<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Norbert, <br>
<br>
<div class="moz-cite-prefix">On Wednesday 08 August 2012 07:08 AM,
Norbert Klein wrote:<br>
</div>
<blockquote cite="mid:5021C330.9070803@gmx.net" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
I do NOT understand what the debate here is about - discussing the
location of the 12, or of the many mirrors - when it is a debate
over possible changes in the political control of this system.<br>
<br>
Only what happens or does not happen on the Alpha Server makes any
difference (and it is replicated down the lines throughout all the
sub-systems) I understand. Wrong?<br>
<br>
So any question about control of the 12 and the mirrors is only
about technical details. If the "control" question is pointing at
anything else but the Alpha Server it is not changing anything
fundamentally. Correct or wrong?<br>
</blockquote>
<br>
You have asked a good question - what is the debate here :)<br>
<br>
You seem to agree with Carlos that the political issue is ONLY vis a
vis the control over the alpha server, which we now know is in fact
not the alpha server that a new 'stealth server'. All other root
servers, including their anycast extensions, simply and ONLY reflect
the root zone file, and so it does not matter who controls them. As
for location, there has not been any known difficulty to locate new
anycasts anywhere. Fair enough. <br>
<br>
Now, I will have to take you, and others who may still be with us,
to a long discussion on 'US's oversight' over CIRs - chiefly the
IANA function, that took place in June on this list. David was
greatly involved in it. When I and others argued why US cannot be
relied on to have the unilateral authority to change the root file
at its will - the MAIN argument by David and others was; the 13, or
at least 9, root zone operators will very likely simply refuse to
publish a file so changed by the US. This 'system feature' was
listed as the MAIN defence that things are not as problematic as
some of us are making them to be. McTim, Lee and others made the
same argument of the 'independent decision making' by root server
operators, to minimise what was seen as the 'scare' over US's
fiddling with the root in its own interest. At the end of this email
I provide a few quotes from among several on how this single
argument was repeated employed. <br>
<br>
Whereby, when we argue about the problem with US's unilateral
control over the root, the argument of 'independence of root
operators' is invoked. Such independence means that the '13 root
operators' systems is seen, if required, as being able to go beyond
simply reflecting the root zone file. Well, it has to be one of the
two;<br>
<br>
(1) Either, root operators can and will ONLY reflect the root zone
file in the 'stealth server', whatever happens - in which case, we
should not use the argument of their deemed independence in
discussions on problems vis a vis US's unilateral IANA oversight
powers <br>
<br>
(2) Or, indeed, at least potentially, root operators can refuse to
publish what is considered as an improperly changed file by the US,
and support the internet system continuing to work on the basis of
the original 'proper' file - whereby, it is useful to redistribute
root server operator-ship among agencies that together are more
likely to resist US unilateralism. <br>
<br>
One of the above two must be true, and both cant be true, because
they are logically exclusive arguments. It cant be that (2) is true
in a discussion over IANA authority, but it becomes untrue when we
discuss distribution of root server operators in a geo-political
even and just manner. This alone is my case.<br>
<br>
I can accept either (1) to be true, in which case the argument of
independence of root server operators to publish what they want
should NOT be used in an IANA related argument (David, McTim, Lee et
all, are you there :) )<br>
<br>
Or I can accept (2) to be true, in which case, I will appeal to
Carlos for sympathy to the argument that redistribution of root
server operation authority may be useful to be considered, while
agreeing that IANA authority is a much more important question. <br>
<br>
(To be fair to David, he has said even in the present thread of
discussion that 'The diversity of architecture ( of root server
operators) and lack of centralized control is seen as a feature as
it reduces the opportunities for "capture". If I surmise right,
Carlos, and perhaps you, Norbert, do not think this of being of any
real significance.)<br>
<br>
So, indeed there are real difference of views between, for instance
David and Carlos, on the political significance of root server
operator's independence (or absence of it) - and thus of political
significance of who the 13 root server operators are.<br>
<br>
Such independence (or absence of it) of root operators, especially
in the face of an eventuality of US's rogue behaviour, thus remains
a key political issue, and in good part is the point of debate here.
