Slashdot Mirror
Fort N.O.C.'s Security in Obscurity
penciling_in writes "Brock N. Meeks of MSNBC reports
on his recent visit to VeriSign's secret location: 'The unassuming building
that houses the "A" root sits in a cluster of three others; the architecture
looks as if it were lifted directly from a free clip art library. No signs or
markers give a hint that the Internet's most precious computer is inside
humming happily away in a hermetically sealed room. This building complex could
be any of a 100,000 mini office parks littering middle class America.' The
report goes on to say: 'Access to the Network Operations Center, the "NORAD"
of the Internet's traffic monitoring, requires the electronic badge and then a
double biometric hand print scan.' And here are Karl
Auerbach and Robert
Alberti offering their interesting analysis of this report on CircleID."
Sure, the
I'm still fuming about that.
Trolling is a art,
so .. if i (being a researcher and a nerd) was annoyed by this so called internet interruption .. i would also like to know "who" "we" should sue.
This could actually be dangerous. Whenever I hide something I seem to inevitably lose it...
Isn't this "secret location" in Palo Alto? Seems to me there are probably thousands of people (e.g. telco employees) that know where it is...
Although the article says that the location is a secret, a link from the article to www.root-servers.org happily tells you that server A is in Dulles.
I can't imagine having all my domain requests going to Slashdot.org......I'd have sensory overload!
It's either on the beat or off the beat, it's that easy.
I moderate therefore I rule!
--
Sigh. Deep Sigh.
There's more than the 'A' root server. Taking "it" down leaves a whole hurd of other root servers alive. Located all around the world.
The above linked articles are full of that which promoteth growth.
This is also the building that has the big red button labeled "Hijack Internet Traffic"
One bad monkey spoils the whole barrel.
It's cool to see someone write about the building you used to work in! I worked in this building, a bit more than 2 years ago. I was in Network Solutions' consulting arm, whose DC office was in that building, two floors under the NOC. The security really is as spectacular (and low-key) as you'd expect. You would NOT believe the camera surveillance they have facing outwards...you can see some of it, but you can't see some of them at all. And the cameras themselves are startlingly cool...there's a small strip mall across a major highway from the facility, with a clear line of sight. One of the security guys showed me how far the zoom worked, as he zoomed in on a guy smoking in front of a bookstore in the strip mall...about half a mile away. It was still a clear picture.
When 9/11 happened, we were not allowed back into the building for a couple of days, but all they had to stand up as barriers were road cones. Luckily, they're finally moving to a location that isn't just obscure and secure, but armored, as I hear their Mountain View, CA location is.
For your security, this post has been encrypted with ROT-13, twice.
Are we talking about the .com/.net verisign DNS or the main root DNS. DNS is distributed. If one goes down, there are more to take its place. With the root DNS (gtld-servers.net), there are many servers located in many different places. It would be impossible to bring them all down. If we're talking about the .com/.net DNS, why have one central location? Couldn't multiple DNS servers mirror each other... some in obscure locations, others in highly protected facilities?
If this building were destroyed by a nuclear weapon, what would be the impact on the Internet?
you brought their server to a crawl by posting that...
and im not sure which is worse to look at... the goatse man, or rhonda...
The temple from Tron?
Approch, Program, and speak to your User...
Never answer an anonymous letter. - Yogi Berra
This story is news, but I kept expecting some point of contention in the article, rather than some musings on decorating schemes that were compared to clip art.
I found my point here:
The root server operators "have no contract with anyone, no guarantee of level of service, they could turn [the root servers] off tomorrow with no consequences at all because they are doing it out of the kindness of their heart," said Internet consultant Ambler. "ICANN needs contracts with the root server operators that specify minimum levels of service and minimum levels of security and the root servers need to be paid for that," he said.
Why is it so confusing to imagine that (a) People do like to do things out of the "kindness" of their collective hearts, and (b) security is not always "secured" by either contracts or money? I understand the legal protections associated with contracts, but I think there's a chance that the root server operator system, as it stands, could alternatively be viewed as something successful - something, much like the open source software movement, that works, not because of contracts or restrictive covenants, but because people enjoy contributing to something useful for their own and others' use.
