Subject: [dnsext] draft-diao-aip-dns

From: Tony Finch <[email-masked]>
Date: Sun, 17 Jun 2012 18:01:04 +0100

So this "DNS Extension for Autonomous Internet" caught my eye. There are
clearly a number of autonomy-related requirements that the DNS does not
satisfy, such as private/internal names and ad-hoc networking. These are
currently satisfied by working outside the architecture - BIND's views and
multicast DNS respectively.

However this draft is not about any of that. It appears to be proposing a
technical workaround for dissatisfaction with ICANN's management of the
DNS namespace. But it seems to me that none of this is necessary: all it
is doing is shifting the namespace down a level.

That is you can get a similar result by observing that an AIP network
number performs the same function as a top-level domain and an AIP gateway
performs the same function as a root name server. Instead of resolver
search paths, AIP changes the resolution rules to deal with the difference
between local names within the user's AIP network and global names in
other AIP networks.

So a nation-state can get unilateral autonomy within the current DNS
without changing any software or protocols by:

(1) Designating a TLD for this purpose (with or without the co-operation
of ICANN);

(2) Requiring all resolvers to configure name server addresses and a
DNSSEC trust anchor for this TLD, so that it is independent of the root;

(2) Requiring everyone to include the TLD in their resolver search paths,
so users do not need to mention it in their domain names.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Fisher: Westerly or southwesterly 4 or 5, occasionally 6 at first in south,
becoming variable 3 later. Moderate or rough, becoming slight later.
Occasional rain, fog patches developing. Moderate or good, occasionally very
poor later.

---

From: Ondřej Surý <[email-masked]>
Date: Mon, 18 Jun 2012 14:58:31 +0200

Hi,

thanks Tony for pointing that out...

On 17. 6. 2012, at 19:01, Tony Finch wrote:

> DNS namespace.

I am not so sure about the motivations, but I see this draft as dangerous
precedent.  Unified DNS tree was and is an important building block of the
Internet and standardizing DNS-split would mean the end of the Internet
as we know it.

> But it seems to me that none of this is necessary: all it is doing is shifting the namespace down a level.

Exactly.  And then it would be just a mess - every country would create it's own Internet.

> That is you can get a similar result [...] using existing technologies.

+1

not that I promote the usage of existing tools for Internet censorship,
but at least those are just tools, and not the justification to split
the Internet.

Last, but not least, we (IETF) should produce technical documents
and not political.  This is quite nice example of a document which
(in my view) puts priorities of national states over the openness
and overall compatibility of the Internet.

O.
--
 Ondřej Surý -- Chief Science Officer
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 tel:+420.222745110       fax:+420.222745112
 -------------------------------------------

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 18 Jun 2012 15:12:38 +0200

On Mon, Jun 18, 2012 at 02:58:31PM +0200,
 Ond?ej Surý <[email-masked]> wrote 
 a message of 35 lines which said:

> Unified DNS tree was and is an important building block of the
> Internet and standardizing DNS-split would mean the end of the
> Internet as we know it.

The I-D does not split the DNS at all. It plays with words by
pretending it will allow several roots but this is not true. Instead,
it creates a super-root (the one which will allocate the AIPs, the .A
and .B in the examples) and therefore just displaces the (real)
problems to the super-root.

This is what the vast majority of "several roots" systems do: create a
new root but do not call it a root. Newspeak at its best...

---

From: Eric Brunner-Williams <[email-masked]>
Date: Mon, 18 Jun 2012 09:26:53 -0400

On 6/17/12 1:01 PM, Tony Finch wrote:
> It appears to be proposing a

cnnic's ns constellation was illuminated in 2001. the published zone
contained several non-ascii labels -- the better part of a decade
before any non-ascii labels were added to the zone published by
corporations in marina del rey and reston, with the permission of a
government.

my point being that (a) the engineering is not novel, though the draft
in this context is, and (b) purpose may include permitting resources,
e.g., han script, not just denial of resources, e.g., content scope
limitations.

-e

---

From: Ondřej Surý <[email-masked]>
Date: Mon, 18 Jun 2012 15:29:13 +0200

> problems to the super-root.

Well, yes and no.  It's something in between.

If you are in '.A' AIP, you will not have to type .A at the end of your
query, so gov.cn will work as is without '.A'.  Only if you want to go
to 'unapproved' site in .B tree you will have to type
'encrypted.google.com.you-will-be-arrested' into your browser URL bar.

> new root but do not call it a root. Newspeak at its best...

Yup, I agree.

O.

---

From: Donald Eastlake <[email-masked]>
Date: Mon, 18 Jun 2012 19:19:17 -0400

If you want multiple sets of roots within the DNS protocol, you just
use CLASS. "Countries" have 3 digit UN country numbers as well as
alpha codes, so you could assign a block of 1000 CLASSes for this
purpose. Then all you need are B/C/DNAME RRs that include a target
CLASS as well as a domain name... :-)

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

On Mon, Jun 18, 2012 at 9:29 AM, Ondřej Surý <[email-masked]> wrote:
> _______________________________________________
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext

---

From: Ralph Droms <[email-masked]>
Date: Mon, 18 Jun 2012 17:50:16 -0600

> 'encrypted.google.com.you-will-be-arrested' into your browser URL bar.

I also think that if you query example.com (with no .* suffix) in realm A, you may get a different answer than if you query example.com in realm B.

- Ralph

---

From: Mark Andrews <[email-masked]>
Date: Tue, 19 Jun 2012 10:00:40 +1000

In message <[email-masked]>, =?utf-8?Q?Ond=C5=99ej
> Internet and standardizing DNS-split would mean the end of the Internet

The same entered name should get to the same resource even if the
resource does not resolve everywhere.  This doesn't meet this
property.

