Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
The Internet Security

Fort N.O.C.'s Security in Obscurity 297

Posted by michael from the insider-job dept.
penciling_in writes "Brock N. Meeks of MSNBC reports on his recent visit to VeriSign's secret location: 'The unassuming building that houses the "A" root sits in a cluster of three others; the architecture looks as if it were lifted directly from a free clip art library. No signs or markers give a hint that the Internet's most precious computer is inside humming happily away in a hermetically sealed room. This building complex could be any of a 100,000 mini office parks littering middle class America.' The report goes on to say: 'Access to the Network Operations Center, the "NORAD" of the Internet's traffic monitoring, requires the electronic badge and then a double biometric hand print scan.' And here are Karl Auerbach and Robert Alberti offering their interesting analysis of this report on CircleID."
This discussion has been archived. No new comments can be posted.

Fort N.O.C.'s Security in Obscurity More

Fort N.O.C.'s Security in Obscurity

Comments Filter:

  • Good for verisign.. (Score:5, Funny)

    by grub ( 11606 ) <slashdot@grub.net> on Friday January 23, 2004 @06:11PM (#8070405) Homepage Journal

    Sure, the .COM and .NET TLDs are safe from terrorists but one self-righteous bitch [training.edu.cx] can take down goatse.cx

    I'm still fuming about that.
    • you brought their server to a crawl by posting that...

      and im not sure which is worse to look at... the goatse man, or rhonda...

    • Good (Score:2, Offtopic)

      by Call Me Black Cloud ( 616282 )
      I'm glad it's down. Good on her for getting it done. Of course, the picture will live on elsewhere but at least she did what she could.

      Just because you can post something doesn't mean you should post something. Redeeming value of that picture? None.

      Yeah, baby, I'm using my real nick...unlike all the cowards who will doubtlessly reply.

    • Re:Good for verisign.. (Score:5, Funny)

      by juniorkindergarten ( 662101 ) on Friday January 23, 2004 @08:29PM (#8071673)
      I'm glad the goatse.cx is gone, but I had to laugh when I saw this on kuro5hin.org:

      An ode to goatse (2.73 / 19) (#59)
      by komet on Sun Jan 18th, 2004 at 05:25:25 AM EST
      (my user id @ the domain of my homepage) http://4you.ch

      To the tune of "American Pie" by Don McLean
      I can still remember how that image used to burn my eyes
      And I knew if I had my chance
      I could hide a link in a rant
      and maybe they'd be pissed off for a while.
      But January made me shiver
      with every link-troll I deliver
      Bad links on the doorstep, I couldn't take one more step.
      I can't remember if I cried
      when I heard about his orphaned site
      But something touched me deep inside
      the day the goatse died.

      So bye bye to the goatse site
      Put his fingers up his asshole and his asshole was wide.
      Yeah these old trolls were on Slashdot and K5
      Singing this will be the day the Net dies
      This will be the day the Net dies.
  • so .. if i (being a researcher and a nerd) was annoyed by this so called internet interruption .. i would also like to know "who" "we" should sue.
  • This could actually be dangerous. Whenever I hide something I seem to inevitably lose it...

  • "A" is in Dulles, VA (Score:5, Interesting)

    by havaloc ( 50551 ) * on Friday January 23, 2004 @06:15PM (#8070456) Homepage
    Although the article says that the location is a secret, a link from the article to www.root-servers.org happily tells you that server A is in Dulles.
    • now you've done it .. the terrorist will infiltrate the facility and map the goat [goatse.cx] everywhere!
    • That one in Dulles is a decoy. The real one is in my closet.


    • Oh, great. Now we have to kill everybody that reads Slashdot.

      • Re: "A" is in Dulles, VA (Score:5, Interesting)

        by El ( 94934 ) on Friday January 23, 2004 @06:49PM (#8070820)
        How come Homer and Krusty look like clones? Haven't you ever heard Matt Groening's explanation of this? The original joke in the first "Krusty" episode was that Bart had no respect at all for his father Homer, and yet he worshipped this television personality that looked exactly like his father... guess the irony was too subtle for most people.

