KDB Systems

I’m run­ning for the board of direc­tors for the Cana­dian Inter­net Reg­is­tra­tion Author­ity ( CIRA). If you have a .ca domain I’d like your vote. In order to vote you have to be a mem­ber (which is free). To become a mem­ber go here to register.

Your first ques­tion is prob­a­bly – What does CIRA do? CIRA man­ages the .ca coun­try code Top Level Domain (ccTLD). Now you’re prob­a­bly ask­ing – What the heck is a ccTLD? A top level domain is the char­ac­ters on the right side of the last dot in an Inter­net name. This blog lives at www.kdbsystems.ca .ca is the top level domain, kdb­sys­tems is the sec­ond level domain, www is the third level domain, and so on. My busi­ness site is at www.kdbsystems.com. In that case .com is the top level domain. Because .ca rep­re­sents a coun­try, namely Canada, it is called a coun­try code Top Level Domain. Each coun­try only gets one ccTLD. CIRA is a not for profit organ­i­sa­tion that runs the .ca ccTLD under a con­tract with the Cana­dian government.

What’s involved in run­ning .ca? First there is the reg­istry. If you want an Inter­net domain for a web site or an email server or what­ever you need a domain name. This has to be unique so that peo­ple can find it. Some­one has to keep a data­base for each TLD with all the domain names, who reg­is­tered them and how to find them on the Inter­net. Let’s walk through what hap­pens when a busi­ness decides it wants a web site. They’re Cana­dian so they want a .ca domain. They con­tact a mid­dle­man called a reg­is­trar who checks that the domain name is not already reg­is­tered to some­one else. If it’s not the reg­is­trar for a fee con­tacts CIRA and pays CIRA to insert the data into the reg­istry data­base. The busi­ness is now the proud owner of a .ca domain. They con­tact a web host­ing com­pany, often the reg­is­trar, who sets up a web site on a server that is con­nected to the Inter­net. This server has an IP address that is a series of num­bers. Peo­ple who want to access the web site have to know this IP address to find it. No one could remem­ber all of these num­bers so the Domain Name Sys­tem (DNS) was devised. The DNS trans­lates domain names, which are much eas­ier to remem­ber, to IP addresses so your com­puter can find the web site. CIRA man­ages the DNS for the .ca domain. When some­one tries to find www.kdbsystems.ca their com­puter con­tacts a local DNS server, prob­a­bly run by their Inter­net Ser­vice Provider. This DNS server prob­a­bly doesn’t know where www.kdbsystems.ca is so it con­tacts the .ca DNS servers to find out. That’s a very sim­pli­fied expla­na­tion of a com­pli­cated process. CIRA runs the .ca DNS servers as well as the reg­istry data­base. As you can see CIRA is crit­i­cal to the Inter­net in Canada. If CIRA were to stop oper­at­ing peo­ple couldn’t access gov­ern­ment and many busi­ness web sites. Any email address that ends in .ca wouldn’t be reach­able. This could have very bad con­se­quences if .ca quit work­ing for even a few hours.

My full elec­tion state­ment is here. The short ver­sion is that I have the tech­ni­cal knowl­edge to know if things are going off course. I have the tem­pera­ment needed to get along with other board mem­bers even if we have oppos­ing views. I have the strength to stick to my prin­ci­ples when needed. I have the empa­thy needed to hear the other side of the story and under­stand it. I have the busi­ness knowl­edge needed to make sure CIRA is man­aged in a way that will ensure the needed finances are in place. Lastly, and I think most impor­tantly. I believe the Inter­net is the sin­gle largest dis­rup­tive thing that has hap­pened to the human race. As the Inter­net works now most of the peo­ple in the world have access to most of the col­lec­tive knowl­edge of the human race. Dis­rup­tion can be a force for good or evil. I’d like to see the good out­weigh the evil. Part of CIRA’s man­date from the Cana­dian gov­ern­ment is “to develop, carry out and/or sup­port any other Inter­net related activ­i­ties in Canada”. The other activ­i­ties should be about keep­ing that bal­ance on the good side. I have con­sis­tently cham­pi­oned this strat­egy dur­ing my term on the board and I’ll con­tinue to cham­pion it when elected for another term.

In upcom­ing posts I’ll expand on the chal­lenges that CIRA faces, how I think CIRA should man­age them, and more about the “other activities”.

It’s been over a year since I posted to this blog. In that time I’ve become increas­ingly con­cerned about Inter­net Gov­er­nance and how it affects all of us. It’s not that I’m no longer inter­ested in tech­nol­ogy and Microsoft. I just got home from help­ing at a Microsoft spon­sored event, the MVP SMB Com­mu­nity Road­show, in Win­nipeg yes­ter­day. We were demon­strat­ing Win­dows Mul­ti­point Server 2011 among other things. It’s almost unbe­liev­able how cool this is and what a dra­matic effect it could have on IT for the SMB mar­ket. It is mostly tar­geted at the aca­d­e­mic mar­ket but I think the poten­tial for SMB is much big­ger. I’m still very excited about tech­nol­ogy. Inter­net Gov­er­nance though ramps up my excite­ment to a whole other level.

