Alternate
>roots, and mechanisms which create confusion related to the authoritative
>nature of the root with its assurance of global uniqueness, may represent
>destabilizing factors to the global uniqueness of the Internet's naming
>system."
>
>It would be fair to ask if Marilyn is now invoking "security and stability"
>as a thinly veiled means to once more attack the alternate roots.
>--
>This message was passed to you via the [email-masked] list.
>Send mail to [email-masked] to unsubscribe
>("unsubscribe ga" in the body of the message).
>Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 19:35:56 -0700
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] We can't be against it?

Marilyn and all assembly members,

  Agreed here Marilyn!  Well done.  As I and many other mentioned
some 10 months ago, escrow is only one of several DNS security issues
and concerns that were discussed and put forward.  Yet it seems at the time
should you care to re-check the relative archives, that the than comprised
ICANN BOD and staff, most especially Mike Roberts, did not seem
to be overly concerned about most of those issues.  Suddenly following
the Sept.11th terrorist attack they have become more important to
Mr. Roberts (No pun intended).  SOme of the issues than discussed,
and recommendations made are the following:

  1.) Implementation or DNSSEC for all Root server's
  2.) Backup and recovery procedures for Root servers.
  3.) IPSEC implementation
  4.) Registry RRP database security ( note: this is in a deplorable state)
  5.) SRS data escrow and Dbase security implemented.

Cade,Marilyn S - LGA wrote:

> sorry, I think you  missed the mention of "security" in my post.  Data
> escrow is only a part of the issues needing priority attention in ensuring
> stability, security, and integrity in threat situations.
>
> Marilyn
> -----Original Message-----
> From: Jefsey Morfin [mailto:[email-masked]]
> Sent: Saturday, September 29, 2001 6:13 AM
> To: [email-masked]
> Subject: RE: [ga] We can't be against it?
>
> On 03:12 29/09/01, Cade,Marilyn S - LGA said:
> >hmm, so some don't consider business registrants/others
> >a constituency?  We think we are represented by one of the ICANN DNSO
> >constituencies. And the non commercial registrants are engaged through the
> >N-C Constituency.
> >
> >...and that security and data escrow are a priority, and should become even
> >more so.
>
> Sure, domain name protection is of the essence.
>
> But is the escrow of bugged systems and tables the only system to protect
> us. I doubt it. Let be clear: would NSI be blown up, burnt or flooded, what
> would you make with the 24,000,000 DN data they have or not in a vault? You
> would need their system to be rebuilt in the same way, in the very hour.
> - millions of DN on hold? It would be worst that starting it anew? It would
> be thousands USRPs...
> - do you know that to register a name server IP you have to send a fax
> (anyone can fake) and wait for a week? Rebuilding the NSI Sytem would asj
> for months. As Roberto explained it, it would never happen as NSI or the
> world would have gone down before.
>
> The best escrow is a title you can hold and show and a smart card you can
> use on every registry system. May be large businesses with legal staff and
> business enough may accept other solutions. May be individual or NonCom may
> accept temporary patches or loss of access. SMEs cannot: our live depends
> more an more on a tiny something undefined, not protected, not... this not
> ... that, costing $9. Makes the life of our entreprises worth less than a
> pizza. This is not serious.
>
> Jefsey
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,

- --
Jeffrey A. Williams
Spokesman for INEGroup - (Over 118k members strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number:  972-447-1800 x1894 or 214-244-4827
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 19:38:44 -0700
From: Eric Dierker <[email-masked]>
Subject: Re: [ga] Re:  We can't be against it?

This can't be right, the BC is stating that there is supposed to be a
democratically run, by stakeholders, organization.  Is the BC or the rest of ICANN
hallucinating?

We need to be real careful in our next elections within ICANN because beside a
very few, most elected members are not at all doing what they are supposed to do.
Let me make sure no one misunderstands my position here - with little exception,
ICANN officials are committing fraud.

" Until recently, the protocols,
 numbers and names that make
 the internet work were undertaken
 by United States Government
 contract. It was then decided that
 assignment of internet names,
 addresses and protocols should
 be overseen democratically by
 stakeholders in a new not-for-profit
 organisation.

 This led to the formation of the
 Internet Corporation for Assigned
 Names and Numbers or ICANN.