    • Re:"A" is in Dulles, VA (Score:2, Informative)

      by Anonymous Coward
      http://www.iana.org/root-whois/com.htm [iana.org]

      The address in that whois is actually where the A root resides. Not a terribly big secret, even though the building is unmarked.

    • I've been there (Score:4, Interesting)

      by rs79 ( 71822 ) <hostmaster@open-rsc.org> on Friday January 23, 2004 @09:45PM (#8072197) Homepage
      Back in the good old days when her serene highness the Dalai Lauren worked there and Dave Holtzman was still VP I took the e-ticket tour. The facility is in a nondescript industrial mall a few miles from the NSI mothership.

      "oh, you'll want to see this"

      "what is it"

      "A-ROOT"

      "THAT tiny little thing?"

      "Yup. Go ahead and touch it, everybody that comes here wants to do that. See where the paint has worn off the case?".

      "Uh, ok"

      "You use this thing Dave"

      "Nah, I download the root zone from you [open-rsc.org]".

      "Cool, for that you can buy me lunch".

      "Good idea. Thai okay?"

      NSI was fun once and there's lots of good stories. When the FNCAC made the NSF tell NSI to start charging for domain names none of the freaks working at NSI could believe you could charge for this and lots of checks were just pinned up to a bulletin board in a "wait and see" holding pattern for a few months. There weren't so many domains back then.

      Karl Aurbach also downloads the root zone from me and you should too. Or use OpenNIC [unrated.net]'s root or even *cough*ICANNs*cough* (ftp://internic.net/domain/root.zone.gz [internic.net], or any root.zone you want but if you know what's good for you you won't rely any anybody but yourself to serve up the root zone so your computer can find pointers to the various TLD servers: primary the root for yourself and don't worry about DOS attacks on other peoples computers taking your machine off the air.

      That really was the dumbest part of the change from hosts.txt to the DNS - it changed the paradigm from your computer knowing where everything was to making your computer rely on the "." zone to be able to find the computers that know where all names can be found and there's really no reason for it.

      Certainly it does not scale for everybody to grab a copy of the root from one place, and Dan Bernstein has suggested [cr.yp.to] a cryptographically signed root be distributed via usenet. To this end I've created news:alt.root.orsc and will begin doing just that this quarter.
  • So I guess CmdTaco and CowboyNeal will never get in there........thank god!

    I can't imagine having all my domain requests going to Slashdot.org......I'd have sensory overload!

  • sigh (Score:4, Insightful)

    by jap ( 24325 ) on Friday January 23, 2004 @06:16PM (#8070461) Homepage
    Sigh. Deep Sigh.

    There's more than the 'A' root server. Taking "it" down leaves a whole hurd of other root servers alive. Located all around the world.

    The above linked articles are full of that which promoteth growth.

    • Re:sigh (Score:4, Insightful)

      by jayhawk88 ( 160512 ) <jayhawk88@gmail.com> on Friday January 23, 2004 @06:20PM (#8070514)
      Which the article actually states.

    • Re:sigh (Score:5, Funny)

      by 93 Escort Wagon ( 326346 ) on Friday January 23, 2004 @06:23PM (#8070550)
      "There's more than the 'A' root server. Taking "it" down leaves a whole hurd of other root servers alive."

      Shouldn't that be "a whole GNU/hurd"?

