This section of the FAQ is an intriguing history lesson on how a painfully divided organization attempted to hold up the Internet, and how it was discovered to be an Emperor without clothes. If you're not curious to hear a little history, you can probably skip this section entirely. If you've heard about the CIX and aren't sure what it is or what it can do, read on.
It's January of 1995, and the CIX has mainly slipped out of the news. In autumn of 1994, it seemed that you couldn't read your mail without another mention of controversial CIX moves. Now, however, things seem to have quieted down a great deal.
Here's how things looked, circa November-December 1994:
The Commercial Internet Exchange (CIX) is many things to many people. To some, it is the heroic institution separating small ISPs from the oblivion of disconnectedness. To others, its $ 7,500 a year annual fee is restraint of trade, monopolization or worse.
The CIX offers to do three basic things for you:
(1) Any CIX member must agree to pass through the packets of any other
CIX member, without fee. So if you want to talk to a site in England,
and you're going through five or ten other sites on the way, they
cannot charge you for this transport service, assuming all the sites
are CIX members. (Karl Denninger
(2) The CIX operates a router, based in San Jose, CA. As part of your
membership, you have to be connected to that router either directly or
through a chain of CIX members. If you cannot connect to a specific
site through normal means, you can use the CIX router as a last-resort
option to get where you need to go. A direct connection to the router
costs $ 5,000 on top of the membership charge.
(3) Unspecified lobbying and public relations efforts. Observers on
the inet-access mailing list state that these efforts are negligible.
However, those people are also anti-CIX for other reasons, so you may
wish to take their opinions with a grain of salt. The CIX has not
issued any official commentary that I know of on the specifics of
these efforts.
There has been an enormous amount of talk - and we're talking about
literally megabytes of stuff - about whether the CIX as it stands is a
Good or Bad thing. Non-CIX members and some CIX members not on the
board have made the following points:
(1) The basic principles of the CIX are worth saving. Even the most
virulent hater of the organization has stated that the principles of
settlement-free peering are the glue that holds the Internet together
- and those principles should be supported by a trade organization
people join. Gordon Cook's
(2) The CIX is imposing route filtering, as of 15 November 1994. Previously,
if you were a non-CIX member and were connected through a CIX site, you
could still use the CIX router in the same way CIX members could. Under
route filtering, the CIX router will become for the exclusive use of
CIX members. Non-CIX members consider the $ 7,500 annual fee to be
excessive; depending on the size of their operation, it could nearly
double their operating costs.
In September 1994, the membership had an annual meeting, at which
they voted to NOT impose this route filtering. The CIX Board of
Directors said that they would have to impose filtering in any case,
for legal reasons. Some members were relying on the CIX connection
to hook themselves to all providers, whether members or no, so they
actively did NOT want the filtering to occur. At the end of the
meeting, people like Karl Denninger
On 15 November, supposedly D-Day for filtering, someone on the
Com-Priv mailing list noted that nothing had happened, and that even
CIX routes were still available to all. Bob Collet
(3) The CIX has a router, and some people are a long, long way from it.
Wouldn't it be better to have lower membership rates than a router,
especially since the CIX can be thought of in some sense as competing
with its own members? (In fact, one of the CIX members - PSI - operates
the CIX router under contract).
All this sound and fury can be quite entertaining, unless your
business depends on it. However, you may be able to relax: only 38 of
32,000 routes are unique to the CIX router. What this means is that
if you're not a CIX member, route filtering will do very little for
you; you lose contact with just 38 sites. If, however, you are a CIX
member relying on the CIX router to connect you to the world, you may
find yourself cut off from numerous non-CIX sites. As a result, most
of the people connected through the CIX are apparently scrambling for
alternative connections even as we speak.
What seems to have happened is that connectivity providers such as
Sprint and Net-99 are in practice taking care of routing for their
customers. As a result, the CIX router has become very nearly
worthless, especially since it's been heavily overloaded. Bob
Collet's
The following comments have been made by people on the Com-Priv
mailing list on this subject:
* If you're connected by a provider that has access to MAE-EAST,
a major interconnect point, you'll be able to connect to people
hooked in to all major providers, since they're all there. This,
for example, should cover both Sprint and Net-99 customers well.
