Life, the Universe and Everything » root server

Moving on …

wnagele — Sun, 06 Jan 2008 13:35:05 +0000

Some of you probably already know i’ve received a bargain from the RIPE NCC to join their DNS operations team. I used the holidays to reflect all of this and finally decided to take this opportunity. The work will be focused around the operations of the K root DNS server which is a great personal challenge for me. I also would like to take this as a starting point to bring more attention to alternative DNS root server networks like ORSN, although i’ll have to leave my active work due to a possible conflict of interests behind.

This means, i’ll move to Amsterdam by the beginning of February 2008. Which in turn means, i’ll have lower chances to work for FunkFeuer and the other projects i’m involved with. I’ll however try to keep as much work ongoing as possible. Also i’ll be in Vienna from time to time. Depending on how things work out … (Maybe i hate Amsterdam ).

Taking lead on ORSN project

wnagele — Fri, 13 Apr 2007 12:54:42 +0000

I write this, to clear things out and show what my future plans are.

I’ve followed the progress of Open Root Server Network since 2002. While supporting it by using their service since then i switched on operating the node B in September 2006. This node is sponsored by FunkFeuer in Vienna as a successor of ATnet which closed it’s service for that node after it was sold to EUnet.

Currently, in my opinion – ORSN is a proof of concept. This means that we’ve shown that it’s possible to run an independent root server network which sticks to the zone principles of ICANN. But it has still to be considered experimental and needs some further steps to get interesting for the big ISPs too. While talking to operators of UPC, SilverServer and some others the main issue they are concerning about is the stability. They don’t think we’re poisoning the zone but somehow hessitate to switch before other big players did so. So we’re currently having an hen and egg situation. Questioned how to break this most of them came up with the idea of a legal entity focused on the development of the future network. The outcome of this should be some kind of mission statements which show exactly where we are and where we want to go.

As Markus Grundmann is currently very low on his spare time i’ve choosen to take the lead of the project for a while and will try to get following challenges a bit futher.

Legal entity
We’re currently thinking about an appropriate aproach for this. There needs to be considered that we don’t want to fall in the same position ICANN currently is (controlled by one government). Also we don’t want to be based in one country nor in one continent. But question here also is, what will keep our organisational costs minimal.
DNSSEC
Although there is at least one open issue (“Zone walking”) on DNSSEC itself, it’s probably good to do the first step into a more secure DNS.
Personally i don’t consider zone walking as a blocking issue for the introduction of DNSSEC because i stick with the “DNS is public”-argument. I am more concerned about the performance issues this might cause.
Anycast
Currently the load on our servers is not that high as we would need Anycast structure, but if we head forward in providing service to big ISPs the stability will be a big issue – as said. Considering the importance of our service we will get a more interesting target for attackers too.

I hope this gives people interested some insight on my planned steps for the further development of ORSN.

US Department of Homeland Security demanding DNS Masterkey

wnagele — Mon, 02 Apr 2007 09:14:45 +0000

As some of you probably already heard from the news the DHS demanded his claim for the upcoming DNSSEC masterkey. This throws up several questions about aplomb of ICANN and IANA once again.

I have to say that i was also not really thinking about that issue much in my time before participating in ORSN. But which came up as a simple operator job for a DNS server worked out as a big political thing. More on this later.

Latest trends should bring all other nations in an alarm state. Fact is, if one country should ever be capable of this key it’s the country that controls the root zone itself. As recently shown ICANN is not doing quite well with legal issues on basis of privately held firms – so for me this questions how they do with governments? I personally would see it as best solution if this would go to a neutral authority (UN is one example) or maybe they would take the path the ITU did (if still possible) once.

So what does this mean for the Open Root Server Network? Well, several things. We are currently working on our approach to bring in DNSSEC to the root zone. As some of you might ask – what’s the big deal? Clearly said it’s not the technical aspect.

There is still an open question about zone traversal and DNSSEC. As DNSSEC in the root zone would close the last gap in the hierachy this should be considered.
Holding keys securely and still available for the signing work is an important thing to work on.
Get people to use the functions is absolutely necessary. So a lot of lobbying work has to be done.