ietf
[Top] [All Lists]

Re: national security

2003-12-06 18:37:09
iljitsch(_at_)muada(_dot_)com (Iljitsch van Beijnum) writes:

... (Selecting the "best" path is pretty much an after thought in 
BGP: the RFC doesn't even bother giving suggestions on how to do this.) 

congradulations, you're the millionth person to think that was an oversight.

I don't have a problem with some controlled anycasting, but the root 
operators shouldn't go overboard.

i don't think you will ever meet a more conservative bunch of people, so, OK.

For instance, the .org zone is only served by two addresses, which are
then anycast. There have been reports from people who were unable to
reach either of these addresses when there was some kind of reachability
problem. The people managing the .org zone are clearly lacking in
responsibility by limiting the number of addresses from which the zone is
available without any good reason.

see the icann agreements to find out how much of this was ultradns's choice.

The situation that must be avoided is where all or most root servers 
seem to be in the same location from a certain viewpoint, as a BGP 
black hole towards that location will then make them all unreachable. I 
would prefer it if several root servers weren't anycast at all, just to 
be on the safe side.

that's exactly what's likely to continue happening.  diversity is good.

(And some IPv6 roots wouldn't be bad either.)

there are several.  see www.root-servers.org.  (now if we can just advertise.)

You missed the point in one of my previous messages: there is no
officially supported way to do zone transfers for the root. This can stop
working at any time.

indeed, it's been downhill ever since 10.0.0.53 went away.  now it's chaos.
-- 
Paul Vixie