Slashdot Mirror
DNSSEC and the Geopolitical Future of the Internet
synsynackack writes "The Register reports that the DNSSEC protocol could have some very interesting geopolitical implications, including erosion of the scope of state sovereign powers. The chairman of ICANN, Peter Dengate-Thrush, explained, 'We will have to handle the geo-political element of DNSSEC very carefully.' Experts also explained that split DNS and the DNSSEC protocol don't match very well; technically, it is possible for someone at the interface of the global Internet and a country-wide Internet to strip electronic certificates attached to data and repackage the data with a new one."
Jim Galvin of Afilias, an expert in DNSSEC, warned that a “split DNS” – where a country effectively sets up its own Internet within its borders and controls access to the global Internet - and the DNSSEC protocol “do not match very well”.
Isn't that a good thing?
Dislike the Electoral College? Lobby your state to join the National Popular Vote Interstate Compact.
Another attempt to solve things in a hierarchical way that should have been rather fixed with p2p web of trusts so country and trust their own servers with a great degree than outside ones...
But no, centralized control is much more fun in the eyes of politician who care more about guaranteeing their retirement than freedom for everybody.
It's a shame the market didn't go down the DNSCurve (http://dnscurve.org/) road before DNSSEC. DNSSEC as it is currently implemented presents a significant challenge for DNS admins as their job just got more complicated while the tools are still barely capable. BIND with DNSSEC enabled for signing zones and updating your upstream TLD isn't set-it-and-forget-it so I don't see widespread adoption until the implementations are solved with easy point-and-click, set-it-once solutions.
Signing yourdomain.com requires you and .com to perform a transaction (registrar will perform on behalf of .com) that must recur at some interval for KSK and ZSK updates.
Deploying DNSSEC in response to cache poisoning is a lot like deploying TSA to protect the airports. Taking your shoes off and putting toothpaste in a little plastic baggie are kludges.
There is no reason to have TLDs. They perform no useful purpose other than to line the pockets of scheisters and satisfy the megalomaniacs at ICANN, who would otherwise have to bag groceries for a living.
DNS names are hierarchical. Each TLD is granted authority to manage its subsequent names as it sees fit and so on. Any attempt to secure this system should mirror the authority of the names themselves. Each country can control the distribution and authentication of names within their own TLD and DNSSEC just provides the appropriate level of cooperation for any client to read and validate those signatures.
Decoupling the hierarchical nature of DNS from a separate authentication mechanism that didn't follow this grain would be needlessly complex and could result in ambiguous or inconsistent results.
The TLDs serve a very important purpose: They're administrative boundaries. If the policies of one TLD don't suit you, choose a different one for your domains. The DNS root should therefore only have very limited say in how TLD registries do their job and indeed the TLDs are implemented very differently.
Is it better for one to control all, all to control one, none to control all, or all to control none?
As any solution, provide sustenance that grows value, not malice and malevolence. it is better not to consider control ever.
PreDNS-IPv4, DNS, DNSSec... One for all must be all for one, because institutional/national evil lurks behind every wall for everyone.
China, Clerics, C*Os, and some others seek global economic domination with in hall mazes behind stalinist/maoist walls.
I suspect, where DNS splits occur, it will be for nazi/fascist, religion/dogma, and/or faux-capitalism/corporate-welfare governance. "The People" will be like North Korean citizens (eventually without food, shelter, rights... as goes Iran).
A Nation of "The People" has all the rights, the government/institution is never the nation and should never have rights.
It is all about "The People" and civil rights.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
I disagree. Generic TLDs may be useless, but ccTLDs are useful for use in the rest of the world. I, for example, know when I'm buying something from a web shop with a .PT domain that the owner of that domain is a real company registered in Portugal, so it's easier to get my money back if something goes wrong.
Dilbert RSS feed
I was actually testing a theory, that even if the first post is absolutely pointless, there are people that MUST post their replies to the first post. Most topics here have tons replies to the first post, even if its garbage.
But why couldn't this be done for each entry? Instead of limiting entries to name.TLD, why not just let the registrant make any name and sign up for whatever rules set is desired? If I wanted to sign up for great.burgers, who cares if there is a .com, .net, .whatever anywhere in the name? It has always seemed arbitrary and constricting to me, especially in business where squatters make things overly interesting.
Then there'd be only one registry and one set of rules - the rules of the root registry. The separate registries are what keeps some level of competition alive. The root registry only gets to set basic interoperability rules, but the economics and technical implementations are the TLD registries' business.
I'm really not seeing much of a downside here. The greatest feature of public-key cryptography is its potential to undermine the state's ability to interfere with communications.
I think it would be a good thing to make everybody come before a properly-appointed board, just as they might come before the income tax commissioner, and say every five years, or every seven years, just put them there, and say, "Sir, or madam, now will you be kind enough to justify your existence?"
If you're not producing as much as you consume or perhaps a little more, then, clearly, we cannot use the big organizations of our society for the purpose of keeping you alive, because your life does not benefit us and it can't be of very much use to yourself.
I still don't see why this system couldn't be implemented sans TLDs.
In this case, because the DNS is hierarchical, a hierarchical signature system is the right way to authenticate the names. You hand the registrar for ".com" your $6.00 and a public key, the registrar gives you a signed certificate saying you're the Official Owner of "example.com". That doesn't protect you from trademark suits by other people who say *they* should own the name "example.com", or from somebody handing the registry forged papers saying that they're the domain administrator for your company, and it doesn't protect random members of the public from assuming that your domain "example.com" belongs to the company "Best Examples Of North America, Ltd", and maybe those services are something that wants a web-of-trust solution or a hierarchical solution from some different hierarchy, but it's a way for anybody to verify that the IP address they just fetched belongs to the real owner of the example.com domain name and not some forger.
Now, just because there's an absolutely correct simple technical method for handling DNSSEC signatures, that doesn't mean that's how ICANN will choose to implement it, or that they won't also issue DNSSEC signatures to the winners of trademark lawsuits or to governments that want to forge IP addresses for websites, but that's a separate problem. If you're worried about that, you can use DNSSEC Trust Anchors as a web of trust, and they've been in limited use while ICANN's been dragging their feet.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
We (the 'rest of the world') simply need to enforce the sovereignty of the Internet against any attempts at censorship. Give censoring states a few days to stop their malicious activities or face losing connectivity. If they don't comply (which I suspect they won't) simply cut them off the net once and for all.
Let them whine and bitch all they want. Censorship just isn't acceptable.
Maybe they'll grow up and become ready to join in the international community of free information... If not, just let them rot in their own swamp of ignorance and stupidity.
Nobody on /. has ever observed THAT before.
True, But many companies who are registered in Portugal, will be using a .com instead of a .pt.
.com seems to be preferred by certain companies all over the world.
I suppose that situation exists everywhere. The
On another note, if you wouldn't mind emailing me about some of those web shops in portugal, I would sure appreciate it. I have found it hard to locate shops in Portugal that will sell online.
-- -- Warning. Do not stare directly at the sun.
But I'll trust those less. I don't want to force them to register a .PT; but if I have two shops with similar prices for the same products, I'll choose the one with the .PT domain.
Well, shops that sell what? For, e.g., PC components there's plenty of them, but I don't have a list for any kind of shop.
Dilbert RSS feed
I was going to go into that in email, but basically, small electronics, books, DVDs and CDs.
-- -- Warning. Do not stare directly at the sun.
Hitler though 2+2=4. He also thought Jews should be killed.
I know tobacco is bad for you, so I smoke weed with crack.