This was kind of amusing (From the top of the article):
:)
By Brock N. Meeks
Cheif Washington correspondent
MSNBC
Updated: 8:52 p.m. ET Jan. 20, 2004
So Brock's the Cheif eh?
Two fish swim into a wall, one turns to the other and says, "Dam".
"By Brock N. Meeks
/.'s!
Cheif Washington correspondent
MSNBC"
No better than
the Network Operations Center, the "NORAD" of the Internet's traffic monitoring,
I'll say. Did you see that photo? It looks like something out of WarGames. God help us if those computers decide to play games.
The coolest voice ever.
I guess amazon.com which went public in 1997 must have been frequented only be researches and nerds for the first 5 years of operation.
Digex, along with other major hosting and co-lo facilities, has had these kinds of systems in place for their datacenters for many a year. And yeah, most of them look like very non-descript office buildings - a great many I've seen are in warehouse-style industrial complexes, far off the beaten path of regular office space and retail properties.
You have to wonder if they're a little overboard, though; the military doesn't typically have checks that secure to get into specific rooms - not even TS/SCI environments. Though, to be fair, the military certainly has an edge on physical security.
I guess if you're really concerned about your data being physically secure, you could always co-lo out at Sealand, too.
Wow .. cool.. raid (ooggle)
What's the deal here? I mean, isn't the Internet supposed to be decentralized? Who cares if the Internet server in some EZ-mini storage goes down? What's the worst that could possibly happen?
And if it really is that bad, then why aren't we working on making stuff more redundant? All I know is somebody needs to spend money on this, just like the power grid. It's not glamorous, so no politician will run with it, but I think we should have some kinda dialup internet tax to pay for it.
(-1, Raw and Uncut is the only way to read)
Back in the good old days, if you had a recent copy of hosts.txt all this was irrelevant :-).
But it's been most of a decade since just anyone could download it.
I'm guessing they also have a laser grid blocking access to the overhead air conditioning duct, pressure plates that light up when the alarm goes off, temperature gauges etc....NONE OF IT WORKS. A few cables and a 686 thinking machine prototype is all it takes to sieze control...have we learned nothing?
Didja not read the article? Do you not know how DNS works? Are you being sarcastic? Paranoid? Stupid?
My sig is blank, I typed this by hand.
places it in Washington, DC
I'd hate to think the internet depends on SCO UnixWare running on an old 486 ;)
Jonathan
I'd like to see some statistics on how many people attempt to invade/evade the physical security checks at Netsol's NOC that require and necessitate facilties on that level. The same goes for most any datacenter - your physical security is awesome, but why?
:)
Aren't most attacks against servers launched over that intarweb thing?
I can't recall the last time someone tried to suicide bomb a root server.
Or, more to the point, who modded it as "Insightful"?
I can only hope that their NOC has multiple fibers coming to the building and that those fibers aren't in the same trench.
The other potential source for a single-point of failure is the OS that the root server uses. If Verisign uses any kind of monoculture, they will not be as secure as we might hope. A hacker or botched OS patch could hose the thing.
Two wrongs don't make a right, but three lefts do.
Did anyone else shudder when they read that someone employed by one of the Microsoft companies was allowed to view that site?
It instantly became less secure.
Bah! That's nothing. You need to traverse a gauntlet of obsolete motherboards, dead power supplies, empty CD cases and soda cans as well as a floor mined with tiny machine screws to get to my NOC. That's assuming you got past my wife at the front door.
Undrar vad det kan bero pa?
The design documentation of the Internet is globally available... wait for it.. on the Internet!
If you examine it, you will notice that
a) DNS is not part of the original design
b) as designed, it WON'T survive a nuke
c) nobody intended it to.
What it *was* designed for was a limited fault tolerance - based on the idea that phone companies suck and the guy that runs the next node is an idiot who can't be trusted to tie his own shoes.
Turns out they were right about those last two points, incidentally.
I'll bite.
The Domain Name System works by sending out a verified master list to other servers on a graduated time scale. This way no one, two, or twelve servers gets nailed with lookups from THE ENTIRE INTERNET....
