Slashdot Mirror

Given these recent outrageous and blatant violations by registrars, and the indifference of ICANN, this should be a perfect time to resurrect the idea of an alternate system of root DNS servers.

If nothing is done to address the problems, the .com, .net domain name space would probably be filled up with spam junk (if they are not saturated with crap already). Given the increasing importance of the Internet infrastructure these days, it's outrageous to think that the basic infrastructure of the Internet is held hostage by a small group of greedy corporate bastards. Remember the last time Verisign tried to redirect all non-existent .com/.net requests to their own portal site? They are willing to screw up anything as long as they can get away with it (and money).

I understand that the worst TLDs in question are .com and .net, but they set the example. How long would it be for country TLDs to follow the corporate footsteps of Verisign, Network Solutions and co?

I think it should be most apt to start meaningful discussion here on Slashdot, where there are enough people who have the expertise and skills --- and interest and passion, to pull this one off.

I have looked around a bit regarding projects such as AlterNIC, OpenNIC, OpenRSC, etc. But all those projects are dead or at the very least in deep hibernation. I have a feeling that the projects aren't really meant to be serious, rather they are hobbyist projects/social experiments that even the founders couldn't care less about.

Does nobody care at all?

That being said, I personally don't have any concrete proposals. But given the enthusiastic response of Slashdot readers (there are 600+ comments here), I believe we can gather enough personnel and expertise to give the old idea a new try. Interested parties might want to post a reply here, or in my Journal.

Any takers?

[Oh and moderators, you might actually want to mod this one up...]

it redirects to a "Scam Blocked" page...

If you don't like the Cox DNS results, feel free to put another DNS server in your router or computer. Switch from dynamic DNS to static DNS and use some of the public DNS servers.

Here is a good place to start..
http://www.opennic.unrated.net/public_servers.html

Forget ICANN, use OpenNIC, the Democratic Name System.

http://www.opennic.unrated.net/

Generally, all you need to do to use them is convince your computer to use one of their DNS server instead of the one provided by your ISP. Or better yet, convince your ISP to use their DNS in addition to ICANN's.

I wonder what it'd take to develop a new registry for domain names. Just something to get us away from the current set of registrars and their ilk.

Check out OpenNIC. They've got a whole scheme of new TLD's and a system to register names within their TLD's.

They're not perfect. Instead of fighting when ICANN usurped their .biz TLD, the basically rolled over. However the fact that they're still around means there is support for a non-ICANN system. They just need to learn to stand up to ICANN and we'll have a real alternative.

What about OpenNIC? They're an entirely separate root DNS system that still resolves all the standard ICANN stuff as well.

oops wrong link....

http://www.opennic.unrated.net/ opennic is one of them that is still around... AlterNIC was in existance before that...

Already tried and done.

You mean operate an alternative or parallel root name servers like http://www.opennic.unrated.net/ :-)

They have easy instructions on how to configure your DNS to coperate with their servers

OpenDNS != OpenNIC

Are you sure you're not thinking of OpenNIC? I also tried to use them once but had many problems and didn't really like the seemingly endless supply of pointless top level domains.

http://www.opennic.unrated.net/public_servers.html

Don't rely on your ISP's DNS.

Lots of times my ISP's DNS has gone down and opennic has saved the day. Of course, they can go down too, but usually ONE of the two work.

Would it happen to be bell dsl? Mine is and their dns sucks some serious ass

I use dnsmasq running on a linux server and some public dns servers

works like a charm

And the Bush Administration has just what to do with the root DNS servers?

You do know that is what this is all about, right. A distributed database that is is *impossible* for anybody to "control". Not even all the root servers are in the US. And those that are are ran by volunteers, most of whom likely disllke Bush and his policies as much as you and I do. They only really listen to ICANN as a courtesy. ICANN certainly has no right to tell them what to do. And you are free to point at other root servers. I do.

Simply put people continue to use the current system because it works and fits their needs and wants. If they ever did do anything really evil people like you would whine about it while people like myself would route around it like the damage it is and then make it possible for the rest of you to do so.

So please I beg you point to or explain in some way how anybody "controls the Internet". It is simply put, impossible to do so. God are we really at the point in space/time where someond reading and posting to /. doesn't know how DNS works?

How much power does ICANN really have, though? Right now everybody listens to them, but I see no reason why people couldn't just set up their own organizations that performed the same functions, and use these instead. Of course, if they all moved in different directions, there would be big chaos, but as long as they all agreed with ICANN, the Internet would continue to work, right? And then, if ICANN ever took decisions that many disagreed with, people could just rely on these alternatives and bypass ICANN, right?

I know that such a movement already exists in the DNS world (see, for example, OpenNIC).

So, while I resent that one organization - worse, a corporation - has so much power over the Internet, I don't think it's as big a problem as it could be.