 The ICANN Board draws on
 research and advice from three
 permanent supporting
 organizations:"

Jefsey Morfin wrote:

> Dear Danny,
> as you know the document you quote does not represent the DNSO/BC positions
> as it has been published in violation of every DNSO/BC rules.(
> http://www.bizconst.org/bcmain.htm )..
>
> A reconsideration procedure is pending.
>
> But you are right the agenda is to take advantage from the 11th Sept.
> Incident to declare inclusive roots terrorists, probably @large activists
> too. The GAC will also be pushed towards a better control of the ccTLDs.
>
> This is sad and much unprofessional. Most of the "single authoritative
> root" integrists never read a DNS file and never the less "commit"
> themselves, their county and the world to the most stupid risk out of their
> pure and only pride to know better what they ignore.  .
>
> The MdR meetings will be quite boring (talking during three days about the
> ICANN as the single point of BS (bad security) of the Internet). Under that
> circumstances ....
>
> Jefsey
>
> On 22:33 29/09/01, [email-masked] said:
> >Rick Wesson wrote:
> >
> >"Marilyn, please define the context you wish to discuss security, and
> >stability.  They are great words to be thrown around and I encourage real
> >discussion on just what you mean by stability."
> >
> >On behalf of the Business Constituency, Marilyn drafted the August 2001
> >Position Paper on Alternate Roots wherein she writes:
> >
> >"The BC notes that confusion between naming schemes within the DNS and roots
> >operated outside of the DNS, pose a severe threat to the stability of the
> >Internet and it's ability to ensure reliability and integrity in supporting
> >global electronic commerce and communications.  Any threat to the stable and
> >reliable resolvability with uniqueness in the naming system of the Internet
> >will cause user confusion, raise new opportunities for consumer fraud, and
> >cause potential harm to all users of the infrastructure worldwide.  Alternate
> >roots, and mechanisms which create confusion related to the authoritative
> >nature of the root with its assurance of global uniqueness, may represent
> >destabilizing factors to the global uniqueness of the Internet's naming
> >system."
> >
> >It would be fair to ask if Marilyn is now invoking "security and stability"
> >as a thinly veiled means to once more attack the alternate roots.
> >--
> >This message was passed to you via the [email-masked] list.
> >Send mail to [email-masked] to unsubscribe
> >("unsubscribe ga" in the body of the message).
> >Archives at http://www.dnso.org/archives.html
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sun, 30 Sep 2001 16:25:06 +1200
From: DPF <[email-masked]>
Subject: Re: [ga] Review Task Force report

On Sat, 29 Sep 2001 15:33:33 EDT, [email-masked] wrote:

>There is no "Task Force".  There is only a slick effort on the part of Phil 
>Sheppard to deny you your rights.  If you choose to remain complacent about 
>it, that is your prerogative.  I, for one, intend to raise my voice.  

I didn't say I disagreed with your conclusions, just commented that a
frontal attack isn't always the best way to achieve one's goals.

DPF
- --
[email-masked]
ICQ 29964527
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Sat, 29 Sep 2001 21:57:25 -0700
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] We can't be against it?

First of all, Jefsey,NSI and I had this discussion last year, at MdR. NSI
does what every other largish corp does, they have a disaster recovery plan,
usually called business resumption plan, by most IT managers. This includes
off-site backups. I don't think that this is anywhere near the issue that
many have thought it to be. I would guess that Tucows also has one. Even lil
ol' MHSC has one (buncha 2.2GB magneto-optical disks in a SF Bay Area Wells
Fargo Safety Deposit box, with duplicates in Colorado Springs). 

A larger issue is the capital loss of the servers themselves. However, I
know of at least 25 other current root zone capable servers that are online
right now, with 100Mbps 100baseT bandwidth, a very large backbone colo
space, that could pick up the slack in less than 30 minutes notice. I have
root access on all of them. All are RFC 2870 compliant and I just finished
upgrading their root zone files. Some of them have been operational for
three years and the ORSC has a bunch more. Operationally, the Internet is
well covered.

If that's the sort of stuff they are going to talk about then the MdR
meeting has no value-add for MHSC. If they are going to go into competition
with MHSC security services, then I have even more reason to stop
contribution to the ICANN process. If they are even going to think that they
can tell MHSC not to sell and run our zone servers then thay can PUAR and
show us the court order, and Sexton can be thankful that he's in Toronto. If
they're going to try and restrict distribution of the root zone file then
our FOIA papers are already filled out, since I've been expecting that move
for some time now.

|> From: Jefsey Morfin [mailto:[email-masked]]
|> Sent: Saturday, September 29, 2001 3:13 AM
|> 
|> On 03:12 29/09/01, Cade,Marilyn S - LGA said:
|> >hmm, so some don't consider business registrants/others
|> >a constituency?  We think we are represented by one of the 
|> ICANN DNSO
|> >constituencies. And the non commercial registrants are 
|> engaged through the
|> >N-C Constituency.
|> >
|> >...and that security and data escrow are a priority, and 
|> should become even more so.
|> 
|> Sure, domain name protection is of the essence.
|> 
|> But is the escrow of bugged systems and tables the only 
|> system to protect 
|> us. I doubt it. Let be clear: would NSI be blown up, burnt 
|> or flooded, what 
|> would you make with the 24,000,000 DN data they have or not 
|> in a vault? You 
|> would need their system to be rebuilt in the same way, in 
|> the very hour.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #765
************************