Additionally RFC 1535 shows why this approach is bad.  This would
codify the flaw indentified in RFC 1535.

Classic split DNS is additive with additional names, address, etc.
added to the public view to create the private view.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Warren Kumari <[email-masked]>
Date: Mon, 18 Jun 2012 20:54:08 -0400

> and overall compatibility of the Internet.

Hear hear….

There are a large number of major issues with the document (apart from legibility), but the added complexity and fragility for someone's nationalistic desires are not a reasonable tradeoff.

I was also muchly entertained by the Security Considerations and IANA Considerations bits -- wheee, lets bypass the existing (flawed) process and gets our own string by publishing a doc…

W

-- 
With Feudalism, it's your Count that votes.

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 18 Jun 2012 22:49:45 -0400

> problems to the super-root.

I completely agree, and I think that issue is the fundamental problem
with the draft.

We do not need a single root for some political or organizational
reason; lots of things get along without that.  But the DNS is a tree
in the mathematical sense.  It is _incoherent_ to say that you can
have multiple roots in such a tree.  If you have multiple roots, that
just means that you're not yet at the root, properly described.
You're merely at an apex.

Some of the draft is hard to understand because its prose needs work;
that is a mere matter of editing.  But a portion of the draft will
never be possible to understand, because it is trying to hide the
fundamental confusion at its core.  A muddled idea can never be clear,
even once it is clear how muddled the idea is.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 19 Jun 2012 11:36:56 +0200

On Mon, Jun 18, 2012 at 05:50:16PM -0600,
 Ralph Droms <[email-masked]> wrote 
 a message of 56 lines which said:

> I also think that if you query example.com (with no .* suffix) in
> realm A, you may get a different answer than if you query
> example.com in realm B.

It is the exact same thing as the "search" directive in
resolv.conf. When I type "ping www" at home or at work (or "ping
www.lab" if you want an example with multiple labels), I ping a
different machine.

---

From: Ralph Droms <[email-masked]>
Date: Tue, 19 Jun 2012 11:23:05 -0600

> www.lab" if you want an example with multiple labels), I ping a

Hm.  I guess the similarity extends to the observation that a user can reconfigure to avoid the serach directive issue, and can reconfigure to use an RDNSS in the desired "realm" (rather than, e.g., the RDNSS provided through DHCP) to avoid the side effects of draft-diao-aip-dns.

- Ralph

---

From: Mark Andrews <[email-masked]>
Date: Wed, 20 Jun 2012 11:52:25 +1000

In message <[email-masked]>, Ralph Droms writes:
> Hm.  I guess the similarity extends to the observation that a user can reconfigure to avoid the serach directive issue, and can rec
> onfigure to use an RDNSS in the desired "realm" (rather than, e.g., the RDNSS provided through DHCP) to avoid the side effects of d
> raft-diao-aip-dns.
> 
> - Ralph

Pinging www.example.net doesn't touch the search list normally
unless there is nothing at www.example.net.  It really *is* a
security issue to append search list elements to qualified names.

---

From: SM <[email-masked]>
Date: Wed, 20 Jun 2012 00:41:36 -0700

>create it's own Internet.

It would be like letting a hundred flowers bloom for the governance people.

>but at least those are just tools, and not the justification to split

Nowadays it is simply referred to as legally restricted content.

>and not political.  This is quite nice example of a document which

The IETF produces political documents dressed up as technical 
proposals.  They rarely take a line as in this draft as they are 
usually about technology.

In the Introduction Section:

   "Internet Domain Name System (DNS) distributes domain name and IP
    address for the host on the Internet."

What does the above mean?

   "In current Internet domain name hierarchy, the root DNS server
    authorizes and distributes all sub-layer DNS servers."

That doesn't match the current definition.  It has been said that "to 
remain a global network, the Internet requires the existence of a 
globally unique public name space".

Do the authors of draft-diao-aip-dns-00 share the view that:

   (a) It is essential to have a common symbol set; and

   (b) common semantic interpretation of these symbols

In Section 2.3:

   "In order to realize the transition from Internet to Autonomous
    Internet, each partition of current Internet should first realize
    possible self-government and gradually reduce its dependence on the
    foreign domain names, such as COM, NET et al."

It is somewhat simplistic to look at domain names as a way to 
transition the Internet to some other form.

Regards,
-sm

---

From: YP Diao <[email-masked]>
Date: Sat, 30 Jun 2012 19:50:28 -0700 (PDT)

Yes, here is a super-root in this draft in mathematical sense. It is the way to smoothly transfer to AIP DNS and provides DNS resolution among all these AIP networks. If we provide the domain name suffix, common sense is available globally. It satisfies the two essentail perconditions in RFC 2826:
   -  The existence of a common symbol set, and
   -  The existence of a common semantic interpretation of these
      symbols.

But in practical you can run your own root in each AIP network. It provides automony and extensibility. 

Technically, it is extensible choice for countries, global operators, and specific internet networks such as Things of Internet.

Of course, there are more other applications as you need.

Diao Yongping
20120701

--- On Mon, 6/18/12, Andrew Sullivan <[email-masked]> wrote:

> From: Andrew Sullivan <[email-masked]>
> Subject: Re: [dnsext] draft-diao-aip-dns
> To: "Stephane Bortzmeyer" <[email-masked]>
> Cc: "Ond?ej Surý" <[email-masked]>, [email-masked], [email-masked], [email-masked], [email-masked]
> Date: Monday, June 18, 2012, 8:49 PM