I guess I haven't seen a convincing argument either way.

Eventually, there will be some level of shared governance by an independent, multi-national group. The make up of that group is up in the air, will it be headed by jurists, executives, or administrators? Will we need to set up a multinational to deal with these issues, or can they be handled by an existing body like the WTO or the UN? Ultimately, this isn't an issue of the US saying "No, we won't relinquish control." If that does happen, we may see the internet fragment into many pieces.

In the mean time, anyone is free to use an alternate Root DNS or create a separate Root DNS: http://www.opennic.unrated.net/

In theory, there is nothing stopping them from deciding that France should have backed them in the Iraq war, pointing the .fr SOA record at their own server, and redirecting all traffic for .gov.fr IPs via their own service.

If that came to pass, there is nothing stopping France from setting up their own alternate root servers. Or the UN from doing the same.

It would be a shame to see the Internet balkanized like that, though.

Wikipedia - Alternative DNS root
OpenNIC

I think the point of the grandparent was that anyone can offer or use an alternative dns system. Such systems already exist. Most of them can easily copy a lot of the IP addresses and names from the current system.
And if some governments unite and offer their own dns system, and tell their ISP do use it , then this dns system will be a main one.
http://en.wikipedia.org/wiki/Alternative_DNS_root
http://european.nl.orsn.net/
http://www.opennic.unrated.net/

If Slash users don't like ICANN or the UN, why not start an alternative DNS?

And I think I know why.

In spite of its virtues -- in spite of the fact that it seems to embody the very ideals that most individuals seem to hold -- OpenNIC isn't very popular.

The reason OpenNIC isn't popular, is that most peoples' nearests resolvers don't use it. Most people don't want to set up BIND (or its competitors). So they're going to use someone else's resolver, which will almost always be their ISP's machine. Thus, they defer the decision to someone else. ("If you choose not to decide, you still have made a choice." -- Rush)

The UN doesn't want to repeat this unpopularity. They're probably willing to leave it to the market or democracy, but only if they are guaranteed to receive the default vote. They don't want to be an "alternative root", they want to be "the" root, and let ICANN, OpenNIC, etc be "alternatives." And the only way to do that is to sieze control of the hosts that are already entered into everyone's BIND config files. There are a handful of specific addresses that they want to take over.

What I haven't figured out, is why ISPs still use ICANN's root. The big ones (e.g. Comcast), I understand: they have an interest in teaching people to just leave everything important to the megacorps. Being a Comcast customer is all about sucking the corporate teat. But as for the small ones, the universities, etc, I don't get it. I expect that the admins of these networks are educated enough about DNS that they understand the issue, so why do they still choose ICANN?

Time for the internet to declare it's independance!

Let's have a Boston DNS party!

Tell the US & UN to get stuffed!

Use the OpenNIC which has been superseeding ICANN for years.

They require the www prefix: www.opennic.unrated.net.

A confederation of disgruntled DNS servers, of which OpenNIC is one, has been running an alternative namespace to ICANN for a long time now. Looks like opennic.org and opennic.net have been taken over by evil cybersquatters in the ICANN namespace -- but point to opennic.unrated.net and expand your DNS horizon...

How likely are you to switch your DNS over to a new, untested root server system?

I think it really comes down to the old question, "What if they held a war, and nobody came?", except that in this case, the question will be, "What if they propose a new set of root servers, and nobody used them?"

You mean them? http://www.opennic.unrated.net/

Don't get me wrong, something (food from the UN) is better than nothing (dead people). But is something else (UN regulating Internet) better than what he have now (US overseeing TLDs and no issues).

Besides, if you really want to do things your way there's always http://www.open-rsc.org/, or http://www.opennic.unrated.net/. Ironically http://www.open-rsc.org/ is down right now.

As far as starving people, genocide, and mines; eliminate the problem... The warlords and dictators who create this crap. This myth of unfair trade and economics (ala live8) is bull... I'd say more, but off topic.

As Ive said before, this is completely unneeded, as there are already alternative DNS roots.

Maybe now's the time to give serious consideration to long-standing alternative root servers like OpenNIC. And the only way alternative roots will catch on is if individuals fed up with the greedy ways of domain registrars demand that their ISPs allow them port 53 access (or better yet, also include the alternative root zones with the ISP nameserver's own root zones).

How about using something that already exists, like opennic?

It is a currently running, non-profit organization that provides its own set of root DNS servers. They resolve all of the official domains(with the exception of .biz, because there is a dispute over it), and several others, like .oss (open source software).

Sorry, make that http://www.opennic.unrated.net/ - this should teach me to check links before posting them.

Maybe use another DNS server. OpenNIC has several around the world, so unless your ISP is throttling/proxying *all* DNS traffic, you should be fine.

