Thank you. Thank you all for coming.
This is a sort of a modification of a talk I've been giving for a while.
At Usenix Lisa they refer to this as Vixie's Internet Governance Rant.
But I realized I wasn't doing much good and that I needed to behave more like a bomb-tossing revolutionary
and less like a politician.
And Jeff gave me an opportunity to test-pilot the new talk here,
where apparently bomb-tossing revolutionaries are more prevalent.
Okay. One of my favorite authors, Barbara Tuchman, wrote a book.
And you need to go to Amazon.com and get a copy of that book for yourselves.
Trust me on this. If you hate it, then send it to me and I will give you your money back.
Can I talk closer to the microphone? Yes, I'm concerned about the echo.
So what Tuchman had to say about folly, of course, takes a book to say.
But qualifications, as you can see on the slides, it has to be seen as counterproductive in its own time.
It's very easy to look back with the benefit of history, a lot of perspective, and say,
well, that was very stupid. To be folly, it has to be obviously stupid,
even at the time the decisions are getting made and implemented.
There had to be a feasible alternative, right? You can't really call it a decision
if all you were doing was running away from some circumstance right there.
There had to be some choice that you could have made, that a sensible person in your place would have made,
and then it can be called folly.
And lastly, it can't be the action of just one guy, one person,
because that could be a simple matter of mistake, right?
You don't have all the facts or you drank too much or something.
But if you had a group of people together and they all sort of nod sagely at each other
and say, yes, this is the right thing, but it's completely boneheaded,
that, in Tuchman's definition, can be called folly.
And the examples that I picked out for this slide would be Troy and the Greek horse.
We call it a Trojan horse. It's actually a Greek horse.
But anyway, the signs and portents, if you read the original Homer on that,
are really, really obvious, right?
They didn't just put a wooden horse in front of the city and disappear,
as you might read in the Cliff Notes version.
There were all kinds of different things.
Just everything from the weather to, you know, hints and tips and so forth
to really let you know that Homer was saying that the people inside the walls of Troy were morons, right?
They were not simply fooled.
Britain used to rule the sand where we are sitting, and they don't now.
The story of how they avoided it, how they let control go away, spans decades,
and it required a lot of people to do a lot of really, really stupid things
when, frankly, the colonists at that time were strong.
They started out that period of decades as strong British monarchists, loyalists.
They just didn't feel like they wanted to pay taxes unless they had seats in Parliament,
and it would have been easier to give them seats and have the British Empire be a little larger.
People said that at the time.
I said that Hitler invaded Russia or tried to invade Russia.
What I really mean is his general staff said,
Clearly this can be done. Napoleon was just incompetent. We can do it.
Everyone who's ever tried to invade Russia suffered the same fate.
And interestingly, oil production in this world, right?
There are some countries that produce a lot more than they consume,
and then there are other countries that consume a lot more than they produce.
And so we have OPEC as an example of how prices are controlled by the producer side.
But can you imagine how long the oil-producing countries of the world would be able to hold out
if somehow the oil-consuming nations also had a union and said,
We just are not going to pay more than a certain number of dollars per barrel.
It turns out that it's not a one-sided, they need us more than we need them,
and yet the oil-consuming nations just continue paying rather than getting some stiffness in their backbone.
These are all examples of folly.
These are all things that you could have known at the time that that wasn't going to work
or was going to have a very bad outcome.
Two quotes, and then I'll launch into the Internet side of all of this.
For those of you who are vision-impaired, I shall read them aloud.
Wooden-headedness, the source of self-deception, is a factor that plays a remarkably large role in government.
It consists of assessing a situation in terms of preconceived fixed notions
while ignoring or rejecting any contrary signs.
In other words, the power to command frequently causes failure to think.
You have seen this, perhaps, if you have a pointy-haired boss, especially if that boss was me.
It works at any scale you want.
The power to command frequently causes failure to think.
So, this Internet thing that has taken the world, pretty much taken over the world,
started as a research and engineering project.
It was built by the academic people, people who had government contracts,
and it was built for other people who had government contracts to use.
And they made a number of design decisions that were appropriate for the community that they were building it for.
The traditional example is, they were telnetting back and forth from host to host,
and typing their passwords in the clear, not because they were stupid, but because it was a totally trusted network.
That was a completely safe, sane thing to do.
But, they kept saying in the early days, and if you go read any history of the Internet,
you're going to see some marketing terminology along the lines of,
we always intended this to be a global domination force.
Well, I don't know if that can be true.