  • SiteFinder (Score:5, Funny)

    by Sparky77 ( 633674 ) on Friday January 23, 2004 @06:16PM (#8070463) Homepage
    This is also the building that has the big red button labeled "Hijack Internet Traffic"

  • Cool... (Score:5, Interesting)

    by Shoten ( 260439 ) on Friday January 23, 2004 @06:16PM (#8070470)
    It's cool to see someone write about the building you used to work in! I worked in this building, a bit more than 2 years ago. I was in Network Solutions' consulting arm, whose DC office was in that building, two floors under the NOC. The security really is as spectacular (and low-key) as you'd expect. You would NOT believe the camera surveillance they have facing outwards...you can see some of it, but you can't see some of them at all. And the cameras themselves are startlingly cool...there's a small strip mall across a major highway from the facility, with a clear line of sight. One of the security guys showed me how far the zoom worked, as he zoomed in on a guy smoking in front of a bookstore in the strip mall...about half a mile away. It was still a clear picture.

    When 9/11 happened, we were not allowed back into the building for a couple of days, but all they had to stand up as barriers were road cones. Luckily, they're finally moving to a location that isn't just obscure and secure, but armored, as I hear their Mountain View, CA location is.

    • How much physical security is necessary? (Score:4, Insightful)

      by Wingchild ( 212447 ) <brian.kern@gmail.com> on Friday January 23, 2004 @06:29PM (#8070605)
      I'd like to see some statistics on how many people attempt to invade/evade the physical security checks at Netsol's NOC that require and necessitate facilties on that level. The same goes for most any datacenter - your physical security is awesome, but why?

      Aren't most attacks against servers launched over that intarweb thing?

      I can't recall the last time someone tried to suicide bomb a root server. :)

      • Re:How much physical security is necessary? (Score:5, Informative)

        by cmowire ( 254489 ) on Friday January 23, 2004 @06:35PM (#8070680) Homepage
        In Australia in the past year or two, some folks dressed up as maintenence workers and drove off with an allegedly important government server.

        So it does happen.

        I still have to test every 5-pin simplex lock for important rooms to make sure that it's not a simple combination, because when I had access to a datacenter, it was a damn simple lock.
      • Answer: Because there are clients who want that kind of security, for whatever reason, and are willing to pay handsomely for it. You're also probably not going to knock the root servers offline with a DoS attack, seeing as they see so much traffic that a DoS probably wouldn't put a noticable dent in their usage.

        Besides, I don't think they're worried about terrorists, but more of the Kevin Mitnick types who are willing to mix "social engineering" with computer hacking. Tell me there's not a hacker out there
        • The Root Server DDOS [google.com] was October 20-22, 2002. It wasn't totally successful at shutting them down, but it made a serious dent in several of the systems for a while. We still don't know who did it, whether it was some craX0r k1dd13 looking for bragging rights or the Department of Homeland Security trying to get more funding or trying to get official bureaucratic authority over the root servers. And a measurement shortly before that event found that 98% of the queries to the root servers are bogus (repeat
      • I'd like to see some statistics on how many people attempt to invade/evade the physical security checks at Netsol's NOC that require and necessitate facilties on that level. The same goes for most any datacenter - your physical security is awesome, but why?

        Because some resources are so important that even a single breach can be devastating. It's a tough thing to engineer around. For resources like that, you calculate the cost of failure, identify a reasonable relative cost to invest to prevent that failur

  • In the case of a nuclear attack? (Score:5, Interesting)

    by Sean80 ( 567340 ) on Friday January 23, 2004 @06:18PM (#8070491)
    OK so I have to admit I don't understand the technology here any more. Back in the day, they say the Internet was built to withstand a nuclear assault. With phrases like "the Internet's most important computer," how can this be true?

    If this building were destroyed by a nuclear weapon, what would be the impact on the Internet?

    • Because there are several "almost as important" computers in other locations ready to take over should the "most important" one go down.

    • Re:In the case of a nuclear attack? (Score:4, Insightful)

      by gordyf ( 23004 ) on Friday January 23, 2004 @06:21PM (#8070530)
      Not much. There's a bunch of other root servers scattered around the world; this just happens to be the first one.
    • The internet is designed to withstand broken routes, etc. However, if all of the nameservers go down, then you'll have to remember IP addresses!

