This is a follow-up to my previous posting: An Open Letter to NTIA, ICANN, and IANA
In a few days Verisign will remove approximately 15% of the IPv4 address information that the domain name system (DNS) provides when DNS resolvers try to find the set of root servers and the .com and .net top level domains.
The apparent motivation is to promote IPv6, which is used by approximately 0% of the community of internet users, at the expense of IPv4, which is used by approximately 100% of the community of internet users.
Yes, innovation is important, and IPv6 is a useful innovation. But just because something is useful does not mean that we should blindly deploy it. Is there word on this issue from those who's job is to oversee the stable, reliable, accurate, and efficient operation of the upper layers of the DNS? In particular, has either NTIA, ICANN, or IANA presented a convincing proof, or even any proof, that this change is safe and warranted at this time?
No.
Perhaps those whose job it is to ensure the safety and stability of the net are sleeping or off playing some other game?
I have received a communication from ICANN that simply tried to tell me that "[m]any of the issues you raise are not as dire as you fear." However that assertion was not accompanied by any supporting evidence or rationale. There is no reason to believe that such supporting evidence or rationale exists.
Some people have asked me to further elaborate my concerns. This I will do here.
I am personally not very fearful that the net will be harmed immediately as the result of the change being made by Verisign. I am concerned, rather, with the longer term impact.
In particular, I suspect that the absence of a few IPv4 address records will most likely not cause any ill effects on resolvers that already have nicely filled caches and probably already have learned the address information that Verisign will be eliding. Nor do I believe that resolvers that can reach most of the constellation of root and .com and .net TLD servers will have difficulty obtaining the soon-to-be missing server address information except perhaps at the cost of a few more startup packet exchanges than previously.
My concern is more for resolvers that are coming online after an outage due to a natural or human disaster.
In particular, I am concerned that during a time of trouble, a time when the constellations of root and TLD servers may not be fully reachable, a freshly started DNS resolver may find that the absence of sufficient IPv4 records in responses may result in that resolver not being able to reach fully operational status.
During halcyon times the internet is quite robust. But we are not living in an untroubled age. We know that the DNS root servers are under continuous attack 24x7x365. And we know that there are a lot of ill minded and evil people out there who do have the capacity to add more stress to our systems. And mother nature has her own agenda.
Is it silly or wrong to ask that those bodies who's job it is to ensure that the internet works actually demonstrate that a proposed change will be safe?
There is no exigent circumstance that requires that IPv4 address records be removed this week and be replaced by IPv6 address records. There is no reason we can not pause so that we can understand the issues and make informed choices.
There are those who have said that IPv6 needs to move forward. I agree. But it should not move forward by imposing an unknown risk onto who depend on the existing internet and IPv4.
The deeper issue remains - neither NTIA, ICANN, nor IANA seem to be willing to exercise technical oversight. These bodies seem pervaded by the ghost of Dr. Pangloss and have inherited his inability, or unwillingness, to perceive danger or risk and to consider the status quo to be the "best of all possible worlds."
The internet is a complex system; we do not well understand how it fails or degrades. Nor do we comprehend its increasing interdependency with other systems such as the electrical grid, air-traffic-control, emergency services, and voice telephone systems.
In most engineering disciplines a deployed system that has become a utility, as the internet is becoming, is not changed on a whim. Rather, change is viewed with suspicion and implemented only after careful analysis of the change and its benefits and risks.
NTIA, ICANN, and IANA operate not on principle and conservative rules but on the basis of political expediency. This ad hoc-racy is forming a kind of rust on the internet. Rust does not cause immediate failures. Rather it accumulates and manifests itself at the worst of times. Failure to paint a ship today does not cause it to sink tomorrow. But lack of painting can result in a hatch cover failing during a storm or a lifeboat davit jamming during an emergency. An NTIA, ICANN, IANA choice to allow the removal of IPv4 address records may not be noticed next week, but it might result in preventable name resolution failures next time a hurricane crosses the Caribbean or some awful event disrupts internet connectivity.
ICANN and NTIA (along with much of the US Government) have taken the position that oversight of the internet's DNS belongs in the hands of ICANN and not the International Telecommunications Union (ITU). However it is very difficult to give much credit to that position given the apparent incapacity of ICANN and the NTIA to actually oversee the DNS.
If ICANN or NTIA want us to believe that the job should remain in ICANN's hands then it seems only right and proper that ICANN actually begins to do the job. Otherwise we should fire ICANN and get somebody else to ensure the stable operation of the DNS.
Posted by karl at October 18, 2004 12:57 AM