- NANOG - lists.nanog.org

ATT/Bellsouth Mail
by Nick Olsen 02 Jan '13

02 Jan '13

Looking for a contact at ATT/Bellsouth regarding email acceptance. (@bellsouth.net) I've been unable to send them mail with a 550 Error (Blocked for abuse) and have requested de-listing no less then 5 times. Not getting anywhere, Normal contact routes have failed. Nick Olsen Network Operations (855) FLSPEED x106

1 0

[NANOG-announce] NANOG 57 Update
by Betty Burke <betty＠nanog.org> 02 Jan '13

02 Jan '13

Colleagues: Welcome to 2013! NANOG 57, our first meeting of the new year, scheduled for Monday, February 4-6, 2013 in sunny Orlando is well underway. The NANOG Program Committee will be sharing agenda information very soon. As always it will be linked to the NANOG 57 meeting page<http://www.nanog.org/meetings/nanog57/index.html> . I write today, sending along a few reminders regarding registration and hotel information for NANOG 57. The hotel information is as follows: - *Group Name:* NANOG - *Room Rate:* $199 single/double, plus taxes - *Group Rate Expires:* Saturday, January 12, 2013 - *Reservations:* - To call for hotel room reservations, please call 1-888-789-3090 and state that you will be attending NANOG 57. - *Online Reservations:* - Please click here <https://resweb.passkey.com/Resweb.do?mode=welcome_gi_new&groupID=10487120>for online reservations directly with the Renaissance Orlando at Seaworld. And lastly do not miss out on Registration savings: If you are not a NANOG member, consider joining by visiting *Join NANOG today <http://www.nanog.org/membership_main.html>** and receive a $25 discount on standard registration <http://www.nanog.org/membership_main.html>fees for any NANOG conference.* * * *For registration, * <http://www.nanog.org/login/> - Standard Registration starting December 17, 2012 (non-member $525, member $500, student $100) - Late Registration starting January 11, 2013 (non-member $600, member $575, student $100) - On-Site Registration starting February 1, 2013 (non-member $675, member $650, student $100) Look forward to seeing many of you in Orlando. Should you have any questions, please send email to nanog-support(a)nanog.org. Sincerely, Betty Betty Burke NANOG Executive Director 48377 Fremont Boulevard, Suite 117 Fremont, CA 94538 Tel: +1 510 492 4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Join my network on LinkedIn
by glauber gabriel via LinkedIn 02 Jan '13

02 Jan '13

LinkedIn ------------ glauber gabriel requested to add you as a connection on LinkedIn: ------------------------------------------ I'd like to add you to my professional network on LinkedIn. Accept invitation from glauber gabriel http://www.linkedin.com/e/-voa23o-hbggy9vf-4c/q0XU4EiXDUS2IbxL1NdPb3ZaZI/bl… View profile of glauber gabriel http://www.linkedin.com/e/-voa23o-hbggy9vf-4c/rso/83706038/sJhI/name/500543… ------------------------------------------ You are receiving Invitation emails. This email was intended for Ted Fischer. Learn why this is included: http://www.linkedin.com/e/-voa23o-hbggy9vf-4c/plh/http%3A%2F%2Fhelp%2Elinke… (c) 2012, LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

1 0

Re: Gmail and SSL
by Keith Medcalf 02 Jan '13

02 Jan '13

Non prime number store certificates are acceptd for SMTP (25) both to and from google. Perhaps this is CYA to prevent compromised gmail accounts from giving credentials from hijacked accounts to unknown servers. I have no idea how credentials for gmails pop pickup work but perhaps having hijacked a gmail account the hijacker can just change the target pop server address without needing to know the target crefentials. Changing to a malicious pop server would allow the credentials for that account to be compromised. Of course if this were the case I should think fixing the underlying brokedness in the UI might be a good idea as well. Sent from Samsung Mobile -------- Original message -------- From: Scott Howard <scott(a)doc.net.au> Date: To: "John R. Levine" <johnl(a)iecc.com> Cc: nanog(a)nanog.org Subject: Re: Gmail and SSL

1 0

GeekTools Whois Proxy and RIPE/RIPE-NCC
by Rodney Joffe 01 Jan '13

01 Jan '13

NANOG and ARIN Friends, 14 Years ago, at the suggestion of Jon Postel and some of the early participants in NANOG, we developed the GeekTools Whois proxy to make it easier for *us* - network security and abuse techs - to deal with the expanding number of gtlds and registrars and the varied whois servers that were appearing. The service had both a CLI and web interface. The service also led directly to the creation of whois-servers.net, which now seems to be part of a number of *nix distributions. The service has been up for 14 years, and over that time we have fulfilled the requirements of all of the whois server operators in regards to minimizing and stopping abuse of the GT whois proxy by domain scrapers, spammers, etc, while enabling the security folks to do their jobs. In some cases we have even written code to pass the ip address of the requestor to the whois server registry operator when they wanted to manage quota's directly. We think we have a really good relationship with all of the whois server operators, and I think we provide a useful service to the community, and is widely used. And in 14 years we have never been tarred as an enabler of abuse of "the whois" system. There has obviously never been any kind of charge or fee for using the proxy, or any of the other tools on GeekTools. In about 2002 we started placing a banner ad on the web interface page to offset some of the costs for the bandwidth that the proxy consumes. An average of about $70 a month for over the last 10 years. Actual bandwidth costs are higher than that of course, but it was a thought in 2002 that we had frankly forgotten about until recently. Two weeks ago RIPE-NCC, who provide the whois data for IP addresses in the RIPE region, informed us that based on decisions by their members, as of January 1st 2013, tomorrow, they would no longer provide whois proxy query response services to GeekTools unless we ponied up $1,800 a year for RIPE membership. I don't work very well above layer 7. It is what it is. So I wanted to let you know that as of midnight tonight, apparently, you won't be able to use GeekTools for RIPE related queries. If you have automated scripts, and you are one of the users who has expanded access to GeekTools, you'll need to find an alternative for RIPE queries *today*. My guess is that you will be able to query RIPE directly, once you have worked out that the address space is within RIPE's assignments. I think its wrong to have to pay for whois data that is part of a community resource . So I won't do it.