Those Primary and Secondary DNS number you're asked to enter when doing network setups are for the partial copies stored on the (insert any number of levels) nth server from the master.
If it can't find the match on one of those, it'll ask others, until a timeout occurs.
There is nothing to stop you from setting up your own DNS, if you're willing to donate the time and hardware to the cause.
individual to go "postal" and screw things up unfortunately. I subscribe to the "people enjoy contributing to something useful for their own and others' use" theory as well, but I also subscribe to the "people are sometimes unnervingly unpredictable for no apparent reason" theory as well; consequently I understand the need for more defined and structured contracts.
It only takes one bad apple...just one.
Is the juice worth the sqeeze?
And I think that DNS is centralized.
And I think that more government interference with the Internet is Good.
And I believe FUD.
And that Al Gore is pretty technical guy.
And I use AOL on my 'puter.
Please send more informative articles like this. I use them to line the insides of my tinfoil hats.
Thank you very much.
I want to delete my account but Slashdot doesn't allow it.
all you need to access it is a bomb, or, pretty much anything that explodes spectacularly.
I'm glad it's down. Good on her for getting it done. Of course, the picture will live on elsewhere but at least she did what she could.
Just because you can post something doesn't mean you should post something. Redeeming value of that picture? None.
Yeah, baby, I'm using my real nick...unlike all the cowards who will doubtlessly reply.
The internet is somewhat decentralized, although I understand that some backbone consolidation over the years has left us with some weak spots.
DNS, however, is pretty centralized.
I've had a few guys point it out to me before. Many DC / Dulles Toll Road-types know where it is.
Now, there are other buildings in DC that's are much more cool. Like the one on the Toll Road with green "windows" that are merely for appearances as the entire building is solid concrete. Or the stuff in Crystal City that is bathed in electronic white noise to prevent eavesdropping.
Unless the NOC was ordered at this place, I'm not impressed.
Hate me!
Internet's most precious computer is inside humming happily away in a hermetically...
Aren't 98% of all queries at the root level uncessary anyway?
Karma: The shiznight, mostly because I am the Drizzle.
Not too sure what this has to do with the original post, but it sure looks like a question slashdotters could answer!
Bah! That's nothing. You need to traverse a gauntlet of obsolete motherboards, dead power supplies, empty CD cases and soda cans as well as a floor mined with tiny machine screws to get to my NOC. That's assuming you got past my wife at the front door.
Heh, probably true for most slashdotters only s/wife/mom/ and add something about a basement.
If you follow the root server link, it shows the A root location as "dulles, va".
On the count of 3 every one ping 198.41.0.4
Ready?
1...
2...
3.[End of Line].
Coming next week on "Open Source Speaks", detailed plans to your local federal penitentiary, including but not limited to blueprints, schematics for locks, and guard schedules.\
a properly secured facility, that would all be immaterial not do much for breaking out.
so idiocy remains supreme even though you are busy patting yourself on the back for coming up with SUCH a "clever" slam.
twits
Wow did the whole user moderation thing fail on this article. Raise your hand if you haven't setup a DNS server before. If your hand is raised, leave the room, don't post, I don't care how you think it works.
the biometrics are easily gotten around through the ceiling tiles and floor. verisign's safe where the root keys for signing certs lived was kept in a room with an outside window in california and the combo to the safe written on a sticky note on the wall that was covered up anytime rich visitors came by.
So they're safe from us. Big deal. Are we safe from them?
Interesting article. Since the Cold War is over, and Al Quaida live in caves there's some great fodder for Tom Clancy.
Research shows that 67% of those who use the term "research shows", are just making shit up.
Particularly those of you in Virginia. If ya know what I mean. <WINK>
By Brock N. Meeks
Cheif Washington correspondent
MSNBC
Its hard to work out this puzzle, because the truth is well-hidden, but I think I've cracked it. I'm willing to bet that this was written by MSNBC's Chief Washington correspondent.
When bylines have typos, I'm pretty sure its a sign that the republic is falling ...
It's been outsourced and housed some where in India...
how in the hell is that a troll?
