- NZNOG - lists.nznog.org

Re: [registry-discuss] Zone transfers from .nz name servers
by david＠farrar.com 30 May '99

30 May '99

On Thu, 27 May 1999 11:36:22 +1200, Peter Mott wrote: >> I'd say that ISOCNZ did consult industry and are in the process of doing >> so. Some weeks ago the ISOCNZ technical committee, John Vorstermans, >> Mark Davies and Roger De Salis talked to Joe Abley and myself. If they >> didn't talk with Peter that doesn't mean they didn't talk with industry. > >We have a different view on what consultation is. FWIW in hindsight I believe there would have been merit in posting something on say nznog asking for feedback. Perhaps one of the things we can look at is"recognising" nznog as something which should form part of a consultation process on relevant issues. Of course nznog may not want this and might prefer say isocnz-l or isocnz-announce is used for all consultations on these sort of issues. I'll forward this post to nznog (not cross-post) for their interest. But having recognised consultation could be better, let me say nothing is cast in stone. ISOCNZ Council agreed to stop the situation where anyone at all could do zone transfers, but also recognised that certain people or groups would have legitimate grounds for access. Now that leaves enough flexibility to have a very liberal or very tight "access" policy. You have most of the ISOCNZ Technical Cmte on this list and I'm sure that if there is a widespread consensus on what is desirable, agreement can be reached. A point I'll make is ISOCNZ does have some obligations in terms of legal responsibilities as "custodian" which have to be considered. > > I have since been seconded onto ISOCNZ council to fill the vacancy left >> by Peter Mott's resignation and am now on that committee. The tech >> committee have the task of looking at closing of the zone transfer >> holes. This is not cast in stone and could be changed if valid reasons >> can be produced. > > David Farrer said a decision had already been made to disallow XFRS. Can >we get the story straight please? The decision was to stop anyone at all doing transfers. I don't think there is much disagreement that an open slather let anyone grab it and possibly spam with it scenario is desirable to continue. It was recognised some people would still have a need to do transfers. As for how stringent or liberal the policy is, could I pose a number of policy scenarios which may help people focus on what they consider desirable. Now I am not great on all the technical side so I hope I have captured this correctly. a) Status Quo - where anyone at all can do a transfer with no restriction b) No automatic transfers are possible but any *.nz name holder can ask for a zone transfer as long as they promise not to spam. Of course they may give it to others who do with no way to check this. c) Any NZ ISP (and how do we define that) may get a copy of the zone data. Perhaps with an agreement not to spam, on sell etc d) No automatic right of access but any person or group can ask for access, specifying the intended purpose of the data. DOMAINZ to decide which requests are accepted based on criteria set by ISOCNZ (which could come from this group). Note any info about why it is wanted which is given to DOMAINZ would be confidential and not to be publicised e) No access at all except to secondaries (ie those who *need* rather than *want* it Now I'm sure there are many more combinations but hopefully that gets much of it. Feedback on which option is desirable is welcome. Someone raised why ISOCNZ is involved at all. Well simply ISOCNZ has the *duty* on behalf of the Internet Community to be the custodian (for lack of a better word) of the *.nz DNS and associated data. As part of that role it does need to consider implications of what it does with the data. We do have a Privacy Act which few other countries have and we do need to be careful that if ever challenged on what our policies are to do with data we have collected, we can demonstrate that issues have been thought through in a considered manner. I realise the zone data itself may not be relevant to the privacy act, but that it *unlocks* other data may be an issue. Who knows at some stage we may have to spend some money on a legal opinion on our obligations. Speaking for me personally I have no firm view on how liberal or stringent access to the zone files should be (except I strongly support removing open slather access) and am inclined to be supportive of any consensus position reached by a group representative of the industry. DPF --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Anyone running mail on Solaris 2.6 with tcp timestamps tunerd on?
by Chris Wedgwood 27 May '99

27 May '99

Is there anyone out there running using Solaris 2.6 with tcp timestamps turned on for mail? If so, would they mind letting me hit them with some test messages, maybe a hundred or so short messages? I'm trying to track down some funnies and want to be sure of things before I start blaming Solaris again :) -Chris --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [registry-discuss] Zone transfers from .nz name servers
by Andy Linton 27 May '99

27 May '99

2Day Chief Enthusiast wrote: > > >I haven't yet got the draft minutes but my recollection of the ISOCNZ > >Council meeting on Friday is that the consensus was to do exactly that > >- for reasons of both privacy act considerations and anti-spamming. > > Yet another example of ISOCNZ making decisions without consulting industry. > Extremely bad form. I'd say that ISOCNZ did consult industry and are in the process of doing so. Some weeks ago the ISOCNZ technical committee, John Vorstermans, Mark Davies and Roger De Salis talked to Joe Abley and myself. If they didn't talk with Peter that doesn't mean they didn't talk with industry. I have since been seconded onto ISOCNZ council to fill the vacancy left by Peter Mott's resignation and am now on that committee. The tech committee have the task of looking at closing of the zone transfer holes. This is not cast in stone and could be changed if valid reasons can be produced. I'd also note some data points: 1) The root nameservers have had open transfers turned off. 2) The Domainz RFI for the management of the DNS indicates that in the near future the primary and secondary servers will be operated by Domainz. The organisations that host the secondary servers will not have administrative control over them so Joe's recent example where Clear and Xtra currently have access to the zone file data will not hold in the future. 3) Mark Davies' web pages which list the NZ domain names will disappear in their current form. I'd like people to put their cards on the table and say why they want access to the complete zone files. That would help us understand if there are valid reasons for leaving the transfers open. I also believe this discussion belongs on the NZNOG list. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 6