* However, you will NOT be able to connect to people who are
hooked in solely to the CIX router, unless you become a CIX
member. Fortunately, very few sites appear to be in this
category, and most of them are scrambling for alternative
arrangements even as we speak.
* Providers don't advertise all their interconnected routes to
MAE-EAST; they only advertise those routes which help provide
connectivity to their customers. For example, if PSI has a
direct link to Hong Kong, and PSI is connected at MAE-EAST,
you'll be able to hook up to all PSI customers, but not necessarily
Hong Kong. However - just to confuse things - if the Hong Kong
Supernet, a specific site, was connected through PSI, you would of
course be able to hook up to it.
As a result of this CIX filtering, Karl Denninger's MCS-NET and
Net-99, his joint venture with Joseph Stroup, have resigned from the
CIX effective immediately. Their complaint is that the obvious wishes
of the membership (as voted on in the earlier meeting) were ignored.
Bob Collet has asked them to suspend their resignations temporarily,
while he attempts to put together a solution to please all parties. As
a result, they have not yet put their resignations in writing, but their
very deep displeasure with the CIX and its representatives could
hardly be more clear. The CIX response has been that the filtering is
a legal necessity, according to advice of counsel. Others say that
the law could be read either way, and that the primary goal of the CIX
is to expand connectivity; filtering is unquestionably not going to
advance this goal.
It's worth repeating the requirements for filtering, to give us
a better understanding of what's going on. Filtering would affect
you if:
- The site that feeds you is not a CIX member
- You are not a CIX member -AND- you sell SLIP/PPP access, or any
other form of IP connectivity (56k lines, T1, etc).
Otherwise, you can relax and ignore this issue completely. So if
you sell shell or BBS accounts, and the site you're connected to
is a CIX member, then you have full CIX connectivity and can
cheerfully ignore this issue. Otherwise, the bottom line seems
to be that you could ignore it anyway. Stay tuned, though:
this optimistic vision is probably good for the next 30 days and
no longer.
Bob Collet (rcollet@sprint.net), a spokesperson for the CIX Board,
was kind enough to review the above. As his conclusion to a short
list of suggestions, he wrote: "Suggest toning down the personal
opinion flavor of the document." His belief is that my anti-CIX
prejudices are showing rather blatantly, and that an impartial
document would be more neutral in tone. I have invited Mr Collet or
any representative he wishes to choose to contribute a statement of
CIX policy, which I will insert here verbatim if and when it arrives.
Bob Washburn was Executive Director of the CIX until a month or two
ago. Mr Washburn was taking care of most of the public relations for
the organization, and his departure seems to have left the PR tasks
up to members of the board. They are presently searching for a
replacement, which may be one reason the flow of information out of
the CIX is so sluggish. There are now approximately 100 CIX members.
It is thus worth noting that this document consists of an analysis
created by me using the best information I know - the various
messages I read on the inet-access and com-priv mailing lists.
While I hope it has been of value, clearly it cannot guarantee
anyone's future policy, and does not constitute legal advice.
I will definitely plead guilty to making an attempt to give this
rather dry material a bit of entertainment value.
(This section is largely obsolete, since Net-99 is effectively no more.
See the previous section on national providers).
According to Karl Denninger
"Net99 is a commercial effort by Joe Stroup and myself to provide a
resale-encouraged, peering-mandatory, backbone environment for the small
and medium sized reseller. Net99 is not a cooperative, or a non-profit.
Net99 is, however, an alternative project which should, if preliminary
indications are good, provide a reasonable and affordable alternative for
the reseller of Internet connectivity when squared off against the large
companies now domainating this portion of the network infrastructure."
Net-99 beat their November 1 deadline by a very considerable margin,
having POPs up in mid-October. They presently offer service in the
following cities:
New York, Houston, Los Angeles, Chicago, San Jose, Boston, Philadelphia
When asked for the number of sites presently on Net-99, Karl said,
"Can't give you an accurate count; its growing incredibly rapidly!"