For example, John Postel, who was a friend and whom I miss very much,
once wrote that you ought to be liberal in what you accept, and conservative in what you generate.
And he thought that that would lead to a kinder, gentler Internet, where implementations could be robust.
But if you're liberal in what you accept, you'll get more spam.
And if you're conservative in what you generate, you will make less money from phishing.
And so, I don't think there's any evidence that anyone involved early on
ever thought that this would really be a global dominating force the way that we know it today.
And that underlies most of what I have to say today.
First thing they did, they only let research and engineering and contractors people connect.
The DCA's job early on was to keep people off the network, because there was a lot of interest.
And I'm sure a number of you can tell stories, as I can tell, of being at some company
where you really wanted to be able to go FTP files from somewhere on the then ARPANET or NSFNET,
but you weren't allowed to get a connection.
And please realize, these were 9600 VOD analog leased line circuits connected to an IMP somewhere,
but every IMP port was controlled by the DCA.
And if you didn't have a contract, and they couldn't do a background check on you,
you weren't going to get connected.
It's almost as though they knew their network was very fragile,
and if they let any bad people on it, then the whole thing would fall down and go boom.
Although that's not the excuse they used.
What they could have done is to build a network that was expecting to grow,
instead of building a network that was expecting to sort of reach a certain size and then stop.
They could build a network that was expecting to have strangers on it and not just friends.
And they could certainly have thought about scale.
What if 6 billion people used this?
How would that change the design decisions we're making today?
Now I'm not suggesting that they should have adopted a boil the ocean strategy
and said we're not going to do anything until we have a complete design in our head
as to how it could scale globally.
That's not what I'm asking for.
What I'm asking for is just ask us a couple of questions.
How will the decisions we're making today limit this from being acceptable to 6 billion people?
I think that they didn't need to spend more money.
They just needed to spend the time and money they spent a little more wisely.
What happened?
It's a matter of history.
A bunch of other networks started up and started connecting to each other.
Eventually it was commercialized and privatized.
And most of the problems that we face today in terms of high cost to go with the high benefit of Internet use
is traced to what happened instead of the right thing at this early, early moment.
Let's talk about SMTP.
I once sent Eric Allman, what amounts to a flame, saying,
look, this send-mail policy that you have about being an open relay is bad.
And there are spammers out there.
And they're going to systematically find all of these open relays
and use them to sort of send things that they could never send from their own T1
because people would refuse to accept traffic from them.
And Eric said, well, you know, you've got to be liberal in what you accept and so forth.
A year later, he sent me an apology.
And he put in logic in send-mail to lock out relay by default
unless you were on some trusted list of hosts or networks or whatever.
But it's worth noting that send-mail was not the first SMTP implementation.
It was the most widely popular in the early years, but it was not the first one.
They all did this because it was a reasonable thing to do.
For that matter, LPD used to do this.
You could print on other people's printers and use other people for your print queue
and they would send the stuff back to you.
And it all just worked because we were all friends, I guess.
Some of you, this is not on the slide, but some of you will recall our login D hole
where you just made the assumption that whatever the PTR value was
associated with someone else's address could be looked up in your .rhosts file
and if it matched, then it was okay.
The fact that the other person, the owner of the IP address, was in control of that string
just didn't occur to people.
So, I don't know.
What were they thinking? Where were they thinking?
None of the headers have really ever been validated by most of the implementations.
I know I've gotten mail from various robots running on big mainframes saying,
syntax error in the received header you added to this mail message
as it was going through, so we're bouncing it.
But for the most part, you can put anything anywhere and it just goes through.
So, spammers are currently allowed to add a lot of extra received headers
with or without funky time zones in order to frustrate our desires
to find out where things come from.
There was an assumption that every host would have a postmaster mailbox.
After all, what host would be on the internet and send mail
without wanting to hear complaints about it?
What host, indeed.
There was a turn command. Very interesting.
You could connect to somebody, use the hello command in the SMTP protocol
to tell it who you were.
It probably wouldn't compare that to your PTR or anything else.
It would just say, okay, that's who you are.
And when you got to the end of sending your mail to it,
you could use the turn command and it would dump its entire mail queue
toward you on the basis of what you had put into the hello command.
Fascinating logic.
What could they have done differently?
Well, frankly, IBM Profs, which was junk by today's standards,
had a pretty large user base.
They had attachments, they were multilingual,
they didn't do a lot in terms of one host sending mail to another,
but they had a good user base.
