<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Oct 25, 2013, at 2:11 AM, Milton L Mueller <<a href="mailto:mueller@syr.edu">mueller@syr.edu</a>> wrote:<br><div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; direction: ltr;"><br class="Apple-interchange-newline">> There are also inherent limits what can be accomplished based on principles <div>> which are basically voluntary in nature. For example, even if there were common, </div><div>> global agreement on social norms regarding unsolicited commercial email, the </div><div>> mechanisms that would be provided from an entirely techno-centric Internet </div><div>> cooperation system would be limited to various voluntary measures of increasing </div><div>> complexity, in the typical "arms race" of increasing subterfuge and improved </div><div>> detection and mitigation. These not really a solutions at all, just a sequence of </div><div>> coping strategies which result in increasing costs and pain for the users.<div><div><div class="BodyFragment"><div class="PlainText"> </div><div class="PlainText">Not necessarily. Most of the real mitigation of Internet problems occurs in exactly this way.</div></div></div></div></div></div></blockquote><div><br></div>Milton - In many cases, the mitigation strategies are borderline effective, and it's not </div><div>clear that we have solutions that always keep up, nor that we've actually considered</div><div>the price and impact that they inflict on end users of the Internet. </div><div><br></div><div>For example, Distributed Denial of Service (DDoS) attacks are becoming so large that </div><div>the mitigation is becoming near impossible for the largest attacks -</div><div><br></div><div><<a href="http://www.infoworld.com/d/networking/ddos-attack-against-spamhaus-was-reportedly-the-largest-in-history-215352?page=0,0">http://www.infoworld.com/d/networking/ddos-attack-against-spamhaus-was-reportedly-the-largest-in-history-215352?page=0,0</a>></div><div><br></div><div>Now, you might say everything is just fine; it's okay if large portions of the Internet</div><div>(innocent third parties) are impacted during these attacks, but note they are effectively </div><div>the side effect of cyber-vigilantism mitigation against a organization which is itself a</div><div>mitigation effort (i.e. spam blocklists). </div><div><br></div><div>Should we wait for an anti-DDoS cyber vigilanteism mitigation effort to arise (who </div><div>knows, maybe they'll decide to use routing attacks) to take on those who are using</div><div>DDoS attacks (in the process of mitigation against on those who run blocklists, </div><div>which is only being done for the mitigation of spam)?</div><div><br></div><div>How many layers of countermeasures/counterattacks do we need to render the net </div><div>effectively unusable? Every one of these measures has unproductive impacts on</div><div>innocent parties, and there is no consideration of the cumulative impact as these</div><div>half-measures are heaped atop one another.</div><div><br></div><div><div><blockquote type="cite"><div style="direction: ltr;"><div><div class="BodyFragment"><div class="PlainText">This may be a terrible way of approaching problems it is just that in 95% of the cases it is better than all the alternatives. </div></div></div></div></blockquote><div><div style="direction: ltr;"><div class="BodyFragment"><div class="PlainText"><br></div><div class="PlainText">Actually, let's go with 98 or 99%, since the downside risks of disproportionate regulation,</div><div class="PlainText">unintended consequences, etc. etc. are all very real, and in general, the folks who have the</div><div class="PlainText">ability to actually mandate (i.e. governments) generally have shallow understanding of the</div><div class="PlainText">the situation and political factors that may unduly influence any outcome. </div><div class="PlainText"><br></div><div class="PlainText">In fact, this one of the reasons why actual multi-lateral governmental approaches to nearly</div><div class="PlainText">any Internet challenge is (in my personal view) very likely a mistake. Nearly anything which</div><div class="PlainText">is _mandated_ from such high level regarding the deeply technical and pervasive Internet </div><div class="PlainText">is almost certainly going to miss many potential ramifications that could result, and it does</div><div class="PlainText">not help that such discussions are inherently inter-governmental, the meaning of outcomes</div><div class="PlainText">subject to reinterpretation when brought back to national scope and implementation.