Slashdot Mirror

← Back to Stories (view on slashdot.org)

Government Begins Securing Root Zone File

Posted by kdawson on from the not-before-time dept.

Death Metal notes a Wired piece on the US government beginning the process of securing the root zone file. This is in service of implementing DNSSEC, without which the DNS security hole found by Dan Kaminsky can't be definitively closed. On Thursday morning, a comment period will open on the various proposals on who should hold the keys and sign the root — ICANN, Verisign, or the US government's NTIA.

51 of 198 comments (clear)

  1. That's going to be interesting. by assantisz · · Score: 3, Funny

    I have my popcorn ready for the show.

  2. None of the above by jeffasselin · · Score: 5, Insightful

    Anyone really thinks any of those organizations should be trusted with this? How about some UN organization instead?

    --
    If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
    1. Re:None of the above by Anonymous Coward · · Score: 2, Insightful

      Because the UN sucks too? It isn't a symptom of who belongs to the organization, but the very fact that it is a large organization.

    2. Re:None of the above by MightyYar · · Score: 4, Insightful

      The same UN that is comprised of countries that support censorship of political speech? No, thanks. Either give it to an organization of free democracies or hold onto it until such an organization exists.

      I'm not flaming, but seriously - look at the UN's track record where they do things like elect Libya to head the Commission on Human Rights. I can already see China chairing the internet commission.

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    3. Re:None of the above by Kamokazi · · Score: 2, Insightful

      Hell, I'd trust the greedy bastards at Verisign way before the UN.

      But yeah, all those options kinda suck. ICANN is the lesser of the evils tough by a wide margin.

      --
      As our way of thanking you for your positive contributions to Slashdot, you are eligible to disable Slashdot 2.0.
    4. Re:None of the above by FireStormZ · · Score: 4, Insightful

      And why should the UN be trusted with this? As another poster pointed out they are comprised of many nations that censor speech, expression, assembly and thought. On top of that they have been shown to be as (if not more) corrupt (Oil for Food in Iraq), Inept (Sierra Leone), and Impotent (Rwanda)...

      --
      "Ahh! Arrogance and stupidity in the same package, how efficient of you!" --Londo Molari
    5. Re:None of the above by Jesus_666 · · Score: 2, Insightful

      The question is who to give it to. The United States are just as ineligible, seeing as they don't care about separating government and big business or keeping the government's powers in check. And I'm not in favor of giving a nation control over an international resource simply because it was deployed there first. That'd be like ultimately deferring to France in all aviation matters because of the Montgolfier brothers.

      Really, who should get the root zone file? Nobody is eligible so we either give it to nobody or adjust our standards so someine is. The question is, do we accept a multinational body where any attempt at tampering might get vetoed by other members or do we accept a single nation where that isn't the case?

      The UN seem like the safer choice because of more oversight. (Also, let's not forget that any bloc that feels left out can simply start their own root server network or switch over to one already running, thus it's not a wise idea to bind the one most of us currently use too much to a single nation.)

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
    6. Re:None of the above by foobsr · · Score: 2, Interesting

      organization of free democracies

      Leading surveillance societies in the EU and the World 2007

      Clearly in the lead: China, Russia, US ...

      CC.

      --
      TaijiQuan (Huang, 5 loosenings)
    7. Re:None of the above by operagost · · Score: 2, Insightful

      Maybe you shouldn't betray your political leanings by singling out the RNC. There are "free speech zones" at the DNC too. It seems to be more dependent on the attitude of the hosting city. At least we don't imprison grandmothers and sentence them to hard labor just for asking to protest.

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    8. Re:None of the above by MightyYar · · Score: 2, Insightful

      While I agree that the government (mostly local governments) overreacted to the antics of some douchebags, the fact remains that the US is one of the most liberal - if not the most liberal - nations on the planet when it comes to freedom of speech. Restrictions on speech correlate very well with authoritarian rule.

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    9. Re:None of the above by MightyYar · · Score: 2, Insightful

      The United States are just as ineligible, seeing as they don't care about separating government and big business or keeping the government's powers in check.

