Do we need a new internet? No, but we do need more researchers.
Summary: The New York Times ran an article on a new academic research project whose goal is to redesign the Internet from scratch. The most valuable product that will come from this effort is not new technology, but formally trained security researchers.
The New York Times ran an article on a new academic research project whose goal is to redesign the Internet from scratch. The most valuable product that will come from this effort is not new technology, but formally trained security researchers. This past weekend the old gray lady ran an article by John Markoff about how a group of universities received a large grant to draw up a brand new Internet from scratch. The motivation for the work is, as the group claims, that the internet in its current state cannot be secured, and a new internet needs to be drawn up to support security from the start.
Hogwash.
The internet isn't insecure because the fundamental architecture is broken. The internet is insecure because people are using the internet using poorly secured systems and are willing to run any program they come across regardless of its purpose. This problem can't be solved on a protocol level without regulating what applications can be run and who is allowed to connect to each other, which risks stifling new technologies like peer to peer.
The biggest value that will come from this project is the production of any universities' primary output: new engineers and researchers. By allowing students to spend a few years thinking about what could be possible in security when they start with no constraints, they may come up with an innovation that can be bolted onto a current technology. When they graduate, they can either bring their research to market or train new engineers and researchers, allowing everyone to gain value from their grant.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
good luck!
very well stated
There could be things put together that we already
know something about, like both-ends-verified email,
which would refuse spammers a sending point.
I think it's possible to imagine an encapsulating
download service which verifies against malware on
everything, as download.com claims to on its postings.
And, what we haven't imagined, but which a
cryptographically strong fresh look might...
Regards,
Narr vi
We may not need a new internet - but we do need new email.
It's insane, our current email system. Completely insane.
email isn't "broken beyond belief"
OpenID, Yahoo, and others have similar solutions on the table, but in typical fashion, no one can agree on just one and move forward from there.
EV SSL
The top 5 companies could make it happen
When 90% of the email bandwidth is taken up by spam someone must be benefiting other than the spammers otherwise it would be stopped. government legislation is not the answer but corporate action by the largest corporations and the large ISPs might be.
We know that the security product vendors make money out of it. We know that the spam filter specialists make money. We also know that the large corporations all the way down to the personal home user pays.
Isn't it time to make it stop! I am sure that if Wal-Mart Stores, Exxon Mobil, Royal Dutch Shell, BP, Toyota Motor, Microsoft and Cisco said "we will not accept any email unless it comes from an authenticated source from August 2009" then it would happen by August 2009. Make it happen guys!
Garbage!
doing things.
Relying on average users to operate in secure fashion
is the height of idiocy.
We need an Internet where both ISP's and users are
fully identified by number. So bad behavior can be
tracked down and eliminated. Doing so will not
eliminate anonymity, but it will make it possible with
a court order to identify rogue users.
Redoing the Internet will make it easy to eliminate
Spam, Trojans, viruses, etc.
An impossible dream?
Very Possible
Internet was designed as a link between
government departments, each other and
universities. Security was not a concern back
then, it most certainly is now and the entire
basic structure needs to be re-thought and then
re-done.
Spot on
Not to get into a religious flame war, but this is like the difference between Windows, whose roots lie in a single-user, non-authenticated, unprotected system (DOS), and UNIX (e.g. Mac OS X, BSD) and OpenVMS, where the concept of multitple users and protecting the kernel and each user was designed in from the beginning. Windows users still see the artifacts of early architectural decisions (ever install a program that doesn't know how to save and protect separate settings for different users?) This is the way it is with the Internet -- it was designed for universities to openly share thoughts, not transmit billions of dollars between financial institutions.
I only bring this up to highlight the fact that architectural design decisions in the early phase of development will have long term ramifications in how a system's used way down the road.
Now, if your business is built up on building and maintaining these "kludges", the idea of a new, architected, and properly designed Internet should be an anathema. Whatever these researchers come up with will probably be disparaged, ripped apart, and broken up into kludges that will be tacked onto the current Internet. Or as Adam O'Donnell said in his post, "new engineers and researchers... may come up with an innovation that can be bolted onto a current technology".