ROOT-A /--
--\
)(
--/ \--
20 MBs
but here is the /. thread on this facility from March, 2002. http://slashdot.org/article.pl?sid=02/03/29/144922 8&mode=thread&tid=95
To be honest it is kind of embarassing that I immediately thought- "I just saw something just like this on slashdot not long ago" to find out it was almost 2 years ago. I didn't look at the new article close enough to see if there were any big differences over the years. To be honest the articles are spooky similar. Hmmmmm.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
All this high tech biometric stuff is almost as cool as these badgers. Woah...
Almost.
I'd rather be a conservative nutjob than a liberal with no nuts and no job.
Well, there goes that obscurity thing.
More than $40/hour, which isn't much in DC.
/. on Friday evening.
Social engineering works best with underpaid, oversexed, or unappreciated (perception is as important as reality) employees.
Although, in reality, you don't have much of a life or house in DC with less than 100k/year.
Which is why you post on
I think we can be reasonably certain that VeriSign (a) only runs as much of an OS on their root server as is absolutely necessary, and (b) only patches it when it's thoroughly tested and approved by people who know what they're working on.
I agree that Verisign is extremely careful in exactly the ways that you suggest. But I also remember the MCI Frame Relay outage of 1999 and Therac-25 Accidents. The point is that any regime of tests and analyses will only eliminate a percentage (admittedly a high percentage) of the potential fault conditions. And if you realize that Verisign is up against the combined smarts of intentional and unintentional black hats, then you realize that it is inevitable that someone outside the trusted circle will discover and use an exploit before Verisign and the internet community can find the fault and plug it.
What I meant by avoiding monoculture is that any mission critical system would do well to avoid a single implementation of a protocol, encryption algorithm, or OS. Instead, the system should employ more than one independent approach with discrepancy detection. That way, a foe would need to simultaneously spoof or hack a system in multiple ways to create an undetectable exploit.
Nothing is foolproof, but systems that rely on a single chain of logic, algorithm, or code are especially fool hardy.
Two wrongs don't make a right, but three lefts do.
I am a one armed man; i'd have a hook for my other arm?
Perhaps they'll embed an rfid tag inside me pirate's booty. arrrrggggggggggg!
o/~Yo ho, yo ho, a pirate's life for me
We pillage, we plunder, we rifle, and loot
Drink up, me 'earties, yo ho
We kidnap and ravage and don't give a hoot
Drink up me 'earties, yo ho
o/~Yo ho, yo ho, a pirate's life for me
Visitors are "tagged and bagged" and made to sign de facto non-disclosure agreements before being lead to an elevator.
"Tagged and bagged"? Really? Visitors are killed, inventoried, and their remains placed into a body bag? And then they're asked to sign an NDA?
That really is tight security!
The redundant link to the outside has been found!
What do you think is used if a backhoe cuts the fiber!
That's not really a satellite antenna on the roof it is a " 802.11 dish "
- Distributing the database to major servers (at least one machine from each of the 13 often-virtual root servers, plus the master DNS servers at the Tier 1 ISPs, the CCTLD servers, and some small number of other sites
- Answering DNS queries from the major servers
- Answering DNS queries from any random machine on the Internet
The system becomes performance-critical to lots of people because too many machines send queries to the root servers (or theThe root zone itself is probably under 10KB of data that doesn't change every day - if you provide a separate server for zone transfers and let 1000 other DNS servers have access to it (firewalled to prevent any other IP traffic), that's about half an hour on a 56kbps modem. Remember that all it's doing is answering good questions like "Where are .com's name servers?" "Where are .za's name servers", bad questions like "Where are .example,com's name servers?", "Where is 10.in-addr.arpa?" and ugly questions like "Where is Ping of Death?". Let the major servers handle most of the work, absorb the ugly packets and do some queries for bad packets, and let the general public query those anycast machines - they should be querying their ISPs' servers, or their upstreams', which cache the real information, and even when their queries aren't bogus, they shouldn't be blocking the internet-stability-critical traffic.