In 2008 I was elected to the board of direc­tors for the Cana­dian Inter­net Reg­is­tra­tion Author­ity for a three year term. That term is almost up and I’m stand­ing for re-election. Dur­ing my three years on the board as I gained knowl­edge of the domain indus­try, how the Inter­net works, DNS, ICANN, the IGF, ISOC, and more I realised that the world has come to rely on the Inter­net. For some­thing that the world relies on its gov­er­nance is very dif­fer­ent from any­thing else I can think of. It is not well under­stood by peo­ple out­side of those involved. There appears to be a strug­gle for con­trol of it that could have pro­found con­se­quences for all of us. Cur­rently the Inter­net is gov­erned by a very loose con­glom­er­a­tion of com­mer­cial inter­ests, gov­ern­ments, spe­cial inter­est groups, and just plain peo­ple. ICANN arguably the most impor­tant Inter­net Gov­er­nance organ­i­sa­tion has what’s called a multi-stakeholder bot­tom up gov­er­nance model. Any­one can attend an ICANN meet­ing. There are three a year and they move all over the globe. It’s free for any­one to reg­is­ter and attend but you do have to pay your own expenses. CIRA will be host­ing one in Toronto in 2012. Once there you can attend almost any ses­sion. Very few are closed. There is a pub­lic forum where any­body can get up to the micro­phone and have their say. You can join spe­cial inter­est groups within ICANN and put for­ward poli­cies through these groups. It is very chaotic and con­fused but some­how the Inter­net stays run­ning. The net­work pro­to­cols used to con­nect and com­mu­ni­cate with the Inter­net are free and open. No one con­trols them. All this chaos, con­fu­sion, and lack of con­trol con­found gov­ern­ments and many com­mer­cial inter­ests. They want more reg­u­la­tion and con­trol. Some gov­ern­ments want to cen­sor what their cit­i­zens can see and do on the Inter­net. Some com­mer­cial inter­est groups want more con­trol of com­merce on the Inter­net. Some of the spe­cial inter­est groups want more reg­u­la­tion to pro­tect the pub­lic from the gov­ern­ments and com­mer­cial inter­ests. The pub­lic seems to just want to access all the cool stuff on the Inter­net, prefer­ably as cheaply as pos­si­ble. Right now there seems to be some sort of bal­ance between all these diver­gent inter­ests. The bal­ance sways a bit but so far it is some­where near the mid­dle. I’d like to see it stay in the mid­dle. To that end I’m going to use this blog to explore Inter­net Gov­er­nance issues. Because I’m cur­rently in the mid­dle of try­ing to get re-elected to the CIRA board I’ll prob­a­bly be blog­ging about that a lot. Because tech­nol­ogy fas­ci­nates me there’ll def­i­nitely be posts about the tech­nol­ogy of the Inter­net. Finally when I see some­thing cool like Mul­ti­point Server 2011 I’ll write about that.

Stay tuned my next post will be about the CIRA election.

IPv6 is com­ing. We’ll all have to learn how to deal with it. With this in mind I’ve set out to edu­cate myself about IPv6. I learn bet­ter by doing than by read­ing. I like to read enough that I have a very basic under­stand­ing of the sub­ject then play. After play­ing with it I gen­er­ally find I need to do some more read­ing or pos­si­bly even take some courses. With IPv6 I’m at the play­ing stage. I decided to setup a Server 2008 R2 vir­tual machine as a test bed for IPv6. I needed a sec­ond domain con­troller on my SBS 2003 net­work so I made it a DC and a DNS server. It’s prob­a­bly not the best idea to use a DC for an IPv6 exper­i­ment but I fig­ured I may as well go whole hog and learn by mak­ing mistakes.

The rea­son for the DNS server is so once I fig­ure out IPv6 it can answer IPv6 queries from the work­sta­tions. Plus it’s a DC which implies a DNS server. This is the first place I ran into a prob­lem. There is a bug in the 2008 R2 DNS server imple­men­ta­tion. It wasn’t resolv­ing some queries. NSlookup microsoft.com worked but nslookup www.microsoft.com didn’t. It was very per­plex­ing and took a lot of Bing-foo and Google-foo to fix. The fix is here in Scott Forsyth’s Blog. It appears it’s a com­bi­na­tion of some DNS servers not return­ing EDNS results prop­erly and the way Server 2008 R2 DNS deals with that.

The server was now setup as a DC and a DNS server. To play with IPv6 I needed to set up a tun­nel. My ISP doesn’t sup­port IPv6 and nei­ther does my router. I decided to acti­vate a free IPv6 tun­nel at tunnelbroker.net. This was rel­a­tively straight for­ward. I was hap­pily test­ing IPv6 over the tun­nel think­ing that was too easy. I was right, it was too easy. I decided to run a port scan of the IPv6 tun­nel. Imag­ine my sur­prise to find out that as far as the Win­dows fire­wall was con­cerned the tun­nel was part of the local net­work. I had just put a DC on the Inter­net with no fire­wall. Not good to say the least. I quickly dis­abled the tun­nel. I spent the next sev­eral hours Googling and Bing­ing to no avail. So far I haven’t found any way to block incom­ing ports on the IP6Tunnel inter­face while leav­ing ports open for the local net­work. I’m stuck for now. I need to use the Win­dows fire­wall because the tun­nel by def­i­n­i­tion bypasses the fire­wall in my router. I’m sure there’s a way but until I find it no IPv6 for me. Once I get past this set­back I’ll con­tinue this blog series.

Update

It looks like the only way to do this is to add a sec­ond NIC for the IPv6 tun­nel. I should be able to set the fire­wall pro­file for the sec­ond NIC to Pub­lic which would solve the prob­lem. I don’t want the headaches caused by a multi-homed domain con­troller. I’d prob­a­bly need to setup a VLAN as well, which my router doesn’t sup­port. The project is tem­porar­ily on hold while I rethink things.