CircleID

Comments

IP Address Reputation Primer

• Comment posted Jan 29, 2012 2:12 am PST — by David Conrad
  The Famous Brett Watson, It would be unwise to increase the ease with which one may obtain an address block for this very reason. My observation of the RIR policy processes related to the allocation of IPv6 address space is…

• Comment posted Jan 27, 2012 5:56 pm PST — by David Conrad
  The Famous Brett Watson, Folks who are relying on IP reputation are basing decisions about whether to (for example) accept email or block access to websites based on past traffic emanating from that IP address (or block of IP addresses…

• Comment posted Jan 27, 2012 6:23 am PST — by David Conrad
  While I understand and sympathize with the rationales and justifications used to make decisions based on the reputation of IP addresses, this strategy is fundamentally doomed.  With IPv6, the vast amount of address space and the ease by which miscreants…

Whois Scared?

• Comment posted Mar 22, 2011 11:55 pm PDT — by David Conrad
  The Internet is a cooperative system and the cooperators have instituted a system of self governance and policy making that promotes the common interest. I suspect the key word here is "cooperators".  You'll note this is a self-selecting set.  The…

Inquiring About the "Unthinkable"

• Comment posted Mar 10, 2011 8:37 pm PST — by David Conrad
  "Legal chain of custody" is an interesting concept when applied to the root servers in general.  It would undoubtedly be fascinating (to some) to try and nail something like that down.  As I'm not a lawyer, I can't really comment…

• Comment posted Mar 10, 2011 7:47 pm PST — by David Conrad
  Yeah, apologies, I worded that poorly.  Unless all the root servers mucked over the root zone file, the effect to end users would likely be a small amount of additional latency as the resolver declared the modified root server to…

• Comment posted Mar 10, 2011 5:23 pm PST — by David Conrad
  Today, if any one of the root server operators decided to modify the root zone to make it different than that what comes out of the distribution master at VeriSign (not "A" btw), responses from that root server would fail…

Whois Scared?

• Comment posted Mar 04, 2011 5:26 am PST — by David Conrad
  Paul, As demonstrated by http://mailman.nanog.org/pipermail/nanog/2011-March/033962.html, the issue you started to raise regarding the administration of registration data (aka "Whois") is an important one that has remained unresolved for pretty much as long as IP has existed. I believe registration data…

Mubarak, Ben Ali, Kaddafi, ICANN: What They Have in Common Is Scary. Will They Share the Same Fate?

• Comment posted Feb 26, 2011 3:04 am PST — by David Conrad
  Attempting to draw a parallel between events in which people have been (and continue to be) beaten, tortured, and killed and anything related to ICANN is beyond offensive.  Could you actually make this parallel to the faces of people and…

Scrutinize ICANN's Thousand New-TLDs Limit

• Comment posted Oct 17, 2010 6:16 am PDT — by David Conrad
  http://www.icann.org/en/public-comment/public-comment-201011-en.htm#delegation-rate-scenarios

DNS Clients Do Request DNSSEC Today

• Comment posted Sep 06, 2010 11:35 pm PDT — by David Conrad
  Daniel, The more than 50% has remained somewhat constant since long before the root was signed.  As Stephane points out, most resolvers turn on the DO bit by default, even if no trust anchor has been configured.  The end result…

The Digital Divide on IP Addresses

• Comment posted May 27, 2010 1:55 am PDT — by David Conrad
  It's not clear to me that an analysis of national per-capta utilization of IPv6 address space has any value whatsoever.  For one thing, addresses are allocated on a network provider basis as network providers determine they have need for IPv6…

OpenDNS Adopts Proposed DNS Security Solution: DNSCurve

• Comment posted Feb 25, 2010 5:29 pm PST — by David Conrad
  As far as I am aware, DNSCurve was first proposed by Dan Bernstein in August 2008.  I suppose that is recent, at least in comparison to DNSSEC, however I don't believe the lack of implementations is a result of how…

ICANN to Drop Yugoslav's .YU Domain

• Comment posted Oct 05, 2009 5:47 pm PDT — by David Conrad
  At their last meeting, ICANN's board granted the registry for YU an extension of 6 months.

• Comment posted Oct 05, 2009 5:46 pm PDT — by David Conrad
  The YU ISO-3166 country code was moved to "transitionally reserved" by the ISO-3166 maintenance agency.  ISO states "transitionally reserved" means "Code element deleted from ISO 3166-1; stop using ASAP".  Since country code top-level domains are defined by the existence of…

Why Not an Interim Step Until DNSSEC is Ready?

• Comment posted Jun 23, 2009 6:54 pm PDT — by David Conrad
  What IPR claims?  Haven't heard of any being raised. Not sure what you mean by 'the process by which this software was chosen'.  If you're speaking of the DNSSEC protocol, it has been in development for more than a decade…

• Comment posted Jun 22, 2009 12:05 am PDT — by David Conrad
  DNSSEC will never work because it believes that answers should be globally consistent, a perspective that has no place on the Internet we use today.  "Will never work", huh?  DNSSEC, of course, works.  Whether or not it will see widespread…

• Comment posted Jun 21, 2009 12:25 am PDT — by David Conrad
  An interim selection for parties involved in root signing has been made and will be discussed at the ICANN meeting this week in Sydney.  Even if root were not signed, the existence of the ITAR (https://itar.iana.org) and automated tools that…

• Comment posted Jun 20, 2009 1:55 am PDT — by David Conrad
  What are the "myriad issues"?