The answer to this question would determine whether it is worth the
effort to consider reallocating root server operation authority in a
more equitous manner. <br>
<br>
parminder <br>
<br>
<br>
<br>
<br>
<blockquote cite="mid:5021C330.9070803@gmx.net" type="cite"> <br>
<br>
Norbert Klein<br>
<br>
<div class="moz-signature">-- <br>
<font color="#151B8D"> Norbert Klein<br>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:nhklein@gmx.net">nhklein@gmx.net</a><br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.thinking21.org">http://www.thinking21.org</a></font></div>
<br>
<br>
<br>
<blockquote cite="mid:5021160E.4090209@cafonso.ca" type="cite">
<pre wrap="">
This is the only place in which there is NTIA-authorized/controlled
change in the root (the so-called "IANA function"), and all the other 12
and the hundreds of Anycast servers just replicate - the Anycast servers
being replicators of replicators in nearly all cases (except for six
replicating directly from a.root-servers.net).
A new gTLD/ccTLD will never become alive if NTIA does not give the
"nihil obstat" to insert it in this file in this "mother of all
servers", which interestingly (or coincidentally, depending on your
level of paranoia :)) sits very close to CIA headquarters in Virginia.
NTIA also must become aware of *any* modification intended in existing
ccTLD or gTLD records in the root zone file, whatever the Affirmation of
Commitments says.
If a saboteur explodes this server installation (each one of the 13 is
actually a cluster for resilience and security), does the Internet stop?
No, of course, the net of replicators will make sure the Internet
continues to operate fine. But no more changes in the root, Virginia,
until the "mother server" is rebuilt in Virginia :)
If there is a worldwide revolt agains the USA regarding the DNS, can the
Anycast net operate and be modified without resorting to one of the 13
servers (an Anycast server is by agreement used tied to one of the 12
"master replicators", the F, I, J and L being the most popular for this)?
Technically, yes, of course, but...hmmm... I think it is better to keep
a dialogue with the USA instead. :) Aside from the root servers, 16 of
the largest 20 DNS servers in the planet are in the USA, hosting many
millions of domain pointers to Web services *worldwide* -- millions of
websites in Latin America, for example, depend on these servers and
corresponding hosting services.
Is this talk necessary at all? I think this is abundantly common
knowledge since the root system's 13 servers started to operate...
frt rgds
--c.a.
On 08/07/2012 02:17 AM, parminder wrote:
</pre>
<blockquote type="cite">
<pre wrap="">David,
On Sunday 05 August 2012 10:40 PM, David Conrad wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Parminder,
On Aug 5, 2012, at 5:40 AM, parminder <<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:parminder@itforchange.net">parminder@itforchange.net</a>
<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:parminder@itforchange.net"><mailto:parminder@itforchange.net></a>> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Now, we know that there are three kinds of root servers, the
authoritative root server (in which changes are made to the root file
vide the IANA process), 13 root servers and then the any number of
mirrors that can allegedly be created by making an investment of 3k
usd .
</pre>
</blockquote>
<pre wrap="">No.
There is a "distribution master".
</pre>
</blockquote>
<pre wrap="">So, well, apologies for referring to the root zone file as the highest
level of root zone server; I should perhaps simply have said 'the
highest level of Internet's root architecture'. However, your chastising
may be biased. Someone, quite unlike me, with deep technical training
like Daniel said is a recent email;
"As already mentioned, there are hundreds of root server instances.
Each of these is an actual root server."
Isnt this statement as or more untrue, in a discussion where we are
mainly speaking about actual 'control' over the root file. The hundreds
of root servers mentioned above are NOT 'actual root servers'. An actual
root server is a shorthand for an actual root server operator, who
exercises control (at least potentially) over the root zone file that he
publishes. (I learnt this from my earlier discussions with you on the
IANA authority and the US.) The 'ill-informed' Indian minister seems
rather better informed than 'technical experts' here on this particular
issue. He seems to know better which is a true or actual root server and
which is not. Quote from the same interview where he quite wrongly said
that Internet traffic flows through 13 root servers (he should have
said, internet traffic, in a way, gets directed by 13 root servers).
