Slashdot Mirror
DNS Root Servers Outside US Surpass Those Inside
penciling_in writes "Paul Rendek, head of member services and communica of RIPE Network
Coordination Centre (RIPE NCC) has
reported on CircleID that: 'For the first time in Internet history the
number of instances of DNS root servers outside the United States has overtaken
the number within. The balance was tipped by the recent launch in Frankfurt of
an anycast instance of the RIPE
NCC operated K-root server.' In
the same report, Daniel Karrenberg, Chief Scientist of the RIPE NCC says:
'We monitor the quality of the root name service from more than 50
locations worldwide, and we publish the results for everyone to see.'"
So it was a K-raut K-root server that tipped the balance?
*dodges the thrown fruit*
The number of countries outside the U.S. outnumber the number of countries inside the U.S.
I just changed bloody hosts three days ago and my DNS still isn't completely changed over! Now I find out it's because all the new servers are farting around in Frankfurt! Great, just great! =)~
My Webcomic: Asylum on 5th Street
Sure, there may be more DNS root servers outside the US, but it would seem that Verisign still has exclusive rights to muck around with them. So what's the big deal?
"Service quality and security is not always proportional to money spent."
Time until someone makes a Windows-Linux parallel: 5... 4...
The coolest voice ever.
Cool. This is as it should be, too.. As the rest of the world gets on the net, we'll se the US further down the list, I'm sure.
I'm an American, and I love the US, but the imbalance of the internet towards the US has always bothered me. To me, it always has seemed that it should be a completely global venture, and be supported fairly evenly throughout the globe.
DNS servers are probably a good indicator of internet usage/participation and the fact that other countries are catching up is a good thing; however, just shy of half of the DNS servers are still in the US. That's pretty sad considering we represent less than 5% of the global population. Here's to hoping other countries continue to grow in their participation.
Also, I hope Babelfish improves as globalizations continues.....
The routers themselves deal in numerical IP space, right? Why is name service so dang important?
taken! (by Davidleeroth) Thanks Bingo Foo!
I am part K-raut you insensitive K-lod!
It is easier to build strong children than to repair broken men. -Frederick Douglass
I wanted to read the article, but my browser can't resolve the host.
"Personally, I'm torn between the cushy redundancy offered by decentralization, and the cushy security of having most of the servers in a stable, well-protected country."
oh i forgot, germany is such an unstable rogue state. better hurry up and invade!^H^H^H^H^H^H liberate
I'll just use my special getting high powers one more time...
Quick...
/. THAT
Everyone ping k.root-servers.net and try and
... and then there were none
I'd hate to think any of my packets being exported to those guys who wouldn't even help us rid Iraq of weapons of mass destruction! I think in protest, we should hereby refer to all the USA DNS root servers as "Freedom Hosts" (cue Lee Greenwood music...now).
Many hosting companies, etc. use shared servers. I do as well, in fact, for my websites. For example, my website www.studentprogress.info may have the IP address 65.49.199.172, but the site will only show up if you use the hostname.
Based on the sheer number of websites these days, I'm sure we'd run out of IPv4 space instantly without DNS, and maybe even run out of IPv6 space!
There's no place like localhost
I think you're confused. The Germans volunteered to change the names of things such as saurekraut (I'm only half German) to "Liberty Cabbage" during WWII because they were getting persecuted so much by (you guessed it) Americans. We Americans know that the French are too stuck up to stick it to themselves so we changed "their" things to names like "Freedom Toast." And I'm not old. I learned that "Liberty Cabbage" thing from Grandpa Simpson. I kid you not. Simpson's is edumacational.
And besides, even the govenment couldn't change the name to "Freedom Hosts" because even they are slaves to VeriSign. It'd be all wrapped up in too much irony. Even for this administration.
Source
Ben
Work Safe Porn
In the bad old days you and you alone were in control of name resolution. For those of you without receding and/or grey hairlines who may not know or remember this, you had a file called hosts.txt that contained all the mappings of names to IPs. That, obviously, didn't scale and DNS was developed and was widely deployed by about 86 or so.