They dominated what was then the Fortune 500
in terms of all the email in the world.
And if they had just looked at the feature list and said,
you know, if we're going to present this as better,
let's make sure it's at least as good.
Let's talk about classful IP addressing.
In 1989, I was a network administrator at Digital Equipment Corporation,
and we had two class B networks.
And I was responsible for handing out address blocks
to other people anywhere in the world,
and DEC at that time was still a major corporation.
We had like 130,000 employees in a lot of time zones.
So it was getting a little bit cramped,
and I was about to ask for a couple of more class Bs,
and my boss said, oh, what the hell, go ask for a class A.
And I said, but we don't need a class A.
We're never going to have 16 million hosts here.
And my boss said, well, you know, just ask.
Maybe they'll give it to us.
It will sure be a lot more convenient for us if they say yes.
And they did.
So net16 is currently the property of HP,
along with a couple of other class As
that have come into their possession over the years.
If you want to know sort of why the people around the world,
especially in China,
where they would like to get enough addresses
to deploy billions of DSL lines,
they're a little bit concerned
about the way we wasted address space early on in IPv4,
and they want to keep that from happening again in IPv6.
And who can blame them?
So what could they have done differently?
They might have asked the question,
look, on this whole class C thing,
where you get a slash 24 network block
capable of handling about 250 hosts,
if we gave out all the ones that are in the allocation plan,
that would call for a global routing table
of two million entries.
How would we route that?
And then they might have said,
well, you know, over a backbone of 9,600 bought analog links,
we're probably not going to be able to send
that much routing material.
So let's come up with a plan
that we could actually do something about, right?
It's 20 years later.
We still don't know how to route
two million different destinations.
Right around 100,000,
you start to hit some hard limits
on the way that BGP and other sorts of
global routing protocols work.
So they didn't need to be rocket scientists.
Unfortunately, they were rocket scientists.
Maybe that was the problem.
What they needed to do was just ask
some simple, straightforward questions.
How would we route this if this allocation plan filled up?
They could also have asked,
you know, Stanford is a university.
They have one campus.
What are they going to do with a net block
capable of supporting 16 million hosts?
And they could certainly have wondered,
how's this going to scale?
So the rescue for classful IP addressing,
class A, class B, class C,
was classless IP addressing,
so-called CIDR.
And it works.
It's what we're using today.
But it's important to note
that the people who designed it
were the stakeholders.
They were the owners of the routers.
And it seemed obvious to all of us
that the people who had the routers
that had to run this code
ought to have a strong hand in determining
sort of how much complexity and cost
and whatnot they would be bearing.
What we didn't quite realize
was that they would design something
that would have a lock-in effect.
In other words, since renumbering
these address blocks is very tough,
we now have a system
where you have to get your address blocks
from your provider.
And if your provider is not responding well
to market pressures or your own pressures
and is, for example, overcharging you for transit
and giving you poor service,
you can't leave that provider
unless you are willing to pay
a renumbering penalty.
So this was really kind of the fox guarding the chicken house
as far as design was concerned.
What could they have done differently?
Okay, so Class A and Class B were too granular.
Having to choose between 16 million hosts
or 65,000 hosts or 250 hosts
was clearly too granular.
But that doesn't mean that we needed to
have every possible bit boundary
be a network block.
It's possible that we could have just come up
with less granular classes
and come up with something
that fit the size of the community
and fit the size of what routing table
we thought we could support.
And then we would still have address portability.
Not that it would have been in the interests
of the designers of this
that we would all have address portability.
So maybe there would have needed to be some reform
as to how these things get decided
in addition to some new thoughts
as to how to make this decision.
But wait!
IPv6 is going to save us, right?
It doesn't matter that classless routing was bad
because it was only a placeholder
to keep the internet growing
until we could get IPv6.
But I ran out of room on this slide
when I was trying to come up
with the things they did wrong.
They widened the address space
by a factor of four.
So instead of four billion,
which is 2 to the 32nd power,
we have some other number I can't pronounce,
which is 2 to the 128th power
of possible addresses.
And that's because they thought
the problem they had was
that they didn't have enough addresses.
Okay, well, we're still not out
of IPv4 address space.
The original Address Lifetime Extension Project
said that by 2005 we'd be out.
And so we had to rush this IPv6 thing through
because the world will end
if we run out of IPv4 space.
We didn't run out of IPv4 space.
And so, clearly, they solved a problem
we weren't having.
But in addition to that,
they failed to solve some problems
that we were having and are still having.