The .net, .com, and .org domains are a similar problem, except of course they aren't served by the root servers. The zones are much bigger, a few gigabytes size, but probably only 10% of it changes in any given month, or 99.9999% of the existing domains, which ought to be enough to call the Internet stable, using about 1 Mbps (10GB * 1%/day * 8 bits/byte / 24*60*60 ), and again, keep the public query traffic separate from the zone transfer traffic, and maybe offer a third set of DNS servers to answer queries from the big ISPs to handle things like newly created domain names. The reason to keep that kind of query traffic separate is to avoid attacks like "query bogus00001.com" "query bogus00002.com" ... etc.
Obvious flame-attracting discussion points:
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
"From our perspective, I think that clearly we are the leader in that particular area, that we provide more back-ups than anyone else does," says Ken Silva, vice president of Network Security for VeriSign. "The advantage of us running the root servers that we run is that we do invest in this infrastructure," said Silva, a 20 year veteran of the nation's top spy agency, the National Security Agency.
seems like there's nothing to stop the government from censoring a website it really doesn't like with a spook so close to the "A" root server.
i love what you are saying. not only does it not make anything better, even in the terms of the system, it costs taxpayers more to keep people in prison, and it scapesgoats the "criminals," which frequently means that actual solutions (and fixes) aren't explored.
no no no... it isn't a router... It is dns and you are pinging the ip address and if you have read the other 30,000 posts you would know that the internet would ge fine.
Thumbs down to MSNBC for spooning up a dripping dose of Verisign PR.
Thumbs up to consultant Christopher Ambler for getting them to print "rat's ass."
"From our perspective, I think that clearly we are the leader in that particular area..." says Ken Silva... He believes that none of the other root server operators can match VeriSign's investment. etc, etc, etc. Abruptly he pulls his hand away, like a small child sensing the heat radiating from a stove burner. "Can you pull that door closed? I didn't hear it click," How many times did he rehearse that bit of security-is-our-middle-name theatrics?
Reply to this if want to make a $$$ offer.
True genius is grasping a situation like a peice of fruit, and peircing it just right so that it drains dry.
[DNS-Root-Developers] Need help setting up with 2.6.0_test3 and alsa on A root.
Dewie Cheatem dcheatem at verisign.com
Mon Jan 05 06:27:14 EST 2004
- Previous message: [DNS-Root-Developers] Need help with new kernel on H Root. I maked dep dude, what happened?
- Next message: [DNS-Root-Developers] Found a beta of gcc3.4 for B Root. Will report success later.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
---Hey guys. I've just reinstalled the A Root with Lindows and thought I'd try putting a new kernel in. A buddy burned the 2.6 source tree to cd for me so that's what I'm using. Everything seems to be going ok, but I'm not used to setting up alsa and I can't get any sound. I've unmuted all the channels but I still can't hear anything, at least not my Sade cd. Oh, also, distccd keeps segfaulting on this box. I don't know why!! If you've got any thoughts on this let me know too. I've got a shelll script that restarts it every 5 minutes in the mean time.
Thanks in Advance!
Dewie Cheatem
A Root
Verisign
I'm against picketing, but I don't know how to show it.
According to an October 2002 study, 98% of queries to the F Root Server (and therefore probably to the other root servers) are unnecessary. Either they're duplicates (75%) or they're for bogus TLDs (.localhost, .elvis, .corp, etc.) or they're in-addr.arpa queries for RFC1918 addresses, or they're some other bogus query, and they should have been served out of cache or handled by some ISP's DNS instead of bothering the roots. Maybe the A Root has some important functions, but they aren't what it spends its time on. And 50% of the queries come from about 220 servers - they should either be caching responses, or be shuffled off to some server that handles them (I guess anycast will help with this...) as well as cleaning up their act if they're broken, which some of them are.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
6377. Jasin Natael moves like these are more disgusting than the pictures of the goatse man himself
6373. Andrew Chinnici Goatse taught me the meaning of true love
we miss the internet creator, goatse made me who i am, we want goatse back
6303. R(ed) You can't get rid of Goatse! I mean, that was the best morph I've ever seen!!..Wait..what do you mean it's real!
