Internet Infrastructure Ignorance

While at Internet Identity Workshop 2005 this past week, one of the interesting issues that came up several times related to name spaces. Specifically, there were numerous times where people voiced their opinions about how name spaces "should" map onto the Internet, and they used DNS as an example of how things "should" be. The problem is that they demonstrated, by their words and arguments, that they were ignorant of how DNS works. The infrastructure of the Internet has become so transparent, that it seems to me people have begun to make gross assumptions about it's architecture, and this is what is the root of many of the security and privacy issues that we are seeing today.

I was looking forward to the presentation by Drummond Reed about XRI/XDI. One of my concerns in any solid digital identity solution is the freedom to choose. I am not a big believer in compulsory community membership, but instead believe that true freedom is represented by our ability to move in and out of various communities at will, and to create new communities as we want. I really like this thought from "The Meaning of Life - Part II":

There are millions of different social groups in the world, political, economic, religious, philosophical, and cultural. These groups are all trying to bring their particular vision into focus and build a life that is related to the central principles of the group. Each of these groups is an experiment in progress. As time passes, the ideas that are developed within these groups either spread to the society as a whole or are abandoned as unworkable. This is a Darwinian process that develops better ideas in the same way that evolution is supposed to develop better animals. You can find more information about this notion of “idea evolution” at the Memes: Introduction site. Even groups that you personally dislike are working in your behalf, attempting to build visions of the world that might allow you to interact with the world more creatively and successfully.

Groups also serve as symbols in the social world. Groups with different beliefs than your group provide you with viewpoints you wouldn't have otherwise considered. They also represent parts of your own mind that you are not focusing on. However, if you fear those parts of your mind, this representation can degenerate into projection, which is a bad thing.

What does this have to do with DNS and digital identity? It is that I want the freedom to NOT have one name, one identity, or one reference across all communities. Yes, there might be some places where I would benefit from some level of federation. At Internet Identity Workshop 2005 I actually saw where OpenID is intended to not only provide Single Sign-On, but also is specifically designed to cause a level of federation across web sites. I DO NOT want this to be a requirement. I am ok with it being an option. It is this flexibility that I believe will allow a particular solution to become successful and ubiquitous.

So ... I really wanted to hear more about XRI/XDI and i-Names because I specifically wanted to learn if they were going to try to "root" the entire name space into one fixed community. My real question was: "Is XRI/XDI yet another Internet 'tax' like Domain Names (DNS), where you have to pay some entity on an annual basis to use the value of the technology?" Or, was XRI/XDI simply one solution that could be "rooted" anywhere, and allow for the emergence of various communites to use the technology, and have the naming relative to the community. To my relief, the latter was true. XRI/XDI is based on specified root servers, and so naming resolution is based on what root servers you choose. In the end, what this means is that my i-Name is only relative to the community. It is not necessarily a globally unique identifier for me. It also means that any community can set up their own root servers, and create name spaces of their own. In the end this means that =drummond.reed only refers to Drummond within the context of a particular community! Bingo! I like it!

What shocked me was the almost immediate upset expressed by numerous people at the conference. They wanted these names to be absolutely globally unique . .. so that no one would ever be able to get "my" name, and there would never be any ambiguity about who was being referred to by an i-Name. I fully understand the desire, however what shocked me was the references to DNS as having this characteristic! People actually believe that DNS provides an absolute unique identifier in any context! The DNS system has become so transparent, and ubiquitous that people no longer realize that it is simply one community for naming on the Internet ... and there is nothing locking people into using it. These people do not seem to realize that I can set up my own root servers, and resolve and DNS name to any IP address that I like! In fact, I'm quite surprised that the Open Source community has not stepped up to revolt against the "Intenet tax" imposed by ICANN and re-ignited the efforts of OpenNIC, AlterNIC, and many of the other early pioneers in creating a truly free naming system on the Internet.

DNS naming only works because our servers, workstations and laptops all obey the rules, and the default configurations imposed on us by our Operating Systems, ISPs, and DHCP servers. Anyone who has installed a DNS server could easily find the default InterNIC root server list in one of the files on their system ... /var/named/named.ca on my Fedora Core 4 install. I could go into my DNS server and define "www.amazon.com" to be any IP address that I want. If you then happened to route through my DNS server (by being on my network) then you would get *my* name resolution ... not InterNICs. If I was an ISP, or even an Internet Cafe, there is little that you could do, and in fact you would most likely just trust that the DNS server you were using was trustworthy. Another common hack used by trojan horses on the net is to modify your local hosts file. Most all systems have a hosts file that will resolve naming on your local machine without requiring DNS at all! If I put an entry in your hosts file for "www.amazon.com" then it will never even use DNS to attempt to resolve the name correctly.

There is nothing in DNS that stops me from adding other root servers, and creating my own free Top Level Domains (TLDs). It is only because people just fall in line with the DNS configuration that it works. It is only because we allow our machines to automatically join the ICANN community. It is only because of our ignorance and lack of education about how all of this works that we think that DNS names are globally unique in all situations. DNS names, and all naming, are the products of specific communities or contexts. Although these communities might grow to be so large that we can't seem to see anything else, there still is the something else. I actually like it that way.