      I'm still going to rank political speech higher than commercial speech... that's where people really get oppressed. I agree that copyright is a form of censorship, and I would like to see it reformed drastically - but it's not the same as throwing people in jail because they are critical of the people in power.

      The UN seem like the safer choice because of more oversight.

      Two problems. One, the UN would only be effective if the number of countries opposing censorship was larger than the number that rather like it... unfortunately I think that the censors are in the majority. Second, the UN has no actual power to do anything outside of the security council. These committees and such all simply advise the security counsel. If someone were to get out of line, you'd need the security council to actually take action. With Russia and China as veto-wielding members, no action would ever come on issues of free speech.

      But mostly, you are dead-on about it not being all that critical. DNS is mirrored all over the place, and if the US ever went bat-shit nuts the rest of the world could just run their own mirrors.

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    10. Re:None of the above by Sancho · · Score: 2, Insightful

      Yeah, in the US, you can pretty much say what you want, as long as you do it in a place where no one can hear you.

      The reason that restrictions on speech correlate very well with authoritarian rule is because authoritarians don't want dissenters to be heard. It weakens their rule over the people, and threatens their power.

      Free Speech Zones are public places where people are allowed to exercise their first amendment rights[1]--that is, the right to free speech. These zones tend to be away from the attendees, speakers, and mass media covering the event to be protested. This means that the protest is effectively pointless. Maybe you get a feeling that you're doing something by protesting, but by forcing you to protest where no one can see you, you're certainly not getting your message across.

      So it's great and all that I can say pretty much whatever I want in the US. Seriously. I think it's awesome. But what I don't think is awesome is that political speech is effectively censored--that's the kind of speech which is linked to dissent, and which authoritarians want to quash.

      [1] The government "allowing" you to exercise your rights should be a giant-old red flag.

    11. Re:None of the above by MightyYar · · Score: 3, Informative

      Protests are only one form of free speech, and it happens that they involve major disruption. It's like a parade or a festival... even when everyone is very peaceful, you have requirements for food, water, and human waste. Frankly, it's not particularly fair to crash someone else's parade after they've paid for everything and then complain about your rights being squashed. You want to have a parade? Go for it - but pay for all the mess you'll make.

      And you know what? These WTO/RNC/etc protests are NOT non-violent, they are NOT low-impact, and they cause a major disruption - by DESIGN. You have a right to free speech. Have a parade, publish a newspaper, etc. You do NOT have a right to be a douche.

      It tells me that your message isn't worth hearing, because you have resorted to abandoning any sort of civilized debate and just crying like a 2-year-old.

      (Note I don't mean you in particular, just the style of writing that I used.)

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    12. Re:None of the above by MightyYar · · Score: 2, Insightful

      Excuse me, but the reason that most people resort to such intrusive methods is that the government neuters their otherwise peaceful message by plugging their ears through free-speech zones.

      No, it isn't. Their message is fringe and not even close to being popular. They are ignored, and so make noise. The wide use of "free speech zones" came after the douchbaggery, not before - though I happen to agree that they are overkill. Just make the protesters file for a permit, pay for the extra police, get sufficient porta-potties installed, etc... no need for specific zones.

      Remove all violent protests, and soon the peaceful ones will be dead, in jail, or brainwashed.

      That's just absurd. Violent protests have no place in a civil society. That is the whole point of free speech and the justice system. You can say anything you want without tearing shit up.

      Do you really think "the right to free speech" should include location? Like, in the middle of a highway? Fuck everyone - just shut down afternoon traffic because you have something to say?

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    13. Re:None of the above by Jesus_666 · · Score: 2, Insightful

      I'm still going to rank political speech higher than commercial speech... that's where people really get oppressed. I agree that copyright is a form of censorship, and I would like to see it reformed drastically - but it's not the same as throwing people in jail because they are critical of the people in power.

      Yes, some of the UN member states are't too keen on free speech, but then again the United States government isn't, either. Granted, you're not quite on the same level as the worst ones but things like the DHS, Gitmo, unwarranted searches, free speech zones etc. aren't exactly painting the USA as the paragon of freedom of expression -- or even freedom at all. I get to choose between a committe of nations, some of which don't value human rights as highly as they should, or a single nation that doesn't value human rights as highly as it should.