6296. Reverse Experience This is no laughing matter. It's about saving someones ass!
6273. l33t goatse fan i miss goatse.cx soo much, i used to visit the site every night, now i am forced to watch Z3LL do his impersonations of what goatse used to do :'(
6241. kurt goatse.cx is to the internet what the grand canyon is to the tourism industry. it's deep, cavernous domain is meant for the world to see! bring it back, and tell those whiny religious right-wingers to stick it up their own ass for once. leave the goatse guy alone!!!
6209. tuxlearner if Bush still exists, why not Goatse ?
6208. Will Loveless Goatse.cx was like a father to me, thanks for killing him.
6195. The Big One i lost my virginity to GOATSE!!!!!!
6107. Alexei Zakharov Goatse.cx was good, wholesome family entertainment and should be restored immediately. Furthermore, it was an internet institution. Forum newbies the world over are being deprived of this rite-of-passage. Bring back Goatse!
6019. Ron I used to have an email forward on goatse.cx and now thanks to a selfish woman who feels her opinion must be imposed on everyone, I now lack that forward forever. Also, There was even a disclaimer added when people started complaining about it. The administrator did whatever he could to stop people from posting the link to message boards. NIC.CX should have no authority, just like any other registrar, to cancel accounts subjectively.
6001. driver8 goatse.cx is like a historical internet landmark and must be preserved for future generations!
5947. Jani Nurminen When there is goatse.cx, we can rest assured that the Internet has not been fully commercialized. Do not take it away.
5902. James Yarrison Goatse is an embodiment of the best and worst of the internet. Nothing is worse than being tricked into going there, and nothing is better than tricking someone into going there. It served a valuable purpose: to drive home the message that, on the internet, one must be very careful who one trusts, and where one does and doesn't got, but without the potential dangers of viruses or popups. To take the site down is to deny humanity not only of a valuable resource, but of a part of our collective history. People the world over have been fooled by Goatse, and to tear it down is to tear away the sense of community it gives.
5845. Geno4120 please return it! we miss the mascot of the intarweb :(
5821. Eric Raymonds Goatse man's ass was the homeland of 2 million Palestinian refugees, where will they go?
5759. Jack Goatse was not just a shock site to scare n00bs with.... It was a symbol of free speech for all to behold and to be disgusted or be driven to laughter when viewed.
3862. adam ray the man opend his ass for us, we can at least open our hearts
721. meaghan q! sinclair if the basketball doesn't fit, you must acquit
39. PJ J. KIWI HOW DARE YOU TAKE AWAY MY LASER STRIKE TEAMS MASCOT! GOATSE UNITED WILL LIVE ON FOREVER.
38. Karl Kennington I love goatse more than sunshine. Please bring it back!
"We have got to make Stan understand the importance of voting, because he'll definitely vote for our guy." - South Park
Back in the good old days when her serene highness the Dalai Lauren worked there and Dave Holtzman was still VP I took the e-ticket tour. The facility is in a nondescript industrial mall a few miles from the NSI mothership.
"oh, you'll want to see this"
"what is it"
"A-ROOT"
"THAT tiny little thing?"
"Yup. Go ahead and touch it, everybody that comes here wants to do that. See where the paint has worn off the case?".
"Uh, ok"
"You use this thing Dave"
"Nah, I download the root zone from you".
"Cool, for that you can buy me lunch".
"Good idea. Thai okay?"
NSI was fun once and there's lots of good stories. When the FNCAC made the NSF tell NSI to start charging for domain names none of the freaks working at NSI could believe you could charge for this and lots of checks were just pinned up to a bulletin board in a "wait and see" holding pattern for a few months. There weren't so many domains back then.
Karl Aurbach also downloads the root zone from me and you should too. Or use OpenNIC's root or even *cough*ICANNs*cough* (ftp://internic.net/domain/root.zone.gz, or any root.zone you want but if you know what's good for you you won't rely any anybody but yourself to serve up the root zone so your computer can find pointers to the various TLD servers: primary the root for yourself and don't worry about DOS attacks on other peoples computers taking your machine off the air.
That really was the dumbest part of the change from hosts.txt to the DNS - it changed the paradigm from your computer knowing where everything was to making your computer rely on the "." zone to be able to find the computers that know where all names can be found and there's really no reason for it.
