Slashdot Mirror

Look at http://free.tibet/

Yeah the difference is, 15 years ago we had no compelling content. While people did switch in some small percent, and could see http://free.tibet/ or http://watch.gallery/ it was more of an experiment than anything else.

TBB and Wikileaks might be the compelling content to give it critical mass though. We'll see.

Discussions are already underway.

Here's why it won't work. Note that alternative top level domains have been around for a *cough*decade*cough* while. And were making progress, that is, reasonable people, ISP's (earthlink) and companies (GE, etc...) used them. Not because they were cool or had new names, that was sort of icing, but because they were faster.

But, this didn't sit well with some folks; here's what they did.

Enter the "transparent" proxy cache.

In a true end to end internet you type, say, yahoo.com into the browser address bar, your computer looks up the IP address of it, then sends a web request to that IP.

If you used alternative DNS servers and had typed in, say, http://free.tibet/ then it would dutifully look up the name, and a web request to that IP and youd get the page rendered on your browser window.

Enter the "transparent" proxy cache.

It sits at your isp. It intercepts the web request for a website, does a DNS lookup - using the ISP's nameservers - then IF the name resoves does the web request and caches it. ISP's love this because it saves them outbound bandwidth. In many *cough*oversubscribed*cough*allofthem*cough* ISP's it makes the difference between reasonable performance and "uh, this is so slow it's not working".

But the problem is it ignored the fact your computer has already looked up the name and successfully got back an IP address. That doesn't matter. If it doesn't resolve in the proxy caches/ISPs dns, you won't see that page despite the fact - again, your computer was able to resolve it. And of course in this day and age a DNS lookup error is gonna give you a frigging yahoo searchg page - at least that's what my satellite connection does.

So, my computer can in fact resolve free.tibet. But because of all this tomfoolery (and frankly blatent disregard for end-to-end) I get yahoo instead. Yay.

The Russians can set up all the alternative root servers they want. But if your ISP has a "transparent" proxy cache, you're never going to be able to see them.

Plus there's the email issue. If the receiving mail server dosn's use the same alternative DNS as the sender, that mail is gonna bounce. Ask me how I know.

Of course other protocols like ftp and irc are immune. I can ftp to ftp://free.tibet all day long. It's just web and mail that won't work. Yes, this was done on purpose by staunch critics of alternative DNS.

You'd think this might be some sort of net.neutrality issue, no?

Here's why it won't work. Note that alternative top level domains have been around for a *cough*decade*cough* while. And were making progress, that is, reasonable people, ISP's (earthlink) and companies (GE, etc...) used them. Not because they were cool or had new names, that was sort of icing, but because they were faster.

But, this didn't sit well with some folks; here's what they did.

Enter the "transparent" proxy cache.

In a true end to end internet you type, say, yahoo.com into the browser address bar, your computer looks up the IP address of it, then sends a web request to that IP.

If you used alternative DNS servers and had typed in, say, http://free.tibet/ then it would dutifully look up the name, and a web request to that IP and youd get the page rendered on your browser window.

Enter the "transparent" proxy cache.

It sits at your isp. It intercepts the web request for a website, does a DNS lookup - using the ISP's nameservers - then IF the name resoves does the web request and caches it. ISP's love this because it saves them outbound bandwidth. In many *cough*oversubscribed*cough*allofthem*cough* ISP's it makes the difference between reasonable performance and "uh, this is so slow it's not working".

But the problem is it ignored the fact your computer has already looked up the name and successfully got back an IP address. That doesn't matter. If it doesn't resolve in the proxy caches/ISPs dns, you won't see that page despite the fact - again, your computer was able to resolve it. And of course in this day and age a DNS lookup error is gonna give you a frigging yahoo searchg page - at least that's what my satellite connection does.

So, my computer can in fact resolve free.tibet. But because of all this tomfoolery (and frankly blatent disregard for end-to-end) I get yahoo instead. Yay.

The Russians can set up all the alternative root servers they want. But if your ISP has a "transparent" proxy cache, you're never going to be able to see them.

Plus there's the email issue. If the receiving mail server dosn's use the same alternative DNS as the sender, that mail is gonna bounce. Ask me how I know.

Of course other protocols like ftp and irc are immune. I can ftp to ftp://free.tibet all day long. It's just web and mail that won't work. Yes, this was done on purpose by staunch critics of alternative DNS.

You'd think this might be some sort of net.neutrality issue, no?

Apart from a dog and pony show in Stockholm with some V6 blocks that nobody really uses, ICANN never allocated an IP address in it's life. You might be thinking of IANA (may he rest in peace)

The DoC has temporary custody of the legacy root servers because at the interagency domain name task force meetings, the DoC claimed to have all the answers. When the other 13 agencies (NSF, CIA, etc) stopped giggling, they said "ok, run with it".

To say "the US government controls the DNS" is factually incorrect. The US Department of commerce has control over the legacy root servers. That's very different. The sum of the DNS is controlled at the edges of the net by the people that have the root passwords to the namesevers that actually make the net work. If they were to all point to different root servers, the DoC would be in charge of 13 servers nobody used.

However, the notion of using root servers has always been IMO, a little silly. In the transition from the hosts.txt model to the decentralized DNS model, reliance on root servers to point to the tld servers for you is placing far too much faith on those 13 machine. Again IMO the proper way to do this is to secodnary the root zone - any root zone - ICANN's, ORSC's, what have you) thus saving you an intermediate step in looking up names. In other words, you won't need to hit the root servers to find the tld servers, your namesever will know where to find them itself. That same time and network bandwidth.

And of course if you secondary the ORSC root, you'll be able to see the entire Internet, not just the parts the DoC allows you to see.

Do you really think any government controlled domani agency would ever let you see http://free.tibet ?

That's the most profound effect your people can do for the least amount of effort. While I coordinate the ORSC root zone, I'd be happy to see you guys point to any of the alternatives (although obviously I think the ORSC one is better).

Start from there. The rest will come naturally.

http://support.open-rsc.org/How_To

http://free.tibet

rich@rd.sexton

Sincerely,
Richarde,
Webmaster http://www.dnso.com