      If the USA want to be able to claim moral high ground on human rights issues again they're going to have to behave extremely well for at least a decade. Currently their credibility is severely damaged.


      By the way, with "they don't care about separating government and big business" I didn't mean that the government imposes on business but the other way around. I meant plain old corruption (or extortion in some cases). The increasing eccentricity of American tech and IP laws really makes it look like you guys have the best politicians money can buy.

      I dont hate the USA or anything (was there twice; nice people, quaint architecture), but currently they're like a drunk guy with a broken bottle you encounter while bar-hopping: Much better armed than you are, mostly unpredictable and unlikely to be nice. In short, they're scary.

      Second, the UN has no actual power to do anything outside of the security council. These committees and such all simply advise the security counsel. If someone were to get out of line, you'd need the security council to actually take action. With Russia and China as veto-wielding members, no action would ever come on issues of free speech.

      Do you really think the US government gives a shit about free speech elsewhere? Assume they're at pseudo-war* with another country. A logical thing to do would be to shut off that country's ccTLD, causing economical damage and hindering civilian information flow. What happens if someone complains? Will the US say "Oh sorry, we didn't think France would get angry!" or would they say "Our root zone, our rules."?

      But mostly, you are dead-on about it not being all that critical. DNS is mirrored all over the place, and if the US ever went bat-shit nuts the rest of the world could just run their own mirrors.

      Actually, a fragmented root would have the potential to cause some havoc. If Europe gets pissed off at the States enough to switch over to independent-mode ORSN wholesale people will have to make sure their stuff is in two DNS networks instead of just one. Asia might follow suit and suddenly we have three. If those roots diverge we end up with a mess of colliding or incompatible TLDs or even identical domains that resolve differently based on region.

      It's not OMG! The End Of The Internet!, but we should avoid it nonetheless.


      * The weird kind of war-without-a-declaration-only-it-isn't-really-war we saw in the last couple years.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
    14. Re:None of the above by MightyYar · · Score: 2, Informative

      You only believe the protesters are fringe lunatics because of how they're portrayed on the news after the weirdness has erupted. Try finding a nice video of a blogger with a hidden camera at one of these protests from start to finish and you'll see what really goes on.

      Nooooo... I live in NYC and have the pleasure to stroll through these protests every so often. Usually these people are what I would term professional or at least hobbyist protesters. They are largely from out of town. They tend to represent every insane cause you ever didn't want to know about. All the usuals are there, too. The free Tibet crowd, the "I don't eat this or that" crowd, the "free this wronged convict" crowd, anarchists, communists... maybe you don't consider these people fringe - but they very much are.

      As I said before, I agree that the police tend to over-react but in general these things go down pretty well. You'll have 10s of thousands of people with only a few hundred arrests... and most of those are people blocking some road or walkway. You're right that only a few are violent. The walkway and street blocking people are still douchebags, even if they are being non-violent.

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
  3. Who to control... by TheSpoom · · Score: 5, Insightful

    Verisign

    Pros:

    • Quite a bit of money, stability likely wouldn't be a problem

    Cons:

    • Puts a private company in control of a very, very important part of the internet
    • Has previously fucked with DNS, would likely do so again if considered a wise business decision

    US Government

    Pros:

    • Wouldn't dare let it go down since business in their country is very dependent upon it
    • Puts elected officials in charge of a very important part of the internet

    Cons:

    • Nationalizes an important part of an international network
    • Puts elected officials in charge of a very important part of the internet

    ICANN

    Pros:

    • Has been doing this a long time
    • Is a non-profit company so isn't driven by the same business needs as, say, Verisign

    Cons:

    • Still somewhat national

    I'm definitely of the opinion that ICANN should be running it. That said, I don't know everything about the matter, so perhaps there's something that would change my mind. I figure, though, that if it's not broken, don't fix it.

    --
    It's better to vote for what you want and not get it than to vote for what you don't want and get it.
    - E. Debs
    1. Re:Who to control... by TheSpoom · · Score: 3, Informative

      The problem is that that theoretical hosts file is already split among different entities; for example, Verisign controls the .com and .net registries, not ICANN. So, if you wanted to do that, you'd have to convince all of them to give up their control.