"Currently, India's mirror servers reflect the data but without
mechanisms of control and intervention."
Clearly what some 'technical experts' stress and what they suppress (or
forget to mention) depends on their techno-political proclivities. Isnt
it obvious!
In response to my another email, you have asked me to "provide examples
of supposed 'statements of technical facts' that are ''thoroughly
wrapped in a certain techno-political viewpoint". Apart from the above
example, I will try and find others in your email below :)
</pre>
<blockquote type="cite">
<pre wrap="">(snip)
That's all. There are no special "13" machines that are the "true
root servers" from which other lesser machines mirror the root zone.
</pre>
</blockquote>
<pre wrap="">Well, you did understand early in this discussion that the argument is
not about 'true root servers' but about 'true root server operators', so
why dont we stick to the real point of contestation rather than create
strawmen and defend against them. From your email of a few days ago
"The concern (as I understand it) is that the administration of
those root servers is in the hands of 12 organizations, of which 9
are US-based. " (David)
Yes, true. It is this what we are discussing here, not the network
latency problem. In that email, you understood the concern right. It is
about root server operators, and the term '13 root servers' is loosely
used to mean '13 root server operators'. That is the real issue, and it
was the issue that bothered the Indian and the African ministers the
latter being wrongly, if not mischievously, retorted to in terms to
availability of root server mirrors - a very different issue. Similarly,
this current discussion is continuously pulled towards the convenient
description of geographic extensions through mirrors of root servers,
away from the real issue of 'concentration' (against distribution) of
power to change root file or resist changes to root file that is with
the root server operators and none at all with anycast mirror operators.
It is very interesting that when I did that long discussion with you,
David, on the US's unilateral IANA authority, your almost entire case
was based on how the root server operators are really independent (which
is the same thing as saying they have 'power') and this is the insurance
against any US mischief with the root zone file. However, now when we
are discussing the power of root server operators, which is
geo-politically very unevenly distributed, the 'power' with the root
server operators is sought to be so minimized as to be completely
evaporated. The focus is repeatedly sought to shifted to how anyone can
set up a root server and that those who speak about 13 root servers
(meaning, root server operators) being not distributed well enough are
merely stupid!
How does what appears to be the 'same fact' take such very different
manifestations in two different political arguments? This is what I mean
by 'technical advice' being warped by strong techno-political
viewpoints. I am not making any personal accusation. I am stating a
sociological 'fact'.
</pre>
<blockquote type="cite">
<pre wrap="">(snip)
</pre>
<blockquote type="cite">
<pre wrap="">What I see is that, while there are of course clearly very
significant differences between these three layers or kinds of root
servers, much of the 'technical input' on this list that I have come
across seem to focus on the non-difference and greatly underplay the
difference.
</pre>
</blockquote>
<pre wrap="">As discussed above, the distinction you are making doesn't exist.
</pre>
</blockquote>
<pre wrap="">Well!! See above for the distinction. A clear distinction that you did
understand and articulate in your earlier email in terms of
concentration of ability for "administration of those root servers is in
the hands of 12 organizations, of which 9 are US-based. " There is
obvious and very important distinction between the 'power' of root zone
operator and someone operating a mirror. This distinction is the very
basis of the whole discussion in this thread. But you have easily and
conveniently dismissed, or minimised, distinctions between the root file
layer, root zone layer and anycast mirror layer, esp between these two
latter layers . This is done through a unilateral decision to speak
about one thing when the other party is speaking about quite another, or
at least another aspect of the issue - which here is the issue of
'control' rather than availability of root file for resolving queries.
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">This I think is politically motivated, though disguised as factual
neutral/ technical information.
</pre>
</blockquote>
<pre wrap="">Conspiracy theories are tricky things as it makes it difficult to
communicate.
