|
||
|
||
Why shouldn’t there be a .gadi TLD? Why not one for Microsoft? This post is not about alternate roots or why they are bad, this post is about something else. We do need to go over some background (from my perspective) very quickly though.
ICANN has a steel-fist control over what happens in the DNS realm. They decide what is allowed, and who gets money from it. Whether it’s VeriSign for .com or any registrar for the domains they sell. They decide if .gadi should exist or not.
They decide if I can have .??? (which if encoded correctly on your PC you can see as .gadi in Hebrew), which would be a TLD in Hebrew.
There is a very good reason ‘why not’. It would be circumventing what is currently known as the DNS. The root servers, the TLD servers, and so on, creating confusion and chaos online, according to some (and to a level, me).
Yet with the United States via ICANN controlling that system, kicking the rest of the world out, and with other countries such as China, creating their own as a result. I see no reason why Microsoft, as an organization, can’t. Microsoft in this case was an arbitrary choice by me, as an example, much like .gadi was.
This has been discussed to death, and in my opinion, the US has been self-marginalizing itself looking at short-term income and control over long-term separation and kick in the nuts from the rest of the world.
What I am here to discuss is why Microsoft, as a non-arbitrary choice this time, indeed, of all the world, should kick it aside, creating an alternate root while at the same time not disturbing the world’s DNS. They are the only ones in this world with the muscle to do it. Monoculture can also be a good thing for security.
.ms - It already exists as a ccTLD (for Montserrat). Shame. They could, in all likelihood, get .MSFT if they tried hard enough, in the current root system. I don’t see why they should even try.
What they can do, for a rather low cost, is add something to their next operating system and web browser (Vista and IE 7) to recognize .MSFT, and act accordingly.
There is a wonderful legacy creation, predating DNS, called the hosts file. Using this file, users and malware can input names to be resolved. As an example, my hosts file has an entry for the following host:
127.0.0.1 localhost
So that whenever I try to resolve localhost, I get to 127.0.0.1 which is my loopback address. The same could be done to www.google.com, pointing it to whatever address the user or malware wants it to be pointed to. This happens quite often in the malware world.
There are phishing sites and DNS hijacking is also known to happen, why risk it? Why risk the root servers going down? Why not create a site (at the very least) for users to be able to safely go to, regardless of what’s happening outside of their computer on the DNS? Whenever a user tried to go to .MSFT, the TLD would be recognized as one belonging to Microsoft, and a Microsoft DNS root server would be contacted. Microsoft.com would still be under the control of the DNS, so that wouldn’t work as well.
You could have: live.MSFT or msrc.MSFT, msn.MSFT, etc. Microsoft could also create other TLDs, and why shouldn’t they?
.LIVE
.MSRC
.MSN
Or just, even:
live
msrc
msft
microsoft
Regardless of how far they could take this, they won’t be messing with the global root system as hey, ICANN is not about to add a .MSFT TLD, right? Microsoft is everywhere, and they would be serving Windows users. Their own clients. To their own IP addresses.
I say they should go for it. They won’t be breaking any laws nor stepping on ICANN’s feet. They could call it something else if DNS is too loaded a word.
Security and more importantly, business-wise, this can be a very cool and relatively easy “feature” to implement.
Naturally, once compromised, a machine could be fooled to go elsewhere even if Microsoft were to embed this deeper than the hosts file, but it would be really neat for all other, related, network-based attacks. It would help Microsoft’s network security as well and not just their users, depending on how they may implement this.
A monoculture with Windows machines everywhere is dangerous, potentially, one bug or one bad patch and we are done for. Why not use it for good and business while it’s here, as it is not going anywhere?
Why not Cisco next for their routers? Why not eBay? Whether via Microsoft’s new system as clients, or on their own, adding an address to the hosts file (hoping some malware doesn’t change it, and one would).
Think about it. Even if it never does get implemented, it’s a pretty neat idea, in my completely unbiased opinion. :)
Sponsored byCSC
Sponsored byVerisign
Sponsored byVerisign
Sponsored byDNIB.com
Sponsored byWhoisXML API
Sponsored byIPv4.Global
Sponsored byRadix
A World-Renowned Source for Internet Developments. Serving Since 2002.