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    2. Re:Who to control... by TheSpoom · · Score: 4, Interesting

      Addendum:

      UN

      Pros:

      • As international as it gets
      • Ideally not controlled by any individual country

      Cons:

      • Possibly more bureaucracy than any individual government in existence, would anything ever get done?
      • Could lead to a tyranny of the majority, what if a block of countries wanted censorship?

      I'd be interested in hearing reasons why people believe this is a good thing as well though.

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    3. Re:Who to control... by TheSpoom · · Score: 2, Informative

      I would put that on the con side.

      I did, if you noticed. :^P

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    4. Re:Who to control... by C10H14N2 · · Score: 2, Funny

      ICANN IS INTERNATIONAL.

    5. Re:Who to control... by Anonymous Coward · · Score: 4, Funny

      I know, let's give it to Canada!

    6. Re:Who to control... by TheSpoom · · Score: 3, Funny

      CAPS LOCK IS CRUISE CONTROL FOR COOL.

      (even cruise control [and slashdot filters] you still have to steer)

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    7. Re:Who to control... by mgoren · · Score: 3, Insightful

      Why in the world would they give it to Verisign? I thought we were trying to move away from Verisign controlling anything other than .com (and I guess .net too)?

    8. Re:Who to control... by jhol13 · · Score: 2, Insightful

      It does not really have to be the UN, it can be a non-profit organisation (legally) under UN. This would mean, of course, that those running it would get a huge power ... but they could not (would not necessarily) be persuaded to change policy by any government or lobbyists.

      That would get rid of the bureaucracy and tyranny of majority, but could lead to tyranny of minority.

      How that would work out in practice would be interesting experiment, to say the least. Whether trying is worth the risk ... well, let's just say that one would not cost 700 reallybigones :-)

    9. Re:Who to control... by digitig · · Score: 2, Insightful

      Latest I can find for UN payments is 2005 figures; I wouldn't call the difference between $423M (USA) and $375M (Japan) all that huge a degree. And is the USA actually paying its dues now? In 2005 it owed almost a billion in unpaid dues.

      --
      Quidnam Latine loqui modo coepi?
    10. Re:Who to control... by Tanktalus · · Score: 2, Funny

      Oh, no you don't. We don't want you blaming us AGAIN if something goes wrong.

  4. Ah, screw it. by Rob+T+Firefly · · Score: 4, Funny

    I vote we just give it to Cowboyneal.

    --
    Slashdot Burying Stories About Slashdot Media Owned
  5. I believe DNSSEC is unnecessory... by nweaver · · Score: 5, Informative

    I believe DNSSEC is unnecessary to counter the Kaminski attack.

    See draft-weaver-dnsext-comprehensive-resolver-00 for how I believe you can secure resolvers against attacks less powerful than MitM, including Kaminski (race-until-win) attacks.

    --
    Test your net with Netalyzr
    1. Re:I believe DNSSEC is unnecessory... by spinkham · · Score: 2, Interesting

      I believe you missed what I said, or at least what I intended to say.

      DNSSEC enables using DNS as the method of protection from MITM for other applications.

      With DNSSEC you can distribute your SSH fingerprint in a signed DNS record. That would enable your application (SSH) to have a secure connection that can even withstand a MITM attack as long as you can verify the DNS signing keys, irregardless of whether or not you've ever connected to that server before.

      The same sort of system can be used for email signing keys, IPSEC keys or anything else you want to distribute in an authenticated fashion.

      I agree that DNSSEC to enable secure DNS alone is overkill. If we were only fixing what we have, I'd do it your way. What I believe what you are missing is the potential a secure, distributed, scalable database founded on a robust PKI could have on how we interact with each other.

      DNSSEC is more then just a way to keep people from redirecting you from www.google.com to evilsite.com, it's a technology that can be used to enable authentication and trust on an Internet wide scale. It is a game changer, and gives us something we never have had before.

      I agree that your plan would mostly shore up DNS, but we would miss the opportunity we have to create something so much larger then simply the internet phone book. DNSSEC has the potential to bring sweeping change to our industry, and much greater security to all of our lives.