IANA: A Tale of Two Fails

• Comment posted Mar 21, 2009 2:54 am PDT — by David Conrad
  Having had some small role with IANA in the past, let me try to provide some factual information regarding the issues you raise. The IANA now has a Web form to assist in this task; Actually, IANA has had a…

ICANN Should Pay Even More and Increase Its Spending Several Fold

• Comment posted Jan 08, 2009 4:42 pm PST — by David Conrad
  Suresh, It is a common misperception, one that (at least in my experience) has been actively encouraged by ISPs, that the Internet governance structures (RIRs and ICANN) impose significant fees which the ISPs must recover by passing those costs on…

• Comment posted Jan 07, 2009 2:25 am PST — by David Conrad
  Just a clarification: IANA does not charge any fees for IP addresses (or any other service for that matter).  The RIRs voluntarily contribute to ICANN, but that is unrelated to the services IANA provides and the folks providing IANA services…

IPv6 Considered a Problem by Some Users

• Comment posted Aug 09, 2008 7:47 pm PDT — by David Conrad
  Jeroen, I appreciate the suggestions for getting IPv6 connectivity at home, however the steps you describe reinforce my statement that "IPv6 is not ready for production use".  I (perhaps mistakenly) consider myself to be reasonably technically proficient, but in order…

• Comment posted Aug 08, 2008 10:44 pm PDT — by David Conrad
  It isn't necessarily the DNS.  From personal experience, there are ISPs that accept the announcement of the 6to4 prefix and propagate that route internally, regardless of what path this imposes on IPv6 traffic.  For example, when I turned on IPv6…

Not a Guessing Game

• Comment posted Jul 17, 2008 3:08 am PDT — by David Conrad
  that demo is of technology, not political will, and is therefore somewhat off-topic. One of the points of the demo was to indicate IANA was undertaking to be in a position to sign the root, even at non-trivial cost (you…

• Comment posted Jul 16, 2008 10:45 pm PDT — by David Conrad
  I also know that ICANN and USG lack the political will to sign the root zone with Secure DNS, While I obviously cannot speak for the USG (and I don't speak for ICANN), stating that ICANN lacks the political will…

Identity Theft of Root Name Servers, Reason Unknown

• Comment posted May 20, 2008 4:47 pm PDT — by David Conrad
  http://blog.icann.org/?p=309

DNSSEC: Once More, With Feeling!

• Comment posted Dec 14, 2007 9:29 pm PST — by David Conrad
  Jay Daley said: Lots of useful stuff here.  One thing I would take issue with is the extraordinary statement that "the DNS is already relatively fragile".  Nothing could be further from the truth. DNS as a whole is quite resilient. …

• Comment posted Dec 14, 2007 9:21 pm PST — by David Conrad
  Brenden, ...except for the network effects associated with the current DNS, which make the likelihood of setting up an alternate tree (that actually gets used) highly improbable. Adding a DNSSEC root key controlled by a single party raises those setup…

The Case Against DNSSEC

• Comment posted Aug 14, 2007 9:30 pm PDT — by David Conrad
  Another take on the same question: A Case Against DNSSEC (Thomas Ptacek)

Where Do Country Code Domain Names Go to Die?

• Comment posted Dec 30, 2006 8:34 pm PST — by David Conrad
  Anne, the sign and stationery people must be rubbing their hands with glee at the very thought of businesses worldwide having to change domain codes. Good thing businesses never change their names, telephone numbers, or postal addresses.  Oh, wait… More…

• Comment posted Dec 18, 2006 11:55 pm PST — by David Conrad
  John, The notion that the ISO-3166 Maintenance Authority is responsible for determining the composition of the root zone, or that IANA is somehow obligated to the ISO-3166 MA to organize the root zone in accordance with ISO-3166 is silly. It…

• Comment posted Dec 15, 2006 3:48 am PST — by David Conrad
  Max, There can be a very bad precedent of killing alive domain even without any real policy reason, just because someone in ICANN don’t like it. No one at ICANN I am aware of has any issue with .SU or…

ICANN Releases Beta TLD Verification Tool

• Comment posted Dec 05, 2006 3:33 pm PST — by David Conrad
  It would be interesting if the tool was actually available. It should be up within a day. There isn’t a reason why the tool was retracted, but it must have something to do with the ITU. It had nothing to…

A Further Look Into ORSN

• Comment posted Oct 15, 2005 6:38 pm PDT — by David Conrad
  Milton, You've merged the concept of the Internet namespace and the implementation of that namespace.  ORSN has implemented the Internet namespace on a different set of IP addresses than the ones the vast majority of Internet users use.  That's all.…