</pre>
</blockquote>
<pre wrap="">:). I made it clear at the onset that I am trying to argue that when a
group has strong political inclinations - as the so called technical
community has - its technical advice gets accordingly wrapped... Call
it my conspiracy theory, but at least I am upfront. But also (try to )
see how the technical community sees deep conspiracies in every single
political utterance from the South. Worse its conspiracy theory is
further compounded by a 'stupidity theory'. Double insult!
</pre>
<blockquote type="cite">
<pre wrap="">(snip)
You misread. The 13 IP(v4) address limitation due to the default
maximum DNS message size still exists. While there are now ways
around this limitation (specifically, the EDNS0 extension to the DNS
specification), these ways are not universally supported and as such,
cannot be relied upon, particularly for root service.
</pre>
</blockquote>
<pre wrap="">No, I dont think I misread. Just that the fact remains that the number
13 can be expanded without much difficulty, but you are not too
interested to explore that direction while I am (again, political
proclivities intervene). Wasnt introducing multilingual gtlds also
considered a bit 'difficult to rely upon' just a few years back.
Finally, political considerations helped get over that unnecessary and
exaggerated fear. It depended who were taking the decisions, the US
centric ICANN establishment earlier, but the same establishment with
some WSIS related fears and cautions in the second instance.
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">So if indeed it is not, why not breach it and make people of the
world happy.
</pre>
</blockquote>
<pre wrap="">Even if it were possible, I sincerely doubt everyone having their own
root server would make the people of the world happy.
</pre>
</blockquote>
<pre wrap="">This is 'the' most important point - whether there is any justification
at all to increase the number or root servers and/or to reallocate /
redistribute them in a manner that is politically more justifiable and
thus sustainable. I will take it up in a separate email.
regards
parminder
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Even within the limit of 13, why not allocate root servers in a
geo-graphically equitable manner, as Sivasubramanian has suggested,
especially when it seems to make no difference at all to anyone. Why
not make all these ill-informed ministers happy.
</pre>
</blockquote>
<pre wrap="">As mentioned in a previous note, the operators of the root servers are
independent (modulo "A" and "J" (through the Verisign contract with
the USG) and "E", "G", and "H" (operated by USG Departments), albeit
each of these operators deal with their root servers differently). How
root server operators distribute their instances is entirely their
decision. To date, there has apparently been insufficient
justification for those root server operators to decide to distribute
their machines in a "geo-graphically equitable manner".
With that said, there are at least two root server operators ("L"
(ICANN) and "F" (ISC)) who have publicly stated they are willing to
give a root server instance to anyone that asks. Perhaps the
ill-informed ministers could be informed of this so they could be happy?
</pre>
<blockquote type="cite">
<pre wrap="">I read that there is no central control over the 13 or at least 9 of
these root servers. Is it really true?
</pre>
</blockquote>
<pre wrap="">Yes. The diversity of architecture and lack of centralized control is
seen as a feature as it reduces the opportunities for "capture".
</pre>
<blockquote type="cite">
<pre wrap="">Is the 13 root server architecture not something that is aligned to
what goes in and from the authoritative root server.
</pre>
</blockquote>
<pre wrap="">Root server architecture is independent of how the root zone is
distributed.
</pre>
<blockquote type="cite">
<pre wrap="">If it is, why can these root servers not be reallocated in the way
tlds have been reallocated. Can they be reallocated or cant they?
</pre>
</blockquote>
<pre wrap="">In practical terms, the "reallocation of a root server" boils down to
transferring the root server's IP address and telling the new owner
the zone transfer password.
Before the DNS became a political battleground, root server
"reallocation" occurred (extremely infrequently) when (a) the person
to whom Jon Postel "gave" the root server changed employers or (b) the
assets of the organization running the root server were acquired by
another company. Today, "reallocation" of a root server would either
require the existing root server operator voluntarily giving the root
server IP address to a different organization or that IP address would
have to be "taken" by eminent domain or somesuch.