      If this building went down, then you wouldn't notice anything. IIRC, (and the article says so, I belive), all DNS info is cached at your local ISP. That's why it takes a few days to propagate across the any IP address changes to your domain...

    • Re:In the case of a nuclear attack? (Score:5, Interesting)

      by Wingchild ( 212447 ) <brian.kern@gmail.com> on Friday January 23, 2004 @06:26PM (#8070572)
      Back in the day, they say the Internet was built to withstand a nuclear assault.

      DARPA was running a research project to build a networking system capable of intelligent self re-routing in the case of points of failure, so that a single network outage couldn't prevent traffic from flowing through. The extended concept for ARPANet was that if a major segment of the network vanished it might still be possible for data to be routed, hence the `it can get nuked and still survive` quotes people toss around.

      Most unfortunately the internet itself is not always as robust; if certain routers are knocked out, large segments of the networks behind them stay unreachable for long periods of time, mainly because of serious network mismanagement on the part of the people who really ought to know better.

      One can also never understimate the power and prevalence of Backhoe Fade [petting-zoo.net].

    • Why do people keep repeating that myth? (Score:5, Insightful)

      by Medievalist ( 16032 ) on Friday January 23, 2004 @06:35PM (#8070685)

      The design documentation of the Internet is globally available... wait for it.. on the Internet!

      If you examine it, you will notice that
      a) DNS is not part of the original design
      b) as designed, it WON'T survive a nuke
      c) nobody intended it to.

      What it *was* designed for was a limited fault tolerance - based on the idea that phone companies suck and the guy that runs the next node is an idiot who can't be trusted to tie his own shoes.

      Turns out they were right about those last two points, incidentally.

    • Re:In the case of a nuclear attack? (Score:4, Funny)

      by chimpo13 ( 471212 ) <slashdot@nokilli.com> on Friday January 23, 2004 @06:41PM (#8070739) Homepage Journal
      If this building were destroyed by a nuclear weapon, what would be the impact on the Internet?

      Oh, there's lots of things that would happen:

      Mutants would crawl the Earth, CHUDs would be in the sewers, thalidomide babies would get super strong ESP and take over satellites to tell us they don't like cigarrettes and brandy, we'd have to go back to pr0n in the magazine form (but bukkake would thankfully disappear), and the Omega Man would kill zombies. There's plenty of others, but I don't want to give away the ending (but it sounds like oylent-say een-gray is eople-pay).

  • What were they expecting? (Score:5, Funny)

    by funwithBSD ( 245349 ) on Friday January 23, 2004 @06:19PM (#8070504)
    The temple from Tron?

    Approch, Program, and speak to your User...

  • LINUX Analogy (Score:5, Insightful)

    by YukioMishima ( 205721 ) on Friday January 23, 2004 @06:19PM (#8070510)

    This story is news, but I kept expecting some point of contention in the article, rather than some musings on decorating schemes that were compared to clip art.


    I found my point here:


    The root server operators "have no contract with anyone, no guarantee of level of service, they could turn [the root servers] off tomorrow with no consequences at all because they are doing it out of the kindness of their heart," said Internet consultant Ambler. "ICANN needs contracts with the root server operators that specify minimum levels of service and minimum levels of security and the root servers need to be paid for that," he said.


    Why is it so confusing to imagine that (a) People do like to do things out of the "kindness" of their collective hearts, and (b) security is not always "secured" by either contracts or money? I understand the legal protections associated with contracts, but I think there's a chance that the root server operator system, as it stands, could alternatively be viewed as something successful - something, much like the open source software movement, that works, not because of contracts or restrictive covenants, but because people enjoy contributing to something useful for their own and others' use.

    • Why is it so confusing to imagine that (a) People do like to do things out of the "kindness" of their collective hearts, and (b) security is not always "secured" by either contracts or money?

