- NANOG - lists.nanog.org

Re: On-going Internet Emergency and Domain Names
by Fergie 03 Apr '07

03 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Patrick Giagnocavo <patrick(a)zill.net> wrote: >On Apr 2, 2007, at 10:27 PM, Douglas Otis wrote: > >> The suggestion was to preview the addition of domains 24 hours in >> advance of being published. This can identify look-alike and cousin >> domain exploits, and establish a watch list when necessary. A preview >> provides valuable information for tracking bad actors and for setting <> up more effective defenses as well. >> > >And just how many humans would this require? > >Or are you going to write a 12-kilobyte regex in Perl to do the work for you? > >Do you know how many trademarks and words that represent companies there are in existence? > >What about local lingo that might be misleading--like if you weren't familiar with college sports and thus "officialNittanyLions.com" (contrived example) didn't raise any red flags with you? > >I could see perhaps a flag or a standard value to go into TXT (maybe part of the exiting SPF conventions) that indicate the age of the domain. > >Then leave it up to the user as to what to do with that information (a mail server not allowing emails from domains less than 15 days old for example). > Good questions, all -- but having said that, there are certainly ways to approach each of these. And of course, there will obviously be things that fall through the cracks. And having said that, something is better than nothing. The value in matching newly registered domains, the registrants themselves, the nameservers, MX records, and historical IP addresses as a matrix operation is incrementally positive as the effort itself becomes also incremental in the positive. What I'm saying is this: Historical reputation systems, coupled with intelligence on known malware domains, observed fast-flux'ers, etc., gives some measure of control. You still have to do an enormous amount of weeding, but again, this is an endeavor that can be undertaken by private and commercial organizations, as long as the domain registration process is changed only slightly, to allow for a minor delay between toe time that the registration(s) are made, and the time that they become "live". As it stands now, everyone gets pretty much blind-sided by domains that crop up solely for the sake of malfeasance. I'm not sure I articulated that very well, but there it is. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGEcveq1pz9mNUZTMRAtR8AKDvPCd/yJ4plkMROu/xg69CiHWfuQCfUmpZ SEW7BxFuIWvenbzn3KxBK38= =3prE -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: On-going Internet Emergency and Domain Names
by Fergie 03 Apr '07

03 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Correction: - -- "Fergie" <fergdawg(a)netzero.net> wrote: >-- Joseph S D Yao <jsdy(a)center.osis.gov> wrote: > >>See the aforementioned "restock fees" presented to ICANN. How much of a >>disincentive would they be? >> > >Not much, I would think. > > http://www.icann.org/minutes/resolutions-22nov06.htm > >Unless you have a more explicit pointer, a quick check at ICANN >reveals that the "restock fee" proposed in November 2000 applies ^^^^ 2006 >to PIR and the .ORG TLD. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGEcbEq1pz9mNUZTMRAg4BAJ4ziGIW/eb23Ayhqs66V40dqc6RgACgoFIa EiA+IkpvIcwLCNTgi+d3opw= =bM0V -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: On-going Internet Emergency and Domain Names
by Fergie 03 Apr '07

03 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Joseph S D Yao <jsdy(a)center.osis.gov> wrote: >See the aforementioned "restock fees" presented to ICANN. How much of a >disincentive would they be? > Not much, I would think. http://www.icann.org/minutes/resolutions-22nov06.htm Unless you have a more explicit pointer, a quick check at ICANN reveals that the "restock fee" proposed in November 2000 applies to PIR and the .ORG TLD. And even if it applied to all (non-ccTLD) domains across the board, it probably wouldn't stop the abuse that we are seeing with bulk registrations, tasting, abuse, etc. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGEcSxq1pz9mNUZTMRAnmDAJwNhX1NRADNzvqoWbXp6Yt3at81UACg87Pw 0MFaN0+owW878PmA7bRx9ZI= =5VZI -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Month of NANOG Bugs
by Team Whiner 03 Apr '07