International Internet changing regimes
by Frank March 27 May '99

27 May '99

A further note on developments in this very occasional series. I have available a copy of the report of a meeting of the Rapporteur Group on International Network Cost Components for the Internet (part of the ITU, and published in the ITU Telecommunications Standardisation Sector newsletter COM 3-R 17-E March 1999). There seems to be some overlap in membership between this group and the APEC TEL activities. The meeting was in Sydney 22,23 September 1998 and covers work by a study group with the following terms of reference: -identify the international network components for the Internet which reside within the GII framework; -determine cost issues; and -if considered appropriate, to propose a set of principles on the equitable cost compensation between international circuit providers. The group notes that "it is not, at this time, in a position to propose a preferred set of principles" and further work is proposed. I will fax a copy (11 pages) to anyone sending me a number. Frank March Specialist Advisor, IT Policy Group Ministry of Commerce, PO Box 1473, Wellington Telephone (+64 4) 474 2908; Fax (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ICANN document of interest
by Andy Linton 27 May '99

27 May '99

http://www.icann.org/tld-deleg-prac.html NEW: Statement of IANA TLD Delegation Practices IMPORTANT NOTICE. The following document is being posted for the information of the Internet community. It contains a statement of the current policies being followed by the Internet Assigned Numbers Authority (IANA) in administering delegations of Top Level Domain Names of the Internet Domain Names System (DNS). At a future date, the ICANN Board may consider changes to these policies and will, at such time, notice proposed changes for public comment in accordance with the ICANN Bylaws. Comments on this document are welcome and should be directed to comments(a)icann.org. -- Mailto:asjl(a)netlink.net.nz Post: Netlink, PO Box 5358, Lambton Quay, Wellington, New Zealand -- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[Fwd: Delivery failure (registry-discuss@2day.com)]
by Andy Linton 26 May '99

26 May '99

> Subject: Re: [registry-discuss] Zone transfers from .nz name servers > Date: Thu, 27 May 1999 04:13:40 +0000 > From: Andy Linton <asjl(a)netlink.net.nz> > Organization: Netlink, Wellington > To: registry-discuss(a)2day.com > > 2Day Chief Enthusiast wrote: > > > > > I'd say that ISOCNZ did consult industry and are in the process of doing > > > so. Some weeks ago the ISOCNZ technical committee, John Vorstermans, > > > Mark Davies and Roger De Salis talked to Joe Abley and myself. If they > > > didn't talk with Peter that doesn't mean they didn't talk with industry. > > > > We have a different view on what consultation is. > > Just because you aren't included in a discussion, it doesn't mean there > hasn't been one. > > > > > > I have since been seconded onto ISOCNZ council to fill the vacancy left > > > by Peter Mott's resignation and am now on that committee. The tech > > > committee have the task of looking at closing of the zone transfer > > > holes. This is not cast in stone and could be changed if valid reasons > > > can be produced. > > > > David Farrer said a decision had already been made to disallow XFRS. Can > > we get the story straight please? > > > > Read my posting - I'm asking for reasons why this should be changed and > all I'm hearing is whinging about how unreponsive ISCONZ are. > > > p.s. If you took up my vacancy, you would be on the education and research > > subcommittee. > > Nope! I'm on the commitee that's most appropriate for my background and > experience. -- Mailto:asjl(a)netlink.net.nz Post: Netlink, PO Box 5358, Lambton Quay, Wellington, New Zealand -- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Re: Zone transfers from .nz name servers
by Robert Gray 26 May '99

26 May '99

>I'm still waiting for a reasoned argument from Peter about this issue. I've spoken to Peter about the zone transfers and he has told me why he wants the ability to do them. I would like to say that: a) the use he makes of it (IMHO) breaches no privacy nor has any other concern and b) it _is_ commercially sensitive - I certainly would not tell too many people unless I wanted competition. There's a conundrum then. Robert Gray Clearview Communications, Auckland New Zealand bobg(a)clearview.co.nz http://www.clearview.co.nz/ Phone DDI +64 9 529 5704, Fax +64 9 529 5702, Mob +64 25 971 860 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Restricting axfr's from ns99.waikato.ac.nz
by Chris Wedgwood 26 May '99

26 May '99

Without wishing to step into the flames, has anyone considered it may already be too _late_ to stop people form generating a list of all .nz domains? Right now, I'm sure plenty of people have copies on the .nz zone files (for various reasons), and they probably update these fairly often. Even if this information is made unavailable to the public at large, people can just check (daily) the Domainz Pending Activity page and produce deltas from that... I just verified that this is indeed possible with a little script that took no more than 5 minutes or so to get going... -cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Fw: Welcome
by Andy Linton 26 May '99