5 8

Happy new year (and contact at 7018/20057)
by Drew Weaver 31 Dec '12

31 Dec '12

Howdy and Happy New Year. We're having some IP/routing issues with AS 20057/7018 and so far attempts at hitting noc(a)att.net<mailto:noc@att.net> and noc(a)attglobal.net<mailto:noc@attglobal.net> haven't been successful. Does anyone have a contact at 20057 or 7018 or if anyone from those orgs are reading this can you please contact me off list? Thanks, -Drew

1 0

Re: Gmail and SSL
by Keith Medcalf 30 Dec '12

30 Dec '12

While i will agree that the client being able to validate the certificate directly is the best place to be, I do not see any advantage of requiring purchased certificates over self-signed certificates. IMO it provides no realistic security benefit at all. Then again I don't award points for certificate verification having anything to do with identity verification of the remote party. In other words, if I didn't sign it then the certificate posseses no more validity than an ephemeral self-signed certificate. Of course, others are free to delude themselves with additional "theatrics" and false assumtions if they want to do so. Sent from Samsung Mobile -------- Original message -------- From: Christopher Morrow <morrowc.lists(a)gmail.com> Date: To: kmedcalf <kmedcalf(a)dessus.com> Cc: mysidia@gmail.com,nanog@nanog.org Subject: Re: Gmail and SSL

1 0

Gmail and SSL
by Randy 30 Dec '12

30 Dec '12

I'm hoping to reach out to google's gmail engineers with this message, Today I noticed that for the past 3 days, email messages from my personal website's pop3 were not being received into my gmail inbox. Naturally, I figured that my pop3 service was down, but after some checking, every thing was working OK. I then checked gmail settings, and noticed some error. It explained that google is no longer accepting self signed ssl certificates. It claims that this change will "offer[s] a higher level of security to better protect your information". I don't believe that this change offers better security. In fact it is now unsecured - I am unable to use ssl with gmail, I have had to select the plain-text pop3 option. I don't have hundreds of dollars to get my ssl certificates signed, and to top it off, gmail never notified me of an error with fetching my mail. How many of email accounts trying to grab mail are failing now? I bet thousands, as a self signed certificate is a valid way of encrypting the traffic. Please google, remove this requirement. Source: http://support.google.com/mail/bin/answer.py?hl=en&answer=21291&ctx=gmail#s…

10 12

Re: Gmail and SSL
by Peter Kristolaitis 30 Dec '12

30 Dec '12

On 12/29/2012 7:41 PM, Mark - Syminet wrote: > On Dec 14, 2012, at 7:52 AM, Peter Kristolaitis <alter3d(a)alter3d.ca> wrote: > >> On 12/14/2012 10:47 AM, Randy wrote: >>> I don't have hundreds of dollars to get my ssl certificates signed >> You can get single-host certificates issued for free from StartSSL, or for very cheaply (under $10) from low-cost providers like CheapSSL.com. I've never had a problem having my StartSSL certs verified by anyone. >> > > So I guess the question really, is this: > > Is it bad, therefore - to *force* every holder of a self-signed certificate - to transmit in the clear? > There are plenty of good reasons for self-signed certs -- people stuck running a Microsoft environment might find it might difficult without it, since it's a fundamental feature of Active Directory. ;) Various F/OSS projects, like OpenVPN, generally recommend self-signed certs as a standard deployment scenario, because it actually provides an extra layer of security -- as the CA, you determine who gets a cert and who doesn't. The difficulty you'll run into is defining "self-signed". If you generate your own CA and put the certs in your /etc/ssl directory, it's still "self-signed" (as in you're the one signing the end-use certs), the only difference is that your browser, etc, won't pop up a warning because it's now "trusted". It's also important to not conflate "encryption" with "chain of trust validation". There are good reasons to encrypt without really caring who you're talking to. There are also good reasons to not necessarily trust an arbitrary list of CAs as provided by your SSL stack vendor and provide your own list, as mentioned above. Two entirely separate issues, IMHO. - Pete

1 0

really facebook?
by mike 29 Dec '12

29 Dec '12

I reloaded their app (yes, I know... sew me) and got this warning: IP address: 2600:100f:b119:c6bc:bd6f:fabb:ff30:2a3d Estimated location: Livingston, NJ, US Which seems pretty bizarre. I'm guessing they must be getting it from whois or something based on the address block for Verizon. The reverse map according to host 2600:100f:b119:c6bc:bd6f:fabb:ff30:2a3d comes back with NXDOMAIN. I suppose the real issue here is with Vz and why they don't have v6 reverse maps, but it did throw me thinking that somebody in New Jersey might have hacked my account. Mike

4 5