In fact, they made some of those problems worse.
They did not put any kind
of automatic renumbering in.
There was a lot of pressure to do that,
but they just said,
oh, that's too complicated.
That'll make it take too long
to get this protocol out the door,
so we're not going to support that.
So once you get your provider-assigned addresses
in IPv6, you'll be just as locked in
as you were in IPv4.
They assumed that once we had IPv6,
that NAT would die.
They thought NAT was only being used
to expand the address space
and make it possible for people
to have address space
who couldn't get enough
from their provider
or from the Internet
or Internet or whoever.
They didn't realize that NAT
would work its way
into the world's consciousness
as kind of an adjunct to firewalls
in terms of how we provision things
and how we do access control.
And so now there is a proposal
to do NAT for IPv6.
Not because people are out of addresses,
as you can see,
but because they need NAT.
They just need NAT.
It's not an addressing thing anymore.
They really wanted to keep using
provider-assigned addressing.
I don't know if that's because
they had corruption
and they knew that somehow
they needed to keep letting
bad Internet providers
lock their customers in,
or if they were just dolts.
I don't know.
But I know that they gave
each LAN a slash 64.
So every Ethernet segment,
every VLAN you have,
is able to have
18 billion billion hosts on it.
Every house that gets
a DSL connection gets
a slash 48,
which is 1.2 million
billion billion addresses.
My house is large,
but it's not that large.
And every multi-homed enterprise,
for example,
my employer,
or ISP,
starts out with a slash 32,
which is 79 billion
billion billion addresses.
There are 6 billion people
on the planet.
If you gave each one of them
an IP address
for every light switch
in their house,
assuming they have electricity,
and gave them 10 cell phones
and 10 laptops
and so forth,
it is potentially
going to be necessary
that each one of them
might have 20 addresses
and, you know,
16 times,
or 6 times 20.
180 billion would have been enough.
And I just don't know
what they were thinking,
except they thought
the problem that they were having
is that they didn't have
enough address space.
And, boy,
that's not the problem
we were having.
But now we're having
all the same problems
we were having before,
except they're bigger.
What could they have done?
They could have asked
a simple question,
what else is wrong
with V4
besides the address space?
What are the other things
that people complain about?
And they just didn't.
And I was there,
and I tried to raise
a number of these issues,
and perhaps they all put me
into their kill files
because they're tired
of listening to me
rant about stuff.
But I wasn't the only one.
These questions were asked,
but they were dismissed.
Let's talk about TCP.
TCP assumes
that all the other flows
that you share your path with
are going to be fair.
They're going to do
their own fair share scheduling.
It has no provision
for what I'm calling
a congestive flow
that will be bursty.
Like, for example,
voice over IP or NFS
or something like that.
They assume that
nobody between you
and your destination
will put any restrictions
on ICMP.
In other words,
they designed
path MTU discovery
without looking at
what providers were doing
even in that day.
A number of providers
are now putting
private RFC 1918
addresses on their core routers.
If they wanted to send you an ICMP,
they couldn't
because it would be coming
from an address space
you couldn't reach.
The initial sequence number
used to start out at zero.
Now it's random.
And the reason is
spam.
It turned out
that you could script
a TCP session.
You could figure out
which segments
you needed to send
and each segment
you send
has to include
some kind of an ACK
for what they will send you.
And you can script
the whole thing
if you know
what the other guy's
initial sequence number
will be.
And spammers
were doing that.
They were emitting
a stream of
TCP segments
from an address
that was not their own
so they would not have
received your ACKs
had you sent any.
And they were successfully
getting spam out.
And then
there was a big
scare about that
and so now everyone
uses a random
initial sequence
number.
If you were
a Linux user
and you saw
devrandom
come into existence
that was the year
and that was the reason.
So, basically
they assumed
everyone else
would do a good job
and would be on
the same side.
And they're not.
There are a lot
of people out there
who are
stupider
than you
or malevolent
and
even
it's
bizarre
to see this
protocol
and it's what
most traffic
on the internet
is.
It's TCP.
And it's bizarre
to see this
protocol
even still in
use.
It's very easy
for, in fact,
I remember
some marketing
literature
back in
maybe mid
90s.
Somebody was
offering a
TCP stack
for probably
Windows, I
don't know,
whose claim
to fame
was that it
was more
aggressive.
It would get
more than
its fair
share of
the path
bandwidth.
And it
would cause
other TCP
flows that
were sharing
the same
path to
back off.