OK Gadi. I’ll bite. I get an e-mail from somebody that says “Dood. Check this new update out, your site needs to install it.”. (Assume it’s actually a link from somebody I actually trust enough to follow a link and not some worm claiming to be a Microsoft security update).
And the link points off to somewhere in *.ms or *.msft..
% cat /etc/issue
Fedora Core release 5.92 (FC6 Test3)
Kernel \r on an \m
*bzzt*. Thank you for playing, but that URL is useless to me.
Well, I think Fedora is kinda a Linux distribution. ;)
Exactly. That’s the *point*.
How do I access the URL if I’m not running (insert frobnitz to grant access to wonky alternate root here)? That’s the problem with *any* alternate root - it Balkanizes things.
Another query for you - how would said Web page ever get indexed by Google? :)
That’s my point. Only Microsoft customers would be using it. Without ever touching the DNS.
It can be indexed by.. MSN. :)
The problem with the “hosts” file itself—the primary reason why the domain name system was invented at all—is that it doesn’t scale. That’s why DNS is a distributed database. I seriously doubt that the hosts file can be used to extend DNS in any practical manner.
That’s neither here nor there, because every instance of Windows contains a resolver—the software that looks up DNS and hosts file entries. Should Microsoft wish to, shall we say, “embrace and extend” the DNS, it is in the perfect position to do so. What’s lacking is any real motive. A “.msft” domain is shorter than “.microsoft.com”, but is that so great a benefit that it warrants monkeying around with the resolver?
Two other scenarios spring to mind: Microsoft sets itself up as the only “alternative root” provider with the clout to establish critical mass rapidly, or Microsoft modifies Internet Explorer to have “Site Finder” functionality and associated ad revenue. Both of these would be obvious abuses of their monopoly position, and likely to attract legal action.
Ultimately, however, I don’t think it’s the threat of legal action which would deter them. I believe that Microsoft’s main goal is to maximise lock-in to their product, and I simply don’t see the DNS as offering any great opportunities in that regard. I’d be genuinely surprised if they did it just for the money.
Indeed, and yet it is so “cool” security-wise. Why “extend” the DNS? It is as unrealted as anything, if done just for their clients for support issues.
How does it differ from the old .hlp files? These have been replaced by web page! :)
Still, it could be interesting in the search engine wars, potentially.
“Only Microsoft users would be using it. Without touching the DNS”.
And what compelling content would you put under this domain? You’re pretty much stuck with only using it for hidden under-the-cover things due to the leakage problem. It’s probably not even safe to put Windows Update out there, because even those URLs have a tendency to leak.
Even hard-coding IP addresses in a URL isn’t as bad - if 66.257.12.19 isn’t the webserver anymore, you can serve up content that says http://66.257.12.27/ instead, and Joe User will get to the right place, and you only get screwed if Joe User decides to bookmark the link. But if their host file has the old IP address, http://neat-o.msft/ will go to the wrong place *forever* (unless you’re seriously suggesting that on a properly run system, a Joe User userid has the privs needed to update the host file).
You apparently have never had to do a large-scale change of a hard-coded IP address for a large network (including the *very* real problem of fixing people who still haven’t gotten the news 6 months later - the support desk just *loves* that sort of call). I’ve had enough fun with that sort of mess on a 30K user network. 600 million Windows boxes that can potentially get out of sync? The mind boggles at the support issues.
When I got on the net some 22 years ago, DNS was *just* making an appearance - specifically because there were some 6,000 machines on the net, and keeping 6,000 host files up to date was impossible. I’m pretty sure we haven’t gotten 100,000 times better at managing that sort of problem in 22 years.
This smells a lot like a solution searching for a problem.
The hosts file is an example, I am sure Microsoft can do much better. If anything .MSFT points to their “DNS” server (root?).
Leave the technology argument for later, look at merits, if you can’t find any, that’s also ok.
As the IAB said in RFC2826:
“To remain a global network, the Internet requires the existence of a globally unique public name space. The DNS name space is a hierarchical name space derived from a single, globally unique root. This is a technical constraint inherent in the design of the DNS. Therefore it is not technically feasible for there to be more than one root in the public DNS. That one root must be supported by a set of coordinated root servers administered by a unique naming authority.