It's generally a good idea to not rely on your ISP's DNS servers too much. Personally, I just use an OpenNIC server, with one of my ISP's servers as a fallback - that way, I don't get any of the occasional timeouts, failures of new records to propagate properly and all that. Really, ISPs should focus on providing the connection, nothing more. I don't use my ISP's mail servers for email, and I don't use their nntp servers for Usenet; why should I use their name servers for DNS requests?

It took me a while to figure out the real reason they're going after the .net domain. It is not just b/c the contract up for renewal. If you hop on over to OpenNICYou'll see that all of their important domains also have a .net domain in case you're not using one of their servers yet. Now will the folks at OpenNIC have the resources to renew all of their domains with this extra fee? At the very least it will drain their resources off. ICANN is doing this to kill off any competition. ICANN must be stopped!

please forgive my ignorance, but what does icann do?

You're forgiven. :)

Okay, here's how it works. You know how the tech community likes to tell newbies that nobody controls the Internet? Well, that's not entirely true. At the time the Internet was founded, peer-to-peer was nowhere near as sophisticated as it is today, so you needed somebody to keep all the important information about computers on the Internet, to prevent it from melting into anarchy.

Various organizations (and in particular, Jon Postel) had different sets of these responsibilities until 1998, when ICANN was founded. ICANN is a non-profit corporation with a U.S. government contract. They are responsible for assigning IP addresses (so there's no duplication), running the DNS system (so mere mortals can get to Slashdot without having to memorize IP addresses) and other more mundane tasks specified in various RFCs, such as tracking well-known port numbers and MIME types.

So, ICANN and its subsidiaries basically represent a government-sanctioned monopoly, like the phone company used to be. Other companies and non-profit organizations occasionally try to create alternative DNS services, such as OpenNIC, but they don't usually get very far because ICANN, in its official capacity, squishes them like bugs.

I may be hazy on the details, but I think this is accurate enough to get you started on your own research.

Yeah, I'm off topic, but any story about ICANN's nonsense is a good place to post a link to OpenNIC.

Well, time to wake up then and look at OpenNIC's TLDs, which do include .geek. Unfortunately, OpenNIC doesn't seem to be working that well at the moment, so maybe you can go back to sleep after all.

I think Opennic should play especially well here, where they eagerly advertises it's .geek and .oss TLDs on the header of their home page.

All it'd take is a /. giving up on their ".com" and ".org" and advertising themselves as "slashdot.geek at opennic", and I bet a bunch of us would switch overnight. Enough IT guys switch, and then who cares about all those .Com[mercial] groups anyway.

Like OpenNIC then?

One thing that confuses me a little is why TLD's need to be restricted in the first place. If anyone was (easily and accessibly) able to create their own TLD and sell (or give away) names underneath them on their own terms, it would reduce the motivation for businesses to go and snap up every single variation of their name under every TLD.

Presumably the people or businesses who snap up the better TLD's and run them more reliably will simply get more people wanting to use them to index their servers on the net. Meanwhile everyone else would still be able to run their thousands of other TLD's under their own terms.

There are already alternative domain registries that do things this way (eg. OpenDNS), but they're immediately disadvantaged because nobody who matters uses their name servers.

I'm not an expert on DNS. Is there some overriding technical reason these days why TLD's need to be restricted to a small and controlled minority? Or is it something else?

Like I mentioned in the prior discussion on this, just because you have a .mail TLD won't stop spammers. TLDs are in DNS, and in the final analysis, it's all arbitrary, as you can use ANY word as a top level domain. That's why you have alternate roots like OpenNIC.

I've been experimenting with alternative roots over the past couple of months.

The OpenNIC root zone file seems pretty stable, and resolves ICANN domains along with opennic's own .geek, .oss, .parody, .indy, .null, and .opennic . AlterNIC and Pacific Root alternate roots seem to be long gone - I haven't been able to find any current information on these alternate roots, and I have yet to come across a root zone file that allows resolution of any of their names (anybody know?).

I tried the ORSC root zone file, which is FAR more extensive, but it seems to be out of date - I couldn't even resolve some ICANN domains with it!

It seems that the YouCANN and ORSC web sites are possibly horribly out of date - can anyone verify that these projects are even active?

Now for a little editorial criticism: I don't see any indication in the article that ICANN is considering "incorporating" alternative TLDs as much as it's considering bulldozing over them, like it has for .biz . The submitter's take that ICANN roots may soon start resolving these independent root operators is either woefully mistaken or badly misleading.

I've been experimenting with alternative roots over the past couple of months.

The OpenNIC root zone file seems pretty stable, and resolves ICANN domains along with opennic's own .geek, .oss, .parody, .indy, .null, and .opennic . AlterNIC and Pacific Root alternate roots seem to be long gone - I haven't been able to find any current information on these alternate roots, and I have yet to come across a root zone file that allows resolution of any of their names (anybody know?).