And, you
know, naturally
some people
actually paid
for that,
bought it,
installed it,
got some
benefit out
of it, I
assume.
But we know
that if everybody
acts that way,
then actually
you'll end up
overflowing all
the lines and
everybody will
get less.
This is kind
of like the
prisoner's
dilemma.
But still,
you have to
wonder what
was in
the minds
of the
designers
of this
protocol.
Building
things that
work in
a lab
is an
achievement.
Building
things that
can make
it from
the lab
into the
real world
and still
be useful
is a
greater
achievement.
And we
should strive
for the
greater
achievement.
There are
a number
of codecs
that you
can use
for voice
over IP
and a
couple of
them are
fixed in
the amount
of bandwidth
that they
use.
In other
words,
whether you're
talking or
not, they
are sending
the same
number of
packets and
the packets
have the
same size
and the
same
inter
packet
gap.
And the
reason is
if they
only send
packets when
you're
talking and
if they
turn your
silence
into a
lack of
packets,
then they
will end
up competing
with TCP
when you
do finally
start talking.
So what they
want to do
is compete
with TCP
the whole
time, even
when you're
not talking.
Okay?
I understand
everybody wants
to adapt
to other
people's
mistakes,
but could
this not
have been
foreseen?
There is a
mantra in
the ivory
tower of
the IETF
that stateless
is good.
They don't
want to put
state in
the routers
in the
middle.
That was
something
X25 and
the rest
of the
ISO protocols
did.
They didn't
want to do
that.
They wanted
to keep
all state
at the
end points.
Now, it
turns out
that with
route caching
and all
the other
things that
modern
routers have
to do in
order to
run at
10 gigabit
line rates,
you have
state in
those
routers
anyway.
And so
it might
have been
worthwhile to
get somebody
to come
in and
try and
separate out
religion
from
engineering
requirements in
the original
design of
all of
this stuff.
This is
near and
dear to
the hearts
of many
in this
room.
For most
DSL
customers or
cable modem
customers or
other sort
of high
bandwidth
full-time
fully
connected
people from
data centers
to houses
to whatever,
you can put
any source
address you
want on
your outgoing
packets.
You can make
them come from
net 10,
you can make
them come from
the loopback
address,
you can make
them come from
net zero,
or most
appropriately
you can make
them come
from some
victim who
you would
like to
destroy.
And then you
can send
them to a
lot of
people and
then the
replies all
go back to
the victim.
And this is
hard to fix,
as it turns
out.
It sounds
simple and
there are
fixes in
various
routers and
there are
all sorts
of online
documents
exhorting
people to
turn those
things on,
but it
turns out
that the
equipment most
providers are
using doesn't
quite have the
ability to do
this and still
run at line
rate.
And the ones
that do can't
turn it on,
because there
are some
beneficial
flows,
benevolent
flows that
depend on
this.
Third-party
TCP that
has a
satellite
leg going
in one
direction
would be an
example.
It is
sometimes
necessary to
spoof.
Well, okay, in
my opinion,
you can, as
a provider,
you're a
slacker if
you use that
excuse.
You need to
find the
customers that
need that
and give
them a
little bit
more latitude
and anybody
who doesn't
need it
needs to
get no
latitude at
all.
I spend a
fair amount
of my
time tracking
down denial
of service
attacks against
DNS servers
and my
job gets a
lot easier
when I know
that a
given flow
really does
have valid
source addresses.
What could
they have done
differently?
Well, it all
needed to be
done on day
one because
once you
sort of
let this
genie out
of the
bottle,
then it
can dictate
terms to
you.
But on day
one, they
needed to
fix it so
that source
addresses had
to be right
from the
moment they
entered your
network.
At every
edge, you
know what
destination
addresses would
possibly reach
that customer.
You could
just demand
that they
only use
source addresses
that are in
the same
range.
It's not
that hard.
Even in
1980, it
was not
that hard.
You can
also make
sure at
every
core router
on the
internet
that, well,
maybe you
don't know
where it
came from
because by
that time
you don't
know which
edge it
started
at, but
you could
just demand
that the
source
address be
in the
routing
table
somewhere.
Just drop
it as soon
as possible
inside the
core if it
has net
zero as
its source
address or
net 10 or
what have you.
This is not
hard.
It would
not have
been hard
in 1980.
As to
why they
didn't do
it, it's
a mystery.
Okay, this
is my
special
area.
I can
rant longer
and harder
about DNS
than any
other topic
I can think
of and
maybe more
than any
other person
you can
meet.