The one big gotcha with DNS is it takes control out of your hands. That is, you may have your own DNS server locally, but you traditionally refer to other servers that serve up the root zone that tells your DNS server where all the TLD servers are. Somewhere along the line the decision was made to use other machines, not your own, for this.
This is wrong for many reasons:
But there are ways around this. The easiest if is you static route the 13 root server IPs to your own nameserver. Then you can run an unmodified copt of the legacy root zone on your own nameserver and the US government root servers can be backhoed or DDOS'd and you wouldn't even notice. ISP's are starting to figure this out, especiallly ones with expensive longhaul connections.
Or, you can modify your nameserver to declare youtself primary for the root zone (which you've dutifully downloaded) and edit out the declarations for "." in the legacy root zone.
Or you can use the ORSC root zone. If it's good enough for two ICANN board members, it's good enough for you.
Whatever you do, for God's sake dump bind and use DJBDNS. It really is so much better it's just not funny.
Need Mercedes parts ?
Yes but Export laws will keep any dns number above 2^2 from crossing the border.
Its amazing how those forigners keep sneaking back into the US to develop their software then releasing it like it came from other countries!
ls
Quick everyone in the US go setup 5 DNS servers!
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
... are resolved to us.
First I wanted to be a chef. Then I wanted to be Napoleon. My ambitions have continued to grow ever since.
http://www.cbc.ca/mondayreport/videos/ontario.html
Need Mercedes parts ?
what they are talking about for a change.
The recent flurry of articles giving the impression that VeriSign is somehow "in charge" of DNS has been rather irritating, when in fact, it is not difficult to configure your DNS server to ignore VeriSign operated root servers. (If you're using bind, dont include thier roots in your roots.cache zone file. I'm sure there's an equivalent trick for djbdns.)
I wish all of those who are about to continue the current flood of "what difference does it make?" and "VeriSign controls DNS anyway." posts would kindly read this article and this one as well for a breif tutorial on DNS from that programmer who writes good shit but everyone says they hate him anyway, D. J. Bernstein.
If you like the subject, maybe you should go out and buy a copy of DNS and BIND so you'll have something interesting to talk about at the coffee house this weekend.
The truth is that DNS is a distributed system that is rather well designed to be redundant. The anycast implementation mentioned in the article is a good and needed way (it's the right way[tm]) to increase the redundancy that is already inherent in the system, making DNS much more secure and resistant to DDOS attacks and other attempts to disrupt DNS service. VeriSign showing off thier "secure" sites, and blowing thier own horn about how "important" they in particular are to the internet is a load of sh*t that should not be given a second thought unless you are in the habit of educating our lawmakers about related issues. Not an especially good habit, it will make you enemies (but only if you're right).
Read, L
I've been using the ORSC root zone and its servers for several years. I have not noticed any outages or problems - oops, yes there was a problem once - it was when ICANN decided to create a .biz of its own even though there was one already running.
I'm torn between the cushy redundancy offered by decentralization, and the cushy security of having most of the servers in a stable, well-protected country.
Fuirst of all, Germany is what most knowlegable people would call a "stable, well protected country".
Second, that in and of itself does not affect the security or reliability of DNS as it is designed very much, and has even less signifigance now that anycast is proven to be a reliable technique for increasing redundancy.
D. J. Bernstein has provided some good introductory about the workings of DNS, including security.
There's a chapter on DNS security from "DNS and BIND" available at the O'reilly website as well.
The biggest dispute about DNS security (and internet security in general) is between those who prefer centralized, single point solutions, and those who prefer distributed, autonomous security measures. IMHO, centralized security creates weakness in most (all?) cases by creating a single point of failure, and is an approach that is most often motivated by the desire to exert control over internet usage in hopes of personal gain (re: VeriSign), and to establish an authority because of a misguided belief that there need be one.
The internet's basic strength is due to it's lack of dependance on centralized authorities in order to work. Any proposals that change that basic assumption are either poorly thought out or suspect.
Read, L