      Because unlike software, bandwidth is never free.
    • "Why is it so confusing to imagine that (a) People do like to do things out of the "kindness" of their collective hearts"

      Probably because if something like this goes down, there is no one that will step up and accept responsibility. But if they were all under contract then there would be someone responsible for the failures. Its not just some project anymore, it is the heart and lungs of the entire system and it needs to give guarantees.
    • individual to go "postal" and screw things up unfortunately. I subscribe to the "people enjoy contributing to something useful for their own and others' use" theory as well, but I also subscribe to the "people are sometimes unnervingly unpredictable for no apparent reason" theory as well; consequently I understand the need for more defined and structured contracts.

      It only takes one bad apple...just one.

    • Re:LINUX Analogy (Score:5, Interesting)

      by karl.auerbach ( 157250 ) on Friday January 23, 2004 @06:45PM (#8070779) Homepage
      Microsoft - or SCO (if it had the cash) - could go out and try to buy all the root servers. There is nothing to stop the root operators from selling out.

      Nor is there anything that prevents root server operators from giving preference to queries coming from paying IP addresses.

      All of that is hypothetical, but without legally enforceable obligations, we're just hoping that nothing changes for the worse.

      And things *do* change - for example, back in the 1980's SCO was a fun company here in Santa Cruz.
      • There is nothing to stop the root operators from selling out

        This comment goes to the heart of the matter; I hope we never see it proven correct. I also hope for universal peace and brotherhood, and you can see what good THAT does me.

        Remeber Google before Google-bombing? Remember USENET before spam? Remember the World Wide Web before popups? Remember email before viruses? Remember the internet before the Morris worm? Remember all those things that didn't need to be secured because we were all pure of hear
    • Why is it so confusing to imagine that (a) People do like to do things out of the "kindness" of their collective hearts

      You think Verisign does anything out of the "kindness" of their heart? They do it so they can control some aspect of the Internet. Do you not remember SiteFinder?

    • "Why is it so confusing to imagine that (a) People do like to do things out of the "kindness" of their collective hearts, and (b) security is not always "secured" by either contracts or money?"

      The people who worry about that are people who worry about maybe upsetting their current friends sometime in the future. Right now, they are friends, but what happens if in the future the different parties no longer share common goals for the DNS?

      The relationship may be friendly today, but maybe not tomorrow, so the
    • "But in a contract situation, legal liability issues will inevitably crop up, Farber said, as would the issues of who do you sue and where do you sue."

      Only in Verisign would the ability to sue someone be more important than a stable root-DNS server...

  • the Network Operations Center, the "NORAD" of the Internet's traffic monitoring,

    I'll say. Did you see that photo? It looks like something out of WarGames. God help us if those computers decide to play games.

  • nobody cared about security two years ago? (Score:5, Insightful)

    by kilbo ( 725707 ) on Friday January 23, 2004 @06:21PM (#8070524)
    "But Ambler nearly chokes on the word 'defense' noting that 'up until two years ago nobody gave a rat's ass for security of the root servers because if the Internet went down it would have been an annoyance to some researchers and nerds.'"

    I guess amazon.com [corporate-ir.net] which went public in 1997 must have been frequented only be researches and nerds for the first 5 years of operation.

    • I guess amazon.com which went public in 1997 must have been frequented only be researches and nerds for the first 5 years of operation.

      Well, let's see...

      1997, loss of $31 million
      1998, loss of $125 million
      1999, losss of $719 million
      2000, loss of over $1 billion
      2001, loss of $567 million
      2002, loss of $149 million

      Yeah. I'd say the statement is more or less correct.

  • Surprised? (Score:3, Interesting)

    by Wingchild ( 212447 ) <brian.kern@gmail.com> on Friday January 23, 2004 @06:21PM (#8070526)
    Digex [digex.com], along with other major hosting and co-lo facilities, has had these kinds of systems in place for their datacenters for many a year. And yeah, most of them look like very non-descript office buildings - a great many I've seen are in warehouse-style industrial complexes, far off the beaten path of regular office space and retail properties.