26 May '99

2Day Operations wrote: > > Date: Thursday, 27 May 1999 11:29 > Subject: Welcome > > >Welcome to the registry-discuss list provided by 2Day Internet Ltd > > > >PURPOSE > > > >This list is provided for discussion of commercial and > >technical issues associated with changes to the .nz > >domain name registration service advised by DOMAINZ on > >Tuesday 18 May 1999. > > > >INVITATION > > > >Any person or organisation with a commercial interest > >in this topic is invited to participate. > > > >ACCEPTABLE USE POLICY > > > >Without wishing to restrict the free flow of ideas and > >information, the list owner (2Day Internet Limited) > >requires that:- > > > > > >a) Messages posted to this list are NOT posted to any > > other list or news group at the same time. > > Looks like I'm breach of Peter's acceptable use policy so I'd better be unsubscribed from 'registry-discuss' I'll be talking about this on the NZNOG list from now on. Join me there if you want a list where who you post to is not dictated to by the list owner. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[Fwd: [registry-discuss] Zone transfers from .nz name servers]
by Roger De Salis 26 May '99

26 May '99

2Day Chief Enthusiast wrote: |> |> >I haven't yet got the draft minutes but my recollection of the |> >ISOCNZ Council meeting on Friday is that the consensus was to |> > do exactly that |> >- for reasons of both privacy act considerations and anti-spamming. |> |> Yet another example of ISOCNZ making decisions without consulting |> industry. Extremely bad form. | | I'd say that ISOCNZ did consult industry and are in the process of doing | so. Some weeks ago the ISOCNZ technical committee, John Vorstermans, | Mark Davies and Roger De Salis talked to Joe Abley and myself. If they | didn't talk with Peter that doesn't mean they didn't talk with industry. ===================================================================== Exactly 10 days ago, I did send out an email to the ISOCNZ council, plus Andy and Joe, with proposal to possibly restrict zone transfers. The sequence was:- 1/ Put an inital proposal to the council plus others to ensure that the technical proposal was sound, and find out if there were i) raving objections, ii) muted dissent iii) muted assent iv) other. 2/ Post the corrected proposal to the NOG for comment. 3/ Assemble and Post feedback to the NOG, and come to a acceptable consensus. Unfortunately real work interfered with this timetable. This email represents step 2. The proposal was informally discussed at the last council meeting, which I was not able to fully attend. Here is the proposal in full, as it was sent out earlier. I remind interested parties that this is a PROPOSAL. Thoughtful comment, dissent and wisely worded counter propoosals will all be thoroughly considered. Here is the proposal as originally sent out. ======================================================================== PROPOSAL:- The caretaker of the registry has been concerned for sometime about the ability to do a complete download of the zone files, and then trawl them for useful information. Typically why people do this is to keep score, and we have no evidence that people have used this information for malicious purposes thus far. But the information does contain personal information, which it must do to permit network operators to rightfully go about their business, and brilliant efforts to keep the internet running. It also potentially offers plenty of SPAM potential. If whole downloads were restricted, but reasonable queries of a moderate length we allowed, and a working who-is was on line, and there was an ability to run reasonable global queries (eg no of domains by provider etc etc), is a restriction on possible global downloads reasonable. A positive suggestion here is that global downloads continue to be permitted, but the receiver must authenticate themselves, so reasonable use can be estimated. A parallel example is Cisco's shipping database. You have query access (via login) to any information, but you need a valid number to be able to extract the single event. There is no way to get the whole of shipping details at that second. But in theory it is all there. The proposal is therefore to propose some minor technical changes with an eye on the Privacy requirements, but ensure that sufficiently useful access and information exists to permit the nog to do their job. I would be most interested to collect opinions about positive technical suggestions, leave it the way it is, or make these suggested changes. Rgds Roger De Salis ====================================================== Joe's comments came back as:- (and appear to me to be eminently reasonable. I hope he will not mind me re-publishing.) For the record, it's only ns99 and rata that currently permit zone transfers; none of the others do. A good compromise might be to restrict zone transfers from ns99 to "all authoritative servers plus authorised hosts" to allow people like Peter to continue to pull the data, without having to mess about with ftp. Domainz could authorise hosts as they saw fit (I would expect the authorisation policy to be fairly non-restrictive). The driver for doing this, remember, is to prevent the unscrupulous walking the DNS, enumerating domain names for the purposes of evil spam; it's not to stop record harvesting for the purposes of generating statistics. This is just for ns99 -- I would expect other authoritative servers to deny transfers from _anybody_. Maintaining a current transfer access list on every secondary is unnecessary. Being overly restrictive on this issue could be problematic anyway; for example CLEAR and Xtra have access to the zone files since they operate authoritative nameservers for the benefit of the community. It would be bizarre if other providers were denied access to the same information simply because they're small (or focused on niche services). Joe ================================================================ -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L3, 117 Customhouse Qy /) +64 4 473 4912 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` Never underestimate the data transmission capacity (Mb/s) of a station wagon full of the backup tapes.

4 6