      --
      Blessed are the pessimists, for they have made backups.
    2. Re:I believe DNSSEC is unnecessory... by spinkham · · Score: 2, Interesting

      HTTP sucks too, but we use it because we all use it. Whatever we want to build gets a http implementation simply because everyone else uses it and understands it, and interoperability is king. In fact, a web service like http/SSL implementation is the only other real contender for a large scale PKI that has a snowball's chance in hell of being adopted. If DNSSEC fizzles out, I'll try that way.

      DNSSEC is the best shot we have at world scale PKI because it's an incremental add-on to something we already have, and solves a real problem that exists in DNS at the same time. It is the most robust way to shore up DNS for the long term against all non-DOS attacks. (DNSSEC makes DOS easier, and fails horribly on that count. Elliptic Curve Crypto will help somewhat by shrinking key size vs RSA based keys)

      Yes, it will be "just another CA infrastructure", but is the one shot we have in the near future at getting such a thing deployed globally.

      Yes, DNS is not the ideal CA infrastructure, but it's the best one that has a chance at life. We want to secure DNS, and on the side we get global PKI almost for free. We're not going to get this kind of chance again for a long time.

      --
      Blessed are the pessimists, for they have made backups.
  6. I'd vote ICANN by K3ba · · Score: 3, Insightful

    But in the end, who really cares who signs it now - what can be signed once, must be able to be signed again (especially if there is a validity period of the signature), and if the signatory needs to change in the future then it can be changed then. Delaying the signing process is counter-productive, as procrastination in this regard only helps the hackers and not the greater unwashed masses who don't know they need this process to be completed in the first place... Maybe they should ask for comments _after_ they have told us the first signatories name. They will get comments then regardless of who they choose ;)

    --
    Catapultam habeo. Nisi pecuniam omnem mihi dabis, ad caput tuum saxum immane mittam.
    1. Re:I'd vote ICANN by afidel · · Score: 3, Insightful

      How about the operators of each Root server signs their own copy of the root? That way if one entity implements policies that you don't agree with you simply remove them from your hints file. There's a reason there's multiple root servers and putting the signing authority in the hands of one entity inherently makes the system less diverse and fault tolerant.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
  7. Re:Hmm... MS-B-DNS by aproposofwhat · · Score: 2, Funny

    Or there could be the Apple version - "BrokebackDNS" :P

    --
    One swallow does not a fellatrix make
  8. Re:Those who do not understand DNS by alexborges · · Score: 2, Funny

    I know i know, lets give it to some wallstreet bankers!

    --
    NO SIG
  9. Re:Those who do not understand DNS by rs79 · · Score: 4, Interesting

    "Are doomed to reimplement it, poorly. Does anyone have any confidence that the US Government WONT mess this up completely? Give the key to Google or AOL or IBM or something. "

    Those who don't understand DNS would recommend giving it to IBM.

    Hi. I run the root server that was the first runner up in the contest to administer it, ahead of two other groups. We were actually asked by the gov to advise icann which we did until we realized all they were doing is using us to get away with what they wanted to do, instead of listening to advice on horrific problems. Hint: the mandate specifies icann is a membership organization and 10 years later you still can join and have a vote. Ahem.

    During this time and for 5 years before that I run the a root to one of the alternative root zones.

    If you think dnssec will fix the problem or that it's the right answer or that it will actually secure it then you and Dan Kaminsky haven't thought about it enough.

    But if you wanna go ahead with the broken dnssec model the keys should be held by Paul Vixie. This is all his mess anyway and he already holds the keys to usenet.

    --
    Need Mercedes parts ?
  10. It doesn't have to be just one player by jonaskoelker · · Score: 4, Interesting

    How about using a threshold signing scheme?

    Here's the ten kilofoot view: each participant p_{1..n} gets a piece of the key. If least t of them (for some 2 <= t <= n) cooperate, they can produce a signature on the input message.

    It is widely held that separation of power into legislative, executive and judiciary is a good thing. Here, the roles would be symmetric, but you still get the benefit of no one body of people (or single person) being in control.