Put simply, deploying multiple public DNS roots would raise a very strong possibility that users of different ISPs who click on the same link on a web page could end up at different destinations, against the will of the web page designers.
This does not preclude private networks from operating their own private name spaces, but if they wish to make use of names uniquely defined for the global Internet, they have to fetch that information from the global DNS naming hierarchy, and in particular from the coordinated root servers of the global DNS naming hierarchy.”
Read that third paragraph repeatedly until it sinks in, and remember two things: (1) Many/most corporate users won’t be able to contact this hypothetical alternate root due to firewalling issues. (2) Many users of Microsoft resources aren’t on Windows boxes (for instance, I regularly read MS KB articles on this laptop, and it’s in MS’s interest to let me keep doing so, because then I can better support my users of their products.
The end result is that there’s no real *use* for an alternate root for MSFT that isn’t equally well served by just serving it from under the microsoft.com tree.
Well, actually, there *is* one, but I’m guaranteed it would meet with legal opposition in the EC, and even the US DoJ would probably have to take action about it. It *would* be handy if MSFT wanted to start an AOL-style walled garden, and host all the premium content under .MSFT domain. I’m not sure how I’d make a business case for a walled garden service under current conditions - the biggest problem would be thinking of a way to *legally* attract paying customers when AOL is hemmoraging subscribers. Trying to leverage their near-monopoly in operating systems into other fields is a big no-no. Using their dominance to snarf subscribers will bring retribution even worse than their foisting IE and WMP on people…..
Fine, do it with a redirector on a web page, or something far better. The technology doesn’t matter. Honest.
And no, this does not apply as an alternate root under the technical term, it does factually. I don’t see why Microsoft couldn’t potentially start something like this for their users, on say, port 445? Silly example but still. Let’s create a protocol for remote help files connecting to Microsoft alone, and not use it over HTTP and port 80. Look at it as a different service.
Now go back to looking at it as DNS. Now look at certificates. There are many certificate authorities. I suppose DNS USERS and CLIENTS would have to support more than one root system before long anyway. Internet Explorer and so on would use whatever systems are popular or have been changed manually.
This is going to happen. This is not what we are talking about here.
What we are talking about here is, say, an Internal DNS sevrer serving, say, private addresses. Only on a much wider scale.
It doesn’t need to inter-connect, and the answer to that is: tough. Microsoft can do whatever they want and this does not affect the global system. If it does, please show me how as I can’t see it?
IE sees .msft - goes to a different root system.
.LOCAL The Microsoft TLD
Microsoft in fact did create a TLD called LOCAL. This TLD caused alot of problems for ICANN because they don’t have it in their root zone file and Microsoft machines use the TLD for many OS applications.
The same problems apply to the Chinese TLDs. The chinese Ministry of Industry root TLD system is the largest in operation today, next to ICANN. As a result of this the ICANN root servers are more then ever under attack by what they call bugus queries, which in fact are valid queries for TLDs the ICANN system does not see.
I wrote an article on the subject which explains this in detail:
They should of considered a root system at the time even though LOCAL always answers NXDOMAIN.
Non the less I agree Microsoft is BIG - really BIG. This means the .LOCAL TLD which has been coded into many OS will not in the near future be available to register at ICANN since it will never function properly due to the collission with Microsoft.
ICANN may be big - but if it does not co-ordinate the namespace and only hords it the net result is someday they will be irrelevant.
regards
Joe Baptista
I use the Mozilla browser, so I guess I’m another one of those for whom addresses using this proposed proprietary system aren’t accessible. Why go to browser and OS-specific addressing instead of a neutral, universal system? That would be a giant leap backward.
It’s not a giant step backward if your business model falls into either the “walled garden” or “world domination” categories. Remember - *you* have a certain vision of what “the net” should be. It’s probably similar to mine. It may even be similar to what some thinkers at some corporations wish would happen.
Unfortunately, at least in the US, corporations are basically legally obligated to do not What Is Right, but What Generates Stockholder Value. And the current investor climate in the US is *very* skewed towards short-term returns. So taking a giant step backwards because it will boost revenue by 17% for the next 12 quarters suddenly starts looking like a reasonable way to do things….