    You have to wonder if they're a little overboard, though; the military doesn't typically have checks that secure to get into specific rooms - not even TS/SCI environments. Though, to be fair, the military certainly has an edge on physical [af.mil] security [fas.org].

    I guess if you're really concerned about your data being physically secure, you could always co-lo out at Sealand [havenco.com], too.
    • Heh, The first link you provided (to cheyenne mountain) has a self-signed SSL cert. Of couse this prompted my browser to ask if I trusted cheyennemountain.af.mil, to which I promptly said "no".

      Do you trust them?

    • You have to wonder if they're a little overboard, though; the military doesn't typically have checks that secure to get into specific rooms - not even TS/SCI environments.

      They go a little overboard because they have two things the military doesn't... Insurance companies they are answerable to and lawyers that advise them.

      That being said; The barriers to entry depended on what kinds of TS/SCI are being gaurded. (SIOP or crypto material for example both have their own special handling, storage, and acess

  • What's the deal here? I mean, isn't the Internet supposed to be decentralized? Who cares if the Internet server in some EZ-mini storage goes down? What's the worst that could possibly happen?

    And if it really is that bad, then why aren't we working on making stuff more redundant? All I know is somebody needs to spend money on this, just like the power grid. It's not glamorous, so no politician will run with it, but I think we should have some kinda dialup internet tax to pay for it.

  • Oh, for the days of hosts.txt (Score:5, Interesting)

    by shoppa ( 464619 ) on Friday January 23, 2004 @06:24PM (#8070553)
    Back in the good old days, if you had a recent copy of hosts.txt all this was irrelevant :-). But it's been most of a decade since just anyone could download it.
    • The Root Zone is really small - a few global TLDs, a couple hundred CCTLDs. It's about 10KB. Even if they added DNSSEC to the whole root zone it'd be under a meg. Might as well get a copy.

      The equivalent for .com is obviously much bigger - I think there are ~35 million names (maybe that includes .net). But that's still about 5GB of highly compressible data - probably about 1GB if you sort it appropriately first. That's about the size of a Linux distribution - use BitTorrent [216.239.41.104]. That's about 3 hours on

  • I'd hate to think the internet depends on SCO UnixWare running on an old 486 ;) Jonathan

    • I don't know about A, but C is a Dell PowerEdge running I think FreeBSD.

      Root servers don't actually do all that much, they just have to be ready to do it 24/7.

    • Naw, everyone knows it runs Windows ME >:)

      There was much unhappy buzz at Sun when they switched from Sun (presumably Solaris on Sparc) to IBM. My guess is AIX on a big PPC box, being that IBM was not a Linux company at the time and Linux didn't/doesn't exactly take advantage of that kind of hardware either.

    • I'm not sure if your question was serious or not but I was curious about the OS used for this.

      The best I could do was this [icann.org] document referencing Y2K from ICANN's site.

      From the page:

      The root servers themselves all use some variant of the Unix operating system, however both the hardware base and the vendors' Unix variants are relatively diverse: of the 13 root servers, there are 7 different hardware platforms running 8 different operating system versions from 5 different vendors.

      I would not be surprise

  • Backhoes don't respect biometric hand prints (Score:5, Insightful)

    by G4from128k ( 686170 ) on Friday January 23, 2004 @06:30PM (#8070615)
    I can only hope that their NOC has multiple fibers coming to the building and that those fibers aren't in the same trench.

    The other potential source for a single-point of failure is the OS that the root server uses. If Verisign uses any kind of monoculture, they will not be as secure as we might hope. A hacker or botched OS patch could hose the thing.
  • My favorite quote:
    In addition, the company runs both the .COM and .NET databases, making it one of the most powerful and influential forces in the Internet. As such, VeriSign's actions often end up being only slightly less controversial than the sport of dwarf tossing.