</div><div class="PlainText"><br></div><div class="PlainText">That does not mean that getting multiple parties (governmental, civil society, business, </div><div class="PlainText">technical, etc.) to agree that "DDoS attacks are bad" then collaborative consider how to </div><div class="PlainText">reduce them" is necessarily a mistake. In the ideal world, this would result in some form</div><div class="PlainText">of coordinated discussion of the problem, various technical solutions, the various societal</div><div class="PlainText">and business implications of the solutions, and potentially nothing else due to lack of </div><div class="PlainText">consensus. However by some miracle, consensus were to emerge on a specific technical</div><div class="PlainText">measure for a problem that could be applied globally, then that would be very good to know. </div><div class="PlainText"><br></div><div class="PlainText">It's possible that may be the end of it; some countries may note the specific technical measure</div><div class="PlainText">as a best practice for industry to consider for self-improvement, some countries may decide to </div><div class="PlainText">engage in further discussions on a national basis about "rulemaking", etc. and some may do </div><div class="PlainText">nothing at all. All of this variation is good; different countries and citizens have different ways </div><div class="PlainText">of looking at these matters; the important part is any technical measure to address a given </div><div class="PlainText">challenge has been confirmed to interoperate on a global scale if implemented, so that any </div><div class="PlainText">deployment that occurs doesn't endanger the interconnected nature of the Internet. </div><div class="PlainText"><br></div></div></div></div></div></div><div><blockquote type="cite"><div style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; direction: ltr;"><div><div><div><div class="BodyFragment"><div class="PlainText"></div><div class="PlainText">> Whereas, if there were a common and global agreement on acceptable social norms in<span class="Apple-converted-space"> </span><br>> this area (hypothetically), and given engagement of all parties (including governments),<br>> there likely would be far superior mechanisms available which provide a higher level of<span class="Apple-converted-space"> </span><br>> assurance and lower costs to users globally.<br><br><div class="PlainText">Your lack of familiarity with the broader field of policy studies may lead you to overstate the potential of collective action involving states, especially at the international level. Would you like to provide an example or two of a successful effort of this sort in a highly technical field? </div></div></div></div></div></div></div></blockquote><br></div><div>I'm not certain that getting common agreement that "servers should not be left publicly</div><div>open and exploitable" rises to the same level as climate change or global monetary </div><div>policy... In fact, most ISPs would agree that there's no reason not to do it right aside</div><div>from the minor incremental cost, as it is just additional configuration to set DNS rate </div><div>limiting for your DNS servers and BCP38 source filtering on customer connections.)</div><div><br></div><div>The fact that we understand the problem (and know of the right technical solutions) </div><div>doesn't actually do anything to solve the problem, since it's not required for ISPs have </div><div>solid configurations and no business wishes to take on costs on a voluntarily good </div><div>samaritan basis if their competitor doesn't do likewise. It doesn't really matter if they </div><div>know it is the right thing to do, as it has real costs in competitive marketplace and the </div><div>downside of not doing is indiscernible locally but adds up globally to a very serious </div><div>problem -</div><div><br></div><div><<a href="http://news.cnet.com/8301-1009_3-57576947-83/how-the-spamhaus-ddos-attack-could-have-been-prevented/">http://news.cnet.com/8301-1009_3-57576947-83/how-the-spamhaus-ddos-attack-could-have-been-prevented/</a>></div><div><br></div><div>Industry is simply not going to adopt such practices, just as businesses are less likely to </div><div>adopt voluntary fire safety measures. The Internet means that every server is "next door"</div><div>to every other one, and that means that we need global agreement on the norms (and the</div><div>actual interoperable technical mechanisms) if we want to actually prevent conflagrations</div><div>when it comes to distributed denial of service attacks. The private sector isn't particularly </div><div>excited about this, and in fact, some of them even make good money off the ever increasing </div><div>capabilities of products and services in the industries which have been enabled as a result </div><div>of simple misconfiguration repeated globally...</div><div><br></div><div>The fact that uninvolved users are often caught in the middle of these attacks is actually</div><div>good news - it creates more headlines and helps sell more products. I imagine that the </div><div>building construction industry would be equally happy to dispense with firecodes; not only </div><div>does it reduce their costs, it creates even more business rebuilding the buildings that burn </div><div>down. The equivalent to what we have in Internet security industry would be no building</div><div>codes, and a robust market in _personal_ fire extinguishers - "Been caught in a burning </div><div>building this year? It's becoming a fact of life, so carry your own personal extinguisher to</div><div>help you get out! Here's some articles about last months victims - don't get caught without</div><div>your own personal protection!" ;-)</div><div><br></div><div>FYI,</div><div>/John</div><div><br></div><div>Disclaimers: My views alone. (and apologies for length, I lacked the time to make it shorter...)</div><div><br></div></body></html>