Certainly it does not scale for everybody to grab a copy of the root from one place, and Dan Bernstein has suggested a cryptographically signed root be distributed via usenet. To this end I've created news:alt.root.orsc and will begin doing just that this quarter.
Need Mercedes parts ?
Most of the anycast deployment has been since then, and Verisign has put out lots of PR about how they're less vulnerable, but the real critical issues are making sure the Tier 1 ISPs get some kind of secure feed to the data so the root servers are less important.
(Oh, and I *could* tell you what the Department of Homeland Insecurity was *really* trying to do, but then I'd have to DDOS you and null-route your address space.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
That isn't the problem. It's having enough computer to be able to load the com zone without falling over. A few years ago I tried this with as big of a Sun machine I had access to and BIND. It thrashed for an hour then cakked.
I'd like to hear if anybody has tried loading the come zone on a PC running DJBDNS. By my seat of the pants reckoning it ought to work.
Need Mercedes parts ?
Well, obviously the US needs to help the UK go find the sources of their funding and the political authorities who let them operate, the way the UK helped us with Afghanistan and the Taliban. That means bombing BOSTON, blowing up its Irish bars, and hauling all those Kennedys down to Gitmo!
Back in 98 or so the guys who ran the root at nordu.net would go away on holidays for a month and were incommunicado, so NSI wanted contracts with them all to spell out exactly what each side had to do. This was well before ICANN.
Earlier than this you can find Manning's comments that "there are problems with the current setup [the root server administrators]". GIYF.
Need Mercedes parts ?
It's not a big file. Certainly smaller than the last hosts.txt.
It's here: ftp://internic.net/domain/root.zone.gz
Of course if you're feeling really frisky you could use this one: ftp://open-rsc.org/pub/db.root
Need Mercedes parts ?
Holtsman pointed out to Sun they were "the dot in dot com" and they used it in their marketing.
When it came time to buy new servers they didn't have enough of a clue to offer NSI a decent price break, and IBM offered them 13 servers.
Need Mercedes parts ?
At the beginning of the article:
... VeriSign isn't shy about touting the $150 million it has invested in various security measures.
...
A bit later
"Can you pull that door closed? I didn't hear it click," he asks of the person standing nearest to the first door.
"Click."
Sheesh, for $150 million you'd think a robot would double check the door for them.
(Score:-1, Wrong)
The equivalent for .com is obviously much bigger - I think there are ~35 million names (maybe that includes .net). But that's still about 5GB of highly compressible data - probably about 1GB if you sort it appropriately first. That's about the size of a Linux distribution - use BitTorrent. That's about 3 hours on a T1 line, and most of the people who need it are ISPs anyway (so it's about 10 minutes on a T3.) Probably doesn't change by more than 20% a month, or 1% a day.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
All the IP addresses are 127.0.0.1, and the domain names are a collection of spammers, popup sites, banner dealers, etc., most of whom you'd rather not talk to. (Of course, that works better if you've got a web server that rejects everything, or sends back blank 1x1 GIFs.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
What moron designs a system without triple redundant background ? Or,if you dont have it initally, what kind of morons let this conditon persist ? You geeks dont seriously expect me to beleive that loss of a single computer would actually effect anyting for more then a few milliseconds ? I think the whole thing is not so subtle pumping for verisign - look at us spending Mbucks on this free but super critical service...if the internet actually cared if A got hit by a bomb, then a LOT of people, in govt and academia and biz have a LOT of explaining to do..
"There is nothing to stop you from setting up your own DNS, if you're willing to donate the time and hardware to the cause."
Actually in this era of "appliance computing". Why shouldn't people with DSL or Cable have "Root" servers in their modems? If everything said in this "/." discussion is true, and HDs are big enough, and small enough? Then that would be the ultimate in distributed architecture. Throw in content caching (cross-link with other local caches) and the load on the Internet would drop quite a bit, and the Internet would be more robust.
I love the attitude. "Only WE have the right to wreck the DNS system completely!"
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
DNS, however, is pretty centralized.
Despite whatever misinformation VeriSign is blowing, DNS is realatively decentralized. The A-root is no more important than B, C, D, E, or F.