  • Hi, I'm stupid (Score:2, Flamebait)

    by Gothmolly ( 148874 )
    And I think that DNS is centralized.
    And I think that more government interference with the Internet is Good.
    And I believe FUD.
    And that Al Gore is pretty technical guy.
    And I use AOL on my 'puter.

    Please send more informative articles like this. I use them to line the insides of my tinfoil hats.

    Thank you very much.

  • Wrong (Score:2, Funny)

    by naoiseo ( 313146 )
    all you need to access it is a bomb, or, pretty much anything that explodes spectacularly.

  • Ummm...it's not really that secret (Score:4, Interesting)

    by PenguinRadio ( 69089 ) on Friday January 23, 2004 @06:40PM (#8070717) Homepage
    I've had a few guys point it out to me before. Many DC / Dulles Toll Road-types know where it is.

    Now, there are other buildings in DC that's are much more cool. Like the one on the Toll Road with green "windows" that are merely for appearances as the entire building is solid concrete. Or the stuff in Crystal City that is bathed in electronic white noise to prevent eavesdropping.

  • Sod it. (Score:5, Funny)

    by Dark Lord Seth ( 584963 ) on Friday January 23, 2004 @06:40PM (#8070718) Journal

    Unless the NOC was ordered at this [villainsupply.com] place, I'm not impressed.

  • Seen on the sidewalk the next day... Oh Shit (Score:5, Funny)

    by PetoskeyGuy ( 648788 ) on Friday January 23, 2004 @07:01PM (#8070923)
    ROOT-A
    --\ /--
    )(
    --/ \--
    20 MBs

  • Not exactly a dupe.... (Score:4, Informative)

    by stoolpigeon ( 454276 ) <bittercode@gmail> on Friday January 23, 2004 @07:05PM (#8070958) Homepage Journal
    but here is the /. thread on this facility from March, 2002. http://slashdot.org/article.pl?sid=02/03/29/144922 8&mode=thread&tid=95 [slashdot.org]

    To be honest it is kind of embarassing that I immediately thought- "I just saw something just like this on slashdot not long ago" to find out it was almost 2 years ago. I didn't look at the new article close enough to see if there were any big differences over the years. To be honest the articles are spooky similar. Hmmmmm.

  • All this high tech biometric stuff is almost as cool as these badgers [badgerbadgerbadger.com]. Woah...

    Almost.

  • Visitors are "tagged and bagged" and made to sign de facto non-disclosure agreements before being lead to an elevator.

    "Tagged and bagged"? Really? Visitors are killed, inventoried, and their remains placed into a body bag? And then they're asked to sign an NDA?

    That really is tight security!

  • Wrong Architecture = More Fragile (Score:5, Informative)

    by billstewart ( 78916 ) on Friday January 23, 2004 @07:46PM (#8071289) Journal
    Anycast is a good approach for some kinds of problems, but fundamentally the A Root and the other rootservers are a more fragile environment than they should be because they're not using the hierarchichal nature of the DNS system appropriately. Last year's DDoS attack on them demonstrated some of this vulnerability. The Root Servers have three main jobs:
    • Distributing the database to major servers (at least one machine from each of the 13 often-virtual root servers, plus the master DNS servers at the Tier 1 ISPs, the CCTLD servers, and some small number of other sites
    • Answering DNS queries from the major servers
    • Answering DNS queries from any random machine on the Internet
    The system becomes performance-critical to lots of people because too many machines send queries to the root servers (or the .com and .net servers) instead of querying their ISP's DNS server, and too many small ISPs are also querying the root servers instead of their upstream's DNS server. DNS scales well because most information can live near the bottom of the net, and almost all queries can be resolved locally or nearby without have to go ask Jon Postel's ghost for the authoritative answer.

