RE: [nznog] so ... what is the real reason there is whois anyway?
-----Original Message----- From: Robert Gray [mailto:bob(a)brockhurst.co.nz] Sent: Friday, 1 October 2004 7:30 a.m. Keith Davidson wrote:
InternetNZ has already agreed to implement DNSSEC. Waiting for the resolution of the issue of "walking the zone" appears prudent.
The debate about "walking the zone" has centered on whether this is actually an issue, luminaries such as Joe Abley and Bill Manning have suggested that it is not. Others, well DPF, has suggested that it is. ----------------------------------- The debate is much wider than this. It amounts to whether or not a technical standard circumvents a wider policy issue relating to access to the zone file and WHOIS data. It is an international debate - although as far as .nz is concerned it is an issue of local Internet community concern. There is a tension between those concerned with the technical issues relating to the DNSSEC standard and those concerned with public policy issues - the problem plainly arises from a failure on the part of the standards setters to take the wider policy issues into account... Unfortunate, but certainly understandable. Whether .geek.nz should have a difference policy set from the other unmoderated .nz 2LDs was debated at the time it was established... The outcome has been well canvassed on this list and I will not repeat it. The policy relating to release of the .nz zone file has been recently reviewed and all received views taken into account. The zone file will be released at the discretion of the NZOC and (ultimately) InternetNZ Council provided that there is a clear public interest and the party concerned is prepared to sign up to strict usage criteria. Timing (not the principle) of DNSSEC implementation is also under constant review. All of these matters have been debated in public, there are no hidden agendas, the only concerns have been the best stewardship of .nz in the interests of all Internet users and, especially, those reliant on the .nz DN space According to Robert Gray: <quote>That the society wishes to ignore the views, however well informed, of a "handful of NZNOGers" speaks volumes about the need for industry membership of InternetNZ. Why pay money to be ignored when you can be ignored for free.</quote> To which the only response I can make is that democracy does have its downside for those who find themselves in the minority. ---- Frank March Chair, .nz Oversight committee _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://www.govt.nz - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Economic Development. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer.
On Fri, Oct 01, 2004 at 09:34:35AM +1200, Frank March wrote:
-----Original Message----- From: Robert Gray [mailto:bob(a)brockhurst.co.nz] Sent: Friday, 1 October 2004 7:30 a.m. Keith Davidson wrote:
InternetNZ has already agreed to implement DNSSEC. Waiting for the resolution of the issue of "walking the zone" appears prudent.
The debate about "walking the zone" has centered on whether this is actually an issue, luminaries such as Joe Abley and Bill Manning have suggested that it is not. Others, well DPF, has suggested that it is.
----------------------------------- The debate is much wider than this. It amounts to whether or not a technical standard circumvents a wider policy issue relating to access to the zone file and WHOIS data.
flattery will get you nowhere. :) First off, (to Mr Grey) I made no such suggestion. It is an issue, but the terms of reference are cloudy. Below is an attempt to clarify. the technical nits on zone enumeration vis usefulness to spammers boils down to one of degree. e.g. how much of the zone is needed to be useful to spammers and how current the data needs to be. spammers can and do use existing, well populated caching servers to harvest domains or will "slow-poll" authoritatve servers to build up their "client" lists. Coupling this database with the (unfortunate) IETF sactioned suite of role-accounts gives the perp a double opt-in database of active email addresses. No DNSSEC tricks needed. To protect against caching server pollution, DNSSEC will ensure you are given back, in your DNSSEC-enabled query, the name of the NEXT lable in the zone. This can be exploited to enable "speed-walking" the zone. Trade off is cache server pollution (injection of false records) vs. the potential of "speed-walking" the zone. Again, a question of degree. Remember that the technical standard (DNS) allows for enumeration, be it partial or full, by using single queries - and no overt, "wider" policy issues can overlook that with impunity. the fine points of "bulk" access, via FTP or AXFR, are well defined in policies; no problems there. Whois data is almost orthoginal. If it is released, no amount of DNS "hiding" will help. The current debate rages around the speed of which one can query the DNS to build up a copy of the zone data.... again, a question of degree. i hope this will be my last word on this topic in this venue.
Frank March Chair, .nz Oversight committee
_______________________________________________
participants (2)
-
bmanning＠vacation.karoshi.com -
Frank March