I tried the ORSC root zone file, which is FAR more extensive, but it seems to be out of date - I couldn't even resolve some ICANN domains with it!

It seems that the YouCANN and ORSC web sites are possibly horribly out of date - can anyone verify that these projects are even active?

Now for a little editorial criticism: I don't see any indication in the article that ICANN is considering "incorporating" alternative TLDs as much as it's considering bulldozing over them, like it has for .biz . The submitter's take that ICANN roots may soon start resolving these independent root operators is either woefully mistaken or badly misleading.

It has set up a specific TLD (.NULL) for "completely non-commercial and only natural persons (lawyer-speak for "no corporations; actual physical people only") may hold .null subdomains, As a non-commercial domain, .null subdomains may not be transferred for compensation."

Frankly, they deserve to have all authority over the root servers taken away from them before they do more harm in their quest for profits.

a lot of people don't know this but verisign's root server isn't the only game in town, these root servers offer many alternatives. If enough people make an end run arround their monoply, their authority will diminish as well as any brazen behavior. If you need instructions on how to do this OpenNIC has detailed instructions.

As i stated in the past the only reason verisign, ICANN or anyone else has DNS power is because everyone agrees to use their standard.. well.. not everybody ;) there is a choice in the matter anyone who wants to run a DNS server can do so and can map domains to whatever IP address they like... it's just that issuing conflicting domain names on different servers benifits nobody and makes things worse for everyone

Back in the good old days when her serene highness the Dalai Lauren worked there and Dave Holtzman was still VP I took the e-ticket tour. The facility is in a nondescript industrial mall a few miles from the NSI mothership.

"oh, you'll want to see this"

"what is it"

"A-ROOT"

"THAT tiny little thing?"

"Yup. Go ahead and touch it, everybody that comes here wants to do that. See where the paint has worn off the case?".

"Uh, ok"

"You use this thing Dave"

"Nah, I download the root zone from you".

"Cool, for that you can buy me lunch".

"Good idea. Thai okay?"

NSI was fun once and there's lots of good stories. When the FNCAC made the NSF tell NSI to start charging for domain names none of the freaks working at NSI could believe you could charge for this and lots of checks were just pinned up to a bulletin board in a "wait and see" holding pattern for a few months. There weren't so many domains back then.

Karl Aurbach also downloads the root zone from me and you should too. Or use OpenNIC's root or even *cough*ICANNs*cough* (ftp://internic.net/domain/root.zone.gz, or any root.zone you want but if you know what's good for you you won't rely any anybody but yourself to serve up the root zone so your computer can find pointers to the various TLD servers: primary the root for yourself and don't worry about DOS attacks on other peoples computers taking your machine off the air.

That really was the dumbest part of the change from hosts.txt to the DNS - it changed the paradigm from your computer knowing where everything was to making your computer rely on the "." zone to be able to find the computers that know where all names can be found and there's really no reason for it.

Certainly it does not scale for everybody to grab a copy of the root from one place, and Dan Bernstein has suggested a cryptographically signed root be distributed via usenet. To this end I've created news:alt.root.orsc and will begin doing just that this quarter.

is available at his blog on O'Reilly. It points out that there is supposed to be no organization with power over the internet and that ICANN has always claimed just to be a sort of "technical facilitator". It mentions the Open Root Server Coalition and although it doesn't mention the OpenNIC guys, it's worth having a look at their more serious project.

I notice a lot of fighting in the comments about whether the UN sucks or not and whether they're worse than ICANN. Simple fact of the matter is that neither of these bodies (or any body that isn't truly democratic) should have any control over OUR internet. Fighting over which master we bow to is a bit ridiculous.

ICANN is a pain in da butt, and from what I recall is becoming more so with the outing of the "netizen representatives". *sigh* These tie wearing techno-nitwits are going to screw the system up good. ICANN, UN, whatever. If it is not built and run by geeks (read: technologically proficient) I have little faith that anything good will come of it, which brings me to the point.

OpenNIC is a geek run DNS system. Just change your DNS servers to point at theirs and go, or if you are a little more gung ho get your ISP to run a tier3 DNS server. Will resolve OpenNIC and ICANN domains and is transparent to the end user.

It is also a fully democratic system with the OpenNIC members voting on new domain TLD's and membership is open to all not just MegaCorps. Jump over and take a look, I think their success will be a good thing(tm).

The only thing I noticed was that NTL's DNS servers stopped working.

I switched to the OpenNIC DNS server and it all works fine, with a little more lag, but nothing serious.

If nobody really owns the internet, how does one own the internet? I mean, that's why I joined up with OpenNIC earlier this year - is because nobody ever really owned the network.

Check out OpenNIC, a democratic and open approach to the whole DNS problem.

They seem much closer to being in line with the methodology the Internet has used to prosper than Verisign/ICANN are.