Robert Gibson
"We have a connection via T1 to NET99, and it works very well. We
also have other T1 connections into the Internet via Sprint, Navy.
I have found the connectivity and support GREAT. ... NET99 is
*great* in terms of service, and I would gladly pay a few $$$ for
service, and enough $$$ to keep the network growing."
Other Net-99 customers have been similarly effusive; I have yet to
hear a single complaint, which is quite rare on the net.
Metering is the idea that users and service providers should be charged
depending on how much use they make of the service. At first blush, it
seems only fair; if you're on the net for an hour a week, you should
pay less than those who are on for five hours a day. For customers of
metered services, however, it tends to be a very bad idea indeed.
There are really two types of metering: Usage-based charging of users,
and usage-based charges made by backbone providers. Very few people
have much against the former, since free competition seems to be eliminating
it (other than the toll-free number options of many vendors, which have
to charge by the hour to pay the phone company's cut).
The latter, however, is a different kettle of fish. Most of the time,
when people talk about metering, they are talking about charges per
packet for Internet use. As a provider, you would be charged for backbone
use by your connection provider (such as SprintNet). The problem, of
course, is that this means you'd have to pass those charges to your
users in the form of hourly fees; this would effectively eliminate the
flat-rate pricing model that's been so successful.
What's the argument for flat-rate pricing? There are really three:
People are much more eager to use a resource when it's not metered.
Most people won't use a service for anything but the most vital needs
when they hear the clock ticking in their heads. The net's ethic
is founded on volenteer work of all kinds, like the production of
FAQs such as this one, the moderation of newsgroups, and so on.
This work would be prohibitively expensive with metered use, and
the amount of information available would be much lower.
Second, flat-rate is almost always cheaper for the user than the
metered option. Consider two pricing models I've seen:
$ 6/month plus $ 2/hour (UUNET)
$ 17.50/month flat rate (Netcom)
If you spend just 6 hours on the net each month, the flat rate becomes
cheaper than the metered price. If you really enjoy the net and
spent 3 hours a day on the system, your bill would be nearly $ 200
a month!
Finally, measured accounts can be a real hassle due to the difficulty
of administrating the timed accounts. This administration costs a
remarkably high percentage of the gain in revenues obtained.
The Internet has become the lively, fun and often bizarre resource it
is today largely BECAUSE people didn't have to pay by the hour or by
the packet. If the big communications near-monopolies ganged together
and offered only hourly rates, the Internet would be changed beyond
recognition. This is why people who are normally the most ardent
free market advocates are pushing for some kind of regulation of backbone
services.
Sort answer: If you are an Internet provider, you almost certainly
don't need or want a firewall.
Long answer: A firewall is a machine that separates your internal
company network from the wild and wooly Internet. Ideally, it will
let employees of your company do things such as send mail and browse
the web without exposing your systems to the security risks that
normally would come with such.
Here's a simplified diagram:
Internet
Router
Firewall
Your machines
Note that all packets coming in from the Internet go through the
firewall. The strictest form of firewall doesn't pass any packets
between it and your machines at all; mail, for example, will run on
the firewall machine and stay there until it is called for by one of
your company machines. Packets thus cannot go directly between your
company's machines (in the internal network) and the Internet.
The problem with this, of course, is that your machines cannot perform
useful work, either. You cannot surf the WWW or FTP files from your
PC, since packets won't go through the firewall.
A program called a Proxy Server can help with this. A proxy server
takes HTTP requests from your internal network and sends them along to
the outside world; then it takes the responses and returns them to
your internal network. As a special bonus, this server can also cache
(save) pages to the firewall system's local disk drive; then later
requests can be fulfulled instantly, without the delay of full
transfer via the Internet. (This is what the Prodigy and AOL browsers
do).
If you're an Internet provider, of course, your users will expect full
and direct access to the Internet. Thus, you really cannot use a
firewall machine for an Internet provider.
For detailed information on firewalls and other security
considerations, check out this URL: http://www.telstra.com.au/info/security.html
Next section: Internet Software tips, tricks and answers
8.2 What is NET-99?
8.3 What is Metering, and why are people so emotional about it?
8.4 What is a Firewall, and do I need one?