And we'll all continue to suffer from the poor foundation, with people nonsensically spouting off on how the only broken part of the Internet is SMTP.
Author doesn't know crap about IT security
your PC secure.
I can walk thru your fire wall and around your anti
virus, set up a rootkit you can't find.
THATS WHY IT IS NOT SECURE.
GERALD ANTHRO
OMG .... ROFL
virus, set up a rootkit you can't find."</i>
Sure you can .... hehehehe !!!!
ROFLMFAO !!!!
What a frigging SCRIPT KITTY !!!!!
ROFL???
You can laugh all the way to your grave, but he's absolutely right.
RE: Do we need a new internet? No, but we do need more researchers.
Authetication, authorization, accountability, confidentiality, integrity, none of these were addressed, or at least considered during the development effort. Some may argue that communication protocols are not the place to define such high level schemes. Maybe they are right. However, the lower the level that one considers and accomodates such concepts and adds hooks or support for them, the more robust these concepts will be while making use of these protocols.
We need a new Internet. How different it looks from, operates and itneroperates with, the existing mess is open to definition.
Just my 2?, collect the whole dime!
Mad Mark
Right, there are two, related, problems
There are two problems here. One is that the core protocols (TCP, IP, and the cruft that support them, like BGP) are obsolete; the architecture was not complete in the first place and we're layering bandages over a weak foundation. That stuff is arcane, not obvious to end users, and crucial. IPv6 is a step in the wrong direction and should be abandoned.
The second problem is in the upper layers, right up to the "wetware" that uses the net. It's true that nothing can protect against a determined user; you can get past a lot of security if you fool someone into installing something he shouldn't. But a lot of that can be controlled by smarter applications; Microsoft's mail and web apps are notorious virus vectors. A better low-layer foundation could certainly be useful if security becomes a more integrated function, but we also have to protect against users who click on attachments in spam. And we need new mail protocols that are less spam-friendly.
Whoever is thinking about a new internet needs to get a life.
You are only seeing the surface
Current internet e-mail is fast on its way to the grave
When a better solution reaches the adoption tipping point, we'll be surprised at how fast the business world abandons SMTP and converts.
It will be like IM in many ways -- authenticated senders, secure, multimedia. The only people still using the old system will be kids and other casual personal users.
Reality check: The new e-mail will not be free, but it will eliminate spam.
We already have Internet2 and the Darknet..
got lucky writing grants to me.
The only protocol that could really use an overhaul is email. I've
thought of a couple ways that it could be spamless but they
would require updates both to server and client apps. Older
versions would have to be left behind.
Otherwise, the current internet is plenty secure.. it's mainly just
Microsoft products that aren't.
RE: Do we need a new internet? No, but we do need more researchers.
Here is a further more professional answer from Technology Review an important source for information based on scientific observation.
"Simply put, the Internet has no inherent security architecture -- nothing to stop viruses or spam or anything else. Protections like firewalls and anti-spam software are ad-dons, security patches in a digital arms race.
The President's Information Technology Advisory Committee, a group stocked with a who's who of info-tech CEOs and academic researchers, says the situation is bad and getting worse. "Today, the threat clearly is growing," the council wrote in a report issued in early 2005. "Most indicators and studies of the frequency, impact, scope, and cost of cyber security incidents -- among both organizations and individuals -- point to continuously increasing levels and varieties of attacks."
And we haven't even seen a real act of cyber terror, the "digital Pearl Harbor" memorably predicted by former White House counter terrorism czar Richard Clarke in 2000 (see "A Tangle of Wires"). Consider the nation's electrical grid: it relies on continuous network-based communications between power plants and grid managers to maintain a balance between production and demand. A well-placed attack could trigger a costly blackout that would cripple part of the country.
The conclusion of the advisory council's report could not have been starker: "The IT infrastructure is highly vulnerable to premeditated attacks with potentially catastrophic effects."
here is the link. Please note that there is a follow up article indicated at the end of the first article and it is even more exacting in it's answers.
Hope this help[s clear up the doubts you may have as to what the real story is and what it means to you and me.
http://www.technologyreview.com/InfoTech/wtr_16051,258,p1.html