A lot
has been
done wrong
here.
They said
that .mil
and .gov
were for
military and
government,
but they
really meant
their own
military
and
government.
Probably
meant that
com, edu
and net
were also
for American
companies,
universities
and network
providers too,
but they
failed to
get that
out.
This has a
distinctly
American
feel to
it, in
the same
way the
telephone
system
does.
I don't
know about
most of
you, but
the
country
code
for
my
cell
phone
is
one.
They needed
to get
ITU
involved
early,
so they
were not
trying to
legislate
things that
affected
national
sovereignty.
They needed
to get
the
existing
organization
that had
already
had that
power
delegated
to them
by all
those sovereign
nations,
get them
involved
early,
so the
whole
argument
could be
moved to
the other
guy's
backyard
instead of
having them
come visit
us.
They needed
a much
better plan
for adding
new TLDs.
Right now,
it's ICANN,
but for
many years,
there was
an RFC
that said
that IETF
was responsible
for determining
when a new
top-level
domain would
exist.
Well, the
E in IETF
stands for
engineering,
and the
creation of
top-level
domains and
the selection
of which
ones ought
to exist
and who
they ought
to belong
to is
not an
engineering
decision.
And you
can't
say, you
know, dot
black hat
or dot
Microsoft
or whatever,
but I think
there ought to
be more.
I think
that this
ought to
be a
more open
vehicle,
and we
ought to
be trying
a lot of
things,
and if some
of them
don't work
out, we
should say,
okay, that
didn't work
out, we'll
delete it
now.
Had they done
that, then
the current
food fight
over who
controls the
top-level
domain space
would be, I
think, a lot
more polite
than it is.
They also
allowed Network
Solutions, which
is a predecessor
of Verisign,
to begin
charging for
domains back
when it was
still a Navy
contract, and
there was no
provision at all
for what we
have now, which
is the
registry-registrar
split.
And so they
let NSI
collect $30
a year per
domain for
years, while
the whole
white-paper
process and
the whole
RRP and
EPP and
the rest of
that stuff
got done,
we're going
to be stuck
with
Verisign
forever as
a result
of this
decision.
What could
they have
done?
How did
we decide
to do,
I don't
know,
international
telephony?
How did
we decide
to do
international
post?
Who decided
what the
settlements would
be for,
gee, I bought
a stamp in
this country,
but you're
delivering it
in that
country, and
vice versa,
and I sent
you more
mail than
you sent
me.
How did we
carve up
Antarctica?
How will we
carve up the
moon?
Well, we're
going to get
diplomats
involved and
say, go
handle it.
For this,
we didn't
do that,
we said,
oh, we're
engineers,
we know
how to
get this
done.
The
evidence to
date
suggests
otherwise.
I have
been a
member of
the
IETF,
which is
to say I'm
on some
of their
mailing
lists and
I attend
some of
their
meetings
for,
I think
12 years,
and I've
seen a
lot of
bad stuff
come and
go.
They built
a standards
organization
originally that
was 50
friends and
a white
board.
And I
think you
can
imagine,
you know,
if you
could pick
50 people
on a
white board
and you
could come
up with
some pretty
cool stuff
and it
would work
and it
would be
successful
in the
market
and so
on.
And so
they did
that because
they knew
that it
would work
and it
would be
successful
and it
would be
fun and
they had
many
fine
lunches
and
dinners
around it.
They
planned for
global
domination.
They wanted
it to be
the case
that IP
would beat
ISO.
They did
not ever
want to
have to
run
TP4
or X25
or anything
like that
in their
enterprise
or ATM.
So they
really
thought hard
about how
to make
sure this
would be
the
dominant
technology.
But what
they didn't
realize is
if you
span the
globe,
then people
from all
over the
globe are
going to
want to
come and
help with
this
protocol
development
process.
They will
have their
own ideas
and you
will have
to have
a standards
organization
that is
capable of
letting
all those
people in
but not
turning the
discussion
to mud.
They had
no such
plan.
They still
have no
such
plan.
They
periodically
reform it
based on
hindsight.
In other
words, they
say how
can we
avoid the
problems of
recent years
in what
we do
next.
But they
never asked
the question
how can
we get
back to
the good
old days.
How
could
something
like
DNS or
SMTP
possibly
survive the
current
IETF
process or
the one we
plan to
have after
the next
reform.
That's not a
litmus test
they use.
All they're
trying to
do is
fix
whatever
they think
is wrong
looking at
the
previous
year or
two.