</pre>
<blockquote type="cite">
<pre wrap="">I also read that the it is not about 13 physical root servers, but 13
root server operators,
</pre>
</blockquote>
<pre wrap="">Well, 12 operators (since Verisign operates two root servers).
</pre>
<blockquote type="cite">
<pre wrap="">so the number 13 is about the root server ownership points, and not
physical location points.
</pre>
</blockquote>
<pre wrap="">In the sense that there are 13 IP(v4) addresses that are "owned" by 12
organizations. Geography is largely irrelevant.
</pre>
<blockquote type="cite">
<pre wrap="">Therefore what is needed is to reallocate the ownership points in a
geo-politically equitious manner. As Siva suggests, probably one to
an Indian Institute of Technology.
</pre>
</blockquote>
<pre wrap="">Somewhat as an aside, my understanding is that efforts to provide
infrastructure (not root server infrastructure specifically albeit the
same folks do provide anycast instances for a root server operator) in
India were blocked by demands for bribes greater than the value of
hardware being shipped into the country (see
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://permalink.gmane.org/gmane.org.operators.nanog/100786">http://permalink.gmane.org/gmane.org.operators.nanog/100786</a>).
</pre>
<blockquote type="cite">
<pre wrap="">Why this is not done, or cant be done are the real questions in the
present debate. Any answers?
</pre>
</blockquote>
<pre wrap="">Sure. You are assuming a top-down model that does not exist. There is
no single entity that can dictate to the root server operators "you
will give your root server to IIT". You and others that care about
this are free to make the case to (say) Verisign that it would be in
their corporate best interests for them to relocate administrative
control of one of their root servers to India, but it would be up to
Verisign (or perhaps more accurately, its shareholders) to make that
decision.
</pre>
<blockquote type="cite">
<pre wrap="">Is the real problem here that if root server allocation issue is
opened up, countries would like to go country-wise on root servers
(as the recent China's proposal for 'Autonomous Internet') which will
skew the present non-nation wise Internet topology (other than its US
centricity), which is an important feature of the Internet.
</pre>
</blockquote>
<pre wrap="">No. Placement of root servers has no impact on Internet topology.
Really. Distributing root server instances can be helpful in reducing
root query latency and improving resiliency in the event of network
disruption. That's pretty much it. Opening up the "root server
allocation issue" is a red herring, particularly given pretty much
anyone can get a root server instance if they care and are willing to
abide by the restrictions inherent in operating a root server.
Merging a subsequent note:
On Sunday 05 August 2012 06:10 PM, parminder wrote:
</pre>
<blockquote type="cite">
<pre wrap="">' administrative access will not be available' to the anycast
operator to his own anycast server.
</pre>
</blockquote>
<pre wrap="">Yes. However, if you ask anyone familiar with computer systems, you
will be told that if you have physical access to a machine, you can
gain control of that machine. Obtaining such control would violate
the terms by which the machine was granted, but that's irrelevant.
</pre>
<blockquote type="cite">
<pre wrap="">This is a pretty centralised control, not at all the picture one got
from all the technically well informed insiders who seem to suggest
on this list that everything is open, uncontrolled and hunky-dory and
kind of anyone can set up and operate root servers.
</pre>
</blockquote>
<pre wrap="">I'm getting the impression that you read what you prefer to read, not
what is actually written. No one (to my knowledge) has suggested
"everything is open, uncontrolled and hunky-dory". Root service is
considered critical infrastructure and is treated as such, so anyone
asserting it is "open and uncontrolled" would be confused at best.
Can you provide a reference to anyone making this suggestion?
As for "hunky-dory", I suppose some folks would say the way the root
servers are operated is "hunky-dory". I am not among them.
</pre>
<blockquote type="cite">
<pre wrap="">Was the African minister really so wrong, or even the Indian minister?
</pre>
</blockquote>
<pre wrap="">Yes. Really.
Regards,
-drc
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
</blockquote>
</blockquote>
<br>
</body>
</html>