    Here's an interesting thought: include some of the root server operators in the decision. I haven't done the formal proof, but my understanding is that it'd be simple to create weighted threshold schemes, such that if ten of the $n roots all agree, that counts as one "vote" in the usgov-icann-verisign calculation [just apply some general secure Multiparty Computation protocol to the computation of RSA-signing with Shamir secret shares of the private key]. And, as your child poster says, you may want to include the UN. Not being a citizen of 192 sovereign nations, I don't like the idea of any one nation having a disproportionately large influence over critical infrastructure, should we come to rely on a signed root zone [note: we don't now, because it isn't; that may be useful to put this issue into its proper perspective, or not...].

    But no matter who the eligible parties are, I don't think any one of them should be in exclusive control. Use a threshold signing scheme to distribute the power.

    1. Re:It doesn't have to be just one player by wiz_80 · · Score: 2, Insightful

      The problem is that this scheme might work now, but it is not very future proof. How would you avoid the issue of Participant A borging participants B through T, thereby owning enough pieces of the key to do whatever they want, no matter what Participants U through Z have to say?

      This might happen with private organizations (companies get bought) or with states (Russia takes over Georgia's piece of the key, just going on what's in the news).

      I think ICANN is still the least bad choice. Somebody has to be the ultimate arbiter, and at least ICANN's fights so far have been confined to ICANN. It has not become a bargaining chip in bigger fights, which would be almost guaranteed with organizations such as the UN.

      --
      " There is a rational explanation for everything. There is also an irrational one. "
  11. Re:Those who do not understand DNS by PinkyDead · · Score: 5, Funny

    One key for Google flying oh so high,
    One for Apple for without it fans would moan,
    One for IBM what are based in Armonk, NY,
    One for the Dark Lord on his dark throne
    In the Land of Redmond where the Shadows lie.
    One Key to rule them all, One Key to find them,
    One Key to bring them all and in the darkness bind them
    In the Land of Redmond where the Shadows lie.

    --
    Genesis 1:32 And God typed :wq!
  12. Re:Those who do not understand DNS by alexborges · · Score: 2, Funny

    Can I be the president of your fan club?

    --
    NO SIG
  13. Give the keys to Jon Postel by davidwr · · Score: 4, Insightful

    I can't think of anyone more qualified.

    Yes, I know he's dead, but I still can't think of anyone more qualified.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
  14. Lame choice is no choice by Daimanta · · Score: 4, Insightful

    "On Thursday morning, a comment period will open on the various proposals on who should hold the keys and sign the root -- ICANN, Verisign, or the US government's NTIA."

    ICANN: Organisation situated in the US, can be heavily influenced and controlled the US government
    Verisign: Private company that is only interested in profit and is situated mostly in the US thereby it can be heavily influenced and controlled the US government
    NTIA: US government

    CHOOSE: US, US, or US

    American election time!

    --
    Knowledge is power. Knowledge shared is power lost.
  15. Verisign? by neowolf · · Score: 3, Insightful

    I can't wait if they get it... Within a couple of years we will all have to start paying for DNS queries. Of course- they will offer to allow your query for free if they can insert ads into every site you go to.

  16. It doesn't HAVE to be one signature by elfguy · · Score: 3, Informative

    DNSSEC already has provisions to use a multi-signature key, where many organizations each sign it, and these parts are used to make one global key, so that no one person or organization is owner of the root zone file. It doesn't have to go like that.

  17. You, sir, are evil and twisted. by Crazy+Taco · · Score: 4, Informative

    Countries like the USA, you mean? Seriously, did you ever try to protest at an RNC, for instance? I did, and I can tell you that it sure makes you wonder exactly which nation you're in, anyway.

    Right, and those of us from Minnesota know ALL ABOUT your protests at the RNC. Let's see, at this year's RNC in Minneapolis we had mass rioting, bricks thrown through windows of business and destruction of property, an attempted bus-jacking, fires, attacking of delegates from multiple states, throwing feces and urine on delegates, attacking police officers and a vast number of other crimes.

    In the pre-RNC raid by the Ramsey County Sherriff's department of the "RNC Welcoming Committee" apartments, police found molotov cocktails, nail bombs, gasoline tanks and other explosives, buckets of urine and all variety of other ordnance. Despite these raids, numerous people were still injured by these people during the riots. Even the liberal mayor of St. Paul applauded the actions of law enforcement and the excellent job they did it keeping the carnage from getting worse.