As a
result,
the
reform is
continuous
and
ineffective.
The
Internet
activities
board is
logically
separate from
the IETF
although it
is the
titular
head of
IETF.
There's
a whole
hairball
of
organizations
starting
with
I.
IAB
is where
the
architectural
vision is
supposed to
come from.
These people
are selected
by a
nominations
committee of
the IETF
body.
I've been
asked to be
on that
committee a
couple of
times and
have said
no.
In other
words, it
is selected
by people
like me
who said
yes, I
will help
make those
selections.
The IAB
has in
the past
said that
firewalls
were an
unnecessary
evil.
And that
hosts just
ought to
be hardened.
Well, okay,
you can say
that, but
that's not
what people
are doing.
They said
that NAT
was an
unnecessary
evil and
that rather
than
promote NAT
and come
up with
firewall
traversal
protocols and
just make
everybody use
NAT and
only have
real addresses
in the
core which
worked,
they said,
no, we
just think
NAT is a
bad design
and we're
going to
come up
with
IPv6
and that
will kill
NAT.
And once
again, I
have to
say that
is a
fine
philosophy
to have,
but that's
not what
people are
doing.
Tony Lee,
who was
then at
that time
a Cisco
employee,
made the
famous
comment
about
IPv6,
he said
it's too
little
too
soon.
We don't
need it
yet and
the things
we need
are way
bigger and
the list
is way
longer than
what people
are planning
on providing,
but that's
what the
IAV decided
on and it
was there
that the
decision was
made.
And those of
you in
business know
what the
feasible
alternative is
in this
case.
You find
out who
the
customer
is, ask
them what
they want
and build
it for
them, rather
than saying
yes, we are
in the
ivory tower
and we will
tell you
whether you
need
NAT or
not.
Foolishness on
its face.
And yet
they're still
defending that
policy.
ICANN,
and I'm
down to my
last ten
minutes,
so we'll
be doing
Q&A
out in
the hall
perhaps.
They should
never have
taken any
money from
the Department
of Commerce,
NTIA being
the part of
the Department
of Commerce
that faces
ICANN,
should never
have taken
money.
Once you
take money
from somebody,
they can tell
you what to
do.
They needed
to cherish
their
independence
from day
one.
They also
let NTIA
guide the
charter and
the initial
board.
And, you know,
what's up
with that?
Where did
these people
come from and
why should
we be
listening to
them?
That's a
question they
failed to
ask.
They used
to have a
bottom-up
at-large
sort of
representation.
They would
let people
like us
vote for
who was
on their
board.
They don't
do that
anymore because
they got a
board member
they didn't
like listening
to.
They needed
to see this
as a
transnational
entity,
not a
U.S.
government
entity,
from day
one.
The governments
they did
not include
on day
one are
now forming
up their
own
thing through
the
I.T.U.
mechanism.
And it's
toothless,
but it's
going to
be a
mess.
True
representative
democracy is
terrible.
And the
only thing
worse is
everything
else.
And they
chose
something
else.
So,
I.T.U.,
I've
mentioned
several
times,
we should
have gone
to them
earlier.
That doesn't
mean that
they had
the wisdom
and they
would have
done the
right thing.
What that
really means
is they
could have
been helped.
And instead
they were
allowed to
go do
their own
thing,
which was
fun to
watch when
it was
foolishness.
But it
means that
we didn't
have their
help.
They should
not have
allowed Panama
to turn
telecom
access fees
into the
major source
of gross
domestic
product.
But most
of Panama's
government
and services
are paid
for by
people in
this country
who pay
heavy-duty
international
dialing rates
to reach
Panama.
The result
is it's
illegal in
Panama to
run an
ISP
without a
license,
and that
license
dictates that
you will
block all
voice-over
IP port
numbers.
This is
kind of
incompatible
with the
way we
do things
on the
Internet,
and the
ITU
needed to
be told
early on
that's
crap.
Just don't
do it.
They needed
to see
telecom
as a
type of
data.
Instead,
they saw
data as
a type
of
telecom.
We needed
to invert
their
mindset.
They
needed to
understand
that the
Internet
was a
force for
democracy,
and it
wasn't
just another
way to
enrich their
members.
I'm going
to race
through some
of this.
So,
here's the
hard part,
because it
involves you.
Revolutions
come about
because people
who had
the land
and the
money and
the power
before you
have deals
with each
other about
how they're
going to
keep it.
That's true of
revolutions
throughout
history.