    The root zone itself is probably under 10KB of data that doesn't change every day - if you provide a separate server for zone transfers and let 1000 other DNS servers have access to it (firewalled to prevent any other IP traffic), that's about half an hour on a 56kbps modem. Remember that all it's doing is answering good questions like "Where are .com's name servers?" "Where are .za's name servers", bad questions like "Where are .example,com's name servers?", "Where is 10.in-addr.arpa?" and ugly questions like "Where is Ping of Death?". Let the major servers handle most of the work, absorb the ugly packets and do some queries for bad packets, and let the general public query those anycast machines - they should be querying their ISPs' servers, or their upstreams', which cache the real information, and even when their queries aren't bogus, they shouldn't be blocking the internet-stability-critical traffic.

    The .net, .com, and .org domains are a similar problem, except of course they aren't served by the root servers. The zones are much bigger, a few gigabytes size, but probably only 10% of it changes in any given month, or 99.9999% of the existing domains, which ought to be enough to call the Internet stable, using about 1 Mbps (10GB * 1%/day * 8 bits/byte / 24*60*60 ), and again, keep the public query traffic separate from the zone transfer traffic, and maybe offer a third set of DNS servers to answer queries from the big ISPs to handle things like newly created domain names. The reason to keep that kind of query traffic separate is to avoid attacks like "query bogus00001.com" "query bogus00002.com" ... etc.

    Obvious flame-attracting discussion points:

    • What about the Alternate Roots? They argued that there's no excuse for ICANN/versign/etc. to own the TLD space and PROFIT from selling names like *.sex. Fine - they can use my ideas for free :-)
    • DJB likes rsync+ssh better. He might be right, but I'm trying to look at the small incremental change approach.
    • This makes nic.big-ISP.net a much bigger target! It's already a target. They can apply the same approach recursively, plus their users can still query the roots, and they probably have a somewhat distributed architecture already.
    • But the Internet is supposed to be any-to-any and this sounds like hierarchical corporate hegemony! Alas, too late for that, and if a 56kbps line can handle 1000 root zone transfers in half an hour, a T1 line should be able to handle 50,000 ok. Meanwhile, even covering the top 100 ISPs covers most of the Internet's users for stability.
  • Thumbs down to MSNBC for spooning up a dripping dose of Verisign PR.
    Thumbs up to consultant Christopher Ambler for getting them to print "rat's ass."

    "From our perspective, I think that clearly we are the leader in that particular area..." says Ken Silva... He believes that none of the other root server operators can match VeriSign's investment. etc, etc, etc. Abruptly he pulls his hand away, like a small child sensing the heat radiating from a stove burner. "Can you pull that door closed? I didn't hear
  • Reply to this if want to make a $$$ offer.

  • 98% of Root Server Queries are Unnecessary (Score:5, Informative)

    by billstewart ( 78916 ) on Friday January 23, 2004 @09:13PM (#8071999) Journal
    According to an October 2002 study [216.239.41.104], 98% of queries to the F Root Server (and therefore probably to the other root servers) are unnecessary. Either they're duplicates (75%) or they're for bogus TLDs (.localhost, .elvis, .corp, etc.) or they're in-addr.arpa queries for RFC1918 addresses, or they're some other bogus query, and they should have been served out of cache or handled by some ISP's DNS instead of bothering the roots. Maybe the A Root has some important functions, but they aren't what it spends its time on. And 50% of the queries come from about 220 servers - they should either be caching responses, or be shuffled off to some server that handles them (I guess anycast will help with this...) as well as cleaning up their act if they're broken, which some of them are.

  • $150 million, $0 of which went to the doors (Score:4, Funny)

    by slagdogg ( 549983 ) on Friday January 23, 2004 @10:09PM (#8072333)
    At the beginning of the article:

    ... VeriSign isn't shy about touting the $150 million it has invested in various security measures.

    A bit later ...

    "Can you pull that door closed? I didn't hear it click," he asks of the person standing nearest to the first door.

    "Click."

    Sheesh, for $150 million you'd think a robot would double check the door for them.

Slashdot Top Deals

Byte your tongue.

Close