    So, the only thing that makes me wonder what country I'm in is that fact that depraved idiots like you are running around lose. People like you are lower than low, defending these tactics and smearing the law enforcement officers. These were not "peace protesters". These were terrorists and anarchists by anyone's definition, and no quarter should be given to them. And frankly, no quarter will be given to you either. You, luckily for you, are given the right of free speech by the rest of us true American citizens, but I will not stand by and let you spew your garbage and hate without reminding others what really happened in Minneapolis at the RNC. People like you are truly evil and immensely twisted and warped if you can defend any of the violent activities the went on during the "protests" (read: riots). And if you were a participant, you deserve to be thrown in jail, or better yet, exiled to a place like Pakistan, Iran, or Syria. Your kind have no place in a free and peaceful democracy.

    --
    Beware of bugs in the above code; I have only proved it correct, not tried it.
    1. Re:You, sir, are evil and twisted. by cptgrudge · · Score: 2

      As another citizen of Minnesota, the parent speaks the truth. I'm all for free speech, but what these "protesters" were doing was attempting to disrupt the political process and infringing on OTHERS' right to free speech.

      --
      Qualitas edurus commercium, nullus penitus net rimor, nullus deus beneficium
    2. Re:You, sir, are evil and twisted. by MasterOfMagic · · Score: 2

      Imagine a world where rioters and peaceful protesters are separate. Nobody is denying that there were rioters at the RNC. Rioters should be arrested. However, peaceful protesters were caught in the crossfire and arrested. If you think that these people should be exiled because they disagree with you, then you are no true American.

      So, the only thing that makes me wonder what country I'm in is that fact that depraved idiots like you are running around lose. People like you are lower than low, defending these tactics and smearing the law enforcement officers...And if you were a participant, you deserve to be thrown in jail, or better yet, exiled to a place like Pakistan, Iran, or Syria. Your kind have no place in a free and peaceful democracy.

      Heil Crazy Taco and his ability to judge who is a true American and who is not.

    3. Re:You, sir, are evil and twisted. by riceboy50 · · Score: 4, Funny

      you are running around lose

      Nooooo! Finally a time when the often misused loose would have been the correct usage. How could you break my heart by using the wrong word here?

      --
      ~ I am logged on, therefore I am.
    4. Re:You, sir, are evil and twisted. by MikeBabcock · · Score: 2

      So, the only thing that makes me wonder what country I'm in is that fact that depraved idiots like you are running around lose. People like you [...]

      I believe that's exactly his point. The USA is supposed to stand for the freedoms of all people, no matter how you feel about them.

      Standing all high and mighty and believing that you somehow have more of a right to your opinion and behaviour than they do, and more importantly, dividing people into "people like me" and "people like you" is bigotry and shouldn't be tolerated any more than feces throwing -- but I'll grant you the right to have your opinion, if you grant me the same.

      Of course, what do I know, I'm from that big ice sheet to the north.

      --
      - Michael T. Babcock (Yes, I blog)
    5. Re:You, sir, are evil and twisted. by raddan · · Score: 2, Insightful

      And which part of the AC's post condones violent protest?

  18. Re:DNSSEC versus DNSCURVE by Todd+Knarr · · Score: 2, Insightful

    Except that DNSSEC is DNS. Period. It isn't compatible with DNS, it is DNS. It simply adds some additional records that aren't normally present that a DNS server or resolver can, if configured to, use to verify that the responses come from a valid server. It's not difficult to deploy, all current DNS servers already implement it so it's already deployed. What's difficult is the process of generating the signature chains, since the validity of the signatures at any level depends on the signature chain back to the root be intact and valid. So, if I have silverglass.org signed, the com and root domains also needs to use DNSSEC and sign their records before the DNSSEC records on silverglass.org can be verified.

    Note that the signature chain's the critical part. The first question that needs answered, before you can validate any response, is "What's the correct, valid key I should verify this domain's records with?". Fail to solve the problem of answering that question securely, and the system's not secure regardless of anything else it may try to do.