It's always
about land
reform or
it's about
governance
reform or
whatever.
ICANN is
stuck with
NTIA.
NTIA is
stuck with
Verisign,
but I'm
starting to
see that
that's not
our problem.
We're not
stuck with
ICANN.
We're not
stuck with
NTIA.
The Internet
has done
for the
world the
same thing
the fax
machine did
after Tiananmen
Square.
It has made
it much
harder for
people to
oppress other
people.
It's made
anonymity
possible.
It's made
freedom of
speech
possible.
It is a
huge thing.
It's not
just a
technological
toy.
There are
some people
out there
who are
trying to
pry this
toy as
they see
it away
from ICANN
and monetize
it.
But I
guarantee if
you go to
these people's
houses there
will be
trailers in
the woods
and right
under the
kitchen
window there
will be a
pile of
Kentucky
fried
chicken
boxes.
And what we
need is
something a
lot better
than that,
maybe even
different from
DNS,
a different
way of
allocating
and using
names and
addresses that
does not
rely on
governance
because the
quality of
governance
in the
world seems
to be so
low.
I mentioned
on the
slide the
technology
counterculture.
Guys in
suits don't
come up with
stuff that's
quite that
innovative.
It comes from
rooms like
this one
full of
people like
us.
Last year I
built a
barn and
it came
about several
times that
one of us
on the
construction
team would
come around
the corner
with some
bleeding body
part and
declare that
rule number
one had
been
violated.
So humans
are animals
and most
of my best
friends are
humans.
But we
have our
dark side.
We spend
a hellacious
amount of
time trying
to figure
out how to
make other
people work
so that we
won't have
to.
If we're
not doing
that, we're
probably spending
a hellacious
amount of
time trying
to keep
other people
from doing
that to us.
And I'm
looking forward
to a day
when we
have some
other mode
of operation,
some other
thing that is
driving us,
and I think
that the
Internet is
a wonderful
potential tool
toward that
end.
I could ask
for a show
of hands and
a bunch of
you would
say yes,
I started
an Internet
consulting
business in
my house,
and because
I was able
to get a
domain name
and get
some bandwidth
and whatnot,
I was equal
to everyone
else in
that business,
and the only
thing that
mattered was
whether I was
any damn
good at
what I did
and how
much I
charged.
That's not
generally
true.
I own
the land
that you
would need
for that
factory,
so you
have to
pay me
my tithe.
I've been
holding on
to it for
you.
The
Internet
works
differently,
and it
could make
humanity
work
differently.
And I
love things
like free
and open
source
software.
I've been
doing open
source
software since
before that
name was
coined.
I'm glad
that somebody
finally came
up with a
name for
what I was
doing.
That's good.
I love
the onion
router.
I'd like
to see
voice over
IP come
along and
destroy the
existing
voice dial
market.
Not because
I hate
the voice
dial market,
although frankly
it tends not
to work well,
but because it's
an instance of
old power
structures
self-perpetuating
themselves at
the cost of
all of us
and our
children.
And before
the Internet
can be that
force for
improving human
nature and
being that
intermediator
that I'd like
it to be,
we have got
to get the
governance of
the Internet
out of the
hands of the
existing power
structure.
Thank you.
I can
take a
couple of
questions.
We're exiting
on that
side.
I have a
question
here.
I see
OASIS as
a competitive
standards body
for
W3C.
And I
think OASIS
is a
wonderful
thing.
For that
matter, I
think W3C
with all
its warts
is a
wonderful
thing.
If you can
imagine what
the web
standards would
look like
had they
been left
in the
hands of
the
IETF,
then you
should be
thanking
Tim
Berners-Lee
for doing
what he
did.
More
questions?
Here.
I think
that in
Tunis, the
WSIS
people will
say, you
know that
cat?
That cat's a
pain in the
butt.
And us
mice, we
need to
do
something
about
it.
One of
us needs
to go
put a
bell on
that
cat.
And
they're
going to
look at
each
other
and
wonder
who's
going to
do
that.
But the
fact is
the
United
States is
the
largest
payer of
dues
into the
United
Nations.
And if
they say
as they
did,
three weeks
ago,
we're
going to
keep
the
root
zone.
If they
say that,
then they
mean it.
And it
doesn't
really matter
what the
UN thinks
they can
do about
it.
I don't
like it,
but that's
the fact.
Any
more
questions?
Thank you
very much.
You can
see me in
the
hallway if
you have
more
questions.
Thank you.