Not only is VeriSign becoming more and more adept at using the media to create the image that they own the internet, it seems that more and more tech writers have never cracked an RFC, or seem to know where to look this shit up.
(BTW, that would be here. Or in your/usr/share/doc/RFC if you're running Debian and have installed the apprpriate doc-rfc packages.)
Seriously.
...An era of personal responsibility and knowledgability about the public nature of the internet.
Mod me sideways, but it's the truth. You and Rhonda should get together and figure out how to take down some other sites you don't agree with.
It takes a seriously bland personality such as yours (and Rhonda's) to not find any redeeming value in goatse. Just the sheer cultural significance of it (especially on slashdot) is enough to make it a talking point, and to attempt to remove it is to end an era.
Why don't you do the rest of us a favor and just get off it if that's your attitude?
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Although I've never taken a close look at it. It's right across the street from the shopping center with the "Regal Cinemas" is... there's a Marriot and a Sweet Water Tavern/Olive Garden on the street leading up to the business park. We go there all the time.
::runs off::
Sigh. Now I'm going to have prowl around out front and get security all worried.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
What a loser....
Fire in the baltimore train tunnel that took out a major east-coast Internet trunk.
It snagged and snarled traffic for the weekend, but the routes were mostly fixed by the beginning of the next week.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
DNFTT. Anyone who thinks goatse had "redeeming value" ... well ...
Besides, tricking minors into visiting that site would be a felony, anyhow; you trolls should be glad you haven't been sent to prison...
They take in satellite data and make detailed maps. I remember after Sept 11 they put in all those really heavy barriers and fences.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
On Sunset Hills by Reston Town Center, (just north of the toll road) just before you get to the new Microsoft/Siebel/Oracle buildings intersection, there is a low brown building with no signs out front.
It belongs to a certain 3-letter agency. I'll leave it up to your imagination.
There's always a cop car with purposefully confusing jurisidiction markings patrolling the street out front. You can speed right on by if you see him, because they're actually Federal Marshals, IIRC.
Also near Dulles airport: Take Rt. 28 south until you reach Willard Blvd. (by the Dulles Expo Center). On your right is a large complex also with fake green windows. It's an enormous building set way back in that property. I think it's the same agency (anyone want to correct me?)
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
And you had the nerve to post AC.
What a tool.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
It is really bad to do security by a "what we needed to stop the last time" approach. Much better, when you know what you protect is valuable, to have good security straight off and never have to have it broken.
For whoever locates "A" first.
And a look from above.m age.aspx ?t=1&s=10&Lon=-77.41223707&Lat=39.03094526&Alon=-7 7.41223707&Alat=39.03094526&w=1&opt=0&ref=A%7c2134 5+Ridgetop+Cir%2c+Sterling%2c+VA+20166
http://terraserver.microsoft.com/addressi
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
Pretty extremist you are.. we are talking about DNS here.... not hospitals or contract law.
By the way, if you mismanage a server at the hospital and it kills someone, the hospital is held accountable, whether they choose to make you be is up to them.
Holding people responsible is a tool, not a solution. Making that server your responsbility might make you pay more attention, or taek your job more seriously, but it won't fix design flaws or make you less stupid.
An exellent point. Although DNS still has to have a "root," and is by nature centralized-- there can still be plenty of redundancy. Centralization doesn't necessarily mean "reliance on a single box."
Thanks for the clarification!!
It's not a smooth linear or exponential thing - it's random and bursty. That's why I padded the numbers up.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I remember seeing the sign now... sigh I feel like an idiot.
And it's Sunrise Valley...
NORTH
of the Toll Road. I fucking live there man, don't tell me. If I get the names switched, forgive me. I never have to remember them (other than the fact I always mix them up when giving directions)
I used to pass by that stupid CIA building every day to work. I also can't tell you how many times I slowed down when I saw that cop, only to realize it was "that guy" and blow by him.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
No, but that's the ip address of the actual root machine, not a random address. SO it would respond to the ping....it's kinda like a DDoS attack....i guess it wasn't that funny.....
Incorrect! Look again. One nuke over Herndon, VA. (for example) would wreck it.