03 Apr '07

Month of NANOG Bugs Team NANOG Whiners present the Month of Nanog Bugs Every day for the next month, the NANOG Whiners Group will introduce a new exploit and post this exploit to the greatest networking list on this side of planet Google Earth. With a special thanks to Vint Cerf for being the ambassador of planet Google Earth. Our focus is short, effective, simple, and to the point: To eliminate possible unforseen future bugs in the methods NANOG registrants post messages to what is supposed to be a moderated list. This month will be the time to cease posting the kinds of messages that some on the list view as harmful to the NANOG environment. No more posting about viruses, worms and malware. This is not relevant to NANOG as viruses, worms and malware do not traverse any known networks, routers, serial interfaces, ethernet, FDDI, token ring, FE, GE and ATM interfaces. Conversations on malicious traffic should be re-directed to Microsoft.com's servers in hopes they can address issues with their operating system No more talk about contacting the admin of Network X Extrememly irrelevant. Just because the administrators of Network X are on the NANOG mailing list, Team NANOG Whiners prohibits other engineers from acquiring the relevant information on contacting said engineers in hopes to mitigate and resolve network issues that affect hundreds perhaps thousands of users worldwide. No more talk about networking in general Team NANOG Whiners is asking the NANOG community to cease and desist posting informational clues as to how to route, filter, and other operational topics to the list. This ensures that no one on the NANOG list receives any helpful information throughout the course of the business day. No more messages from the following individuals: Steve Bellovin Fred Baker Michael Dillon Randy Bush Sean Donelan Anyone from Cisco.com While we've appreciated their insight and relevant information throughout the years, it is Team NANOG Whiners' view that they have flooded our inboxes for far too long with the kind of information one would need a PhD in either electrical engineering, computer science, a CCIE in Routing and Switching, and or a CISSP CCNP CEH MCSE (combined). This is not productive to us and interferes with our time allocated to Youtube, IRC, Jennycam. Team NANOG Whiners is committed to providing irrelevant uninformational threads on the NANOG mailing list so as to not affect the quality time of other engineers around the world. Time is the most valuable substance on the planet and allocation of this time is crucial in the every day course of business. Team NANOG Whiners is committed to ensuring that the only postings that make it through to the NANOG list are postings that ensure that engineers around the world can dissect the information in realtime, and use time the saved as unproductively as possible. Team NANOG Whiners is committed to providing the individuals that make this world a better place with a pedestal so they can showcase their talents that only they and only they possess. These talents include pretending their from the ghetto which has been mastered by the gracious bisexual transvestite Prex. The "I_KNOW_EVERYTHING_IN_DA_WURLD" mastered by Anton Kapela, and all other sorts of unheard of talents including setting modes +kb #nanog and #cisco on the EFNET. Thank you and Happy April Fools.

2 1

Re: On-going Internet Emergency and Domain Names
by Fergie 03 Apr '07

03 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- David Conrad <drc(a)virtualized.org> wrote: >On Apr 2, 2007, at 7:12 PM, Joseph S D Yao wrote: >> On Mon, Apr 02, 2007 at 05:33:08PM -0700, David Conrad wrote: >>> I think this might be a bit in conflict with efforts registries have to >>> reduce the turnaround in zone modification to the order of tens of >>> minutes. >> >> Why is this necessary? Other than the cool factor. > >I think the question is "why should the Internet be constrained to engineering decisions made in 1992?" > For me, it's more of a matter of "Is the Internet actually a bigger cesspool than it was ten years ago?" and the answer I keep hearing from every corner is a resounding "Yes". $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGEbXnq1pz9mNUZTMRAmdfAJ0W1L5jl5qjl6YNJQZCfJa/CZnwfQCgy7xd FXLYVmJDk2xTJGqgVNRt6Eg= =WXoe -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: On-going Internet Emergency and Domain Names
by Fergie 03 Apr '07

03 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- David Conrad <drc(a)virtualized.org> wrote: >On Apr 2, 2007, at 4:56 PM, Douglas Otis wrote: >> The recommendation was for registries to provide a preview of the >> next day's zone. > >I think this might be a bit in conflict with efforts registries have to reduce the turnaround in zone modification to the order of tens of minutes. > I'm not even sure how to respond to that one. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGEaSsq1pz9mNUZTMRAofwAJ44O+cHJ8K5+Ini4Ub8Q5fpBYXpwQCeKUno QLU8T4gI9IgFRRBX0J9UV2A= =oDm8 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Google TiSP (BETA), new FREE in-home wireless broadband service
by Johnny Eriksson 03 Apr '07

03 Apr '07

> http://www.google.com/tisp/ A Client-Sewer implementation? --Johnny

1 0

Support at LimeLight
by Chris L. Morrow 02 Apr '07

02 Apr '07

Could Jack please ping me off-list? :) I seem to have broken something of yours. -Chris ( a jack-a-like at llnw would also work fine)

1 0

RE: On-going Internet Emergency and Domain Names
by dlr＠bungi.com 02 Apr '07

02 Apr '07

[In the message entitled "RE: On-going Internet Emergency and Domain Names" on Mar 31, 15:26, Matt Ghali writes:] > > On Sat, 31 Mar 2007, Fergie wrote: > > > So very clever. > > > > If you're not part of the solution... etc. > > I feel so worthless standing next to you, the Solver. > Guys. We *all* (everyone reading this) have a role to play in dealing with problems on the Internet. There is *no* "one true solution" to what amounts to criminal activity - not on the Internet, and not in real life. We, collectively, have enabled a new frontier of civilization. The Internet is ever growing and changing, and we, collectively, need to address problems as they come up. The dominant OS vendor is currently part of the issue, certainly. But if that dominant OS vendor were (insert your favorite UNIX OS vendor), the same problems would exist. We are not fighting technology. We are dealing with very well organized, smart, and well-funded people. We need to focus on solutions that we can deploy, which will address the problems at hand, as we discover them. That means we will deploy things that do not solve underlying prolems, but address the symptoms as best we can, to prevent the entire mess from falling down. That means that we must look at short-range solutions to address things in near-real-time, and we need to look at changing the legal system to catch up. We also need to look at the policies which enable people to abuse the systems we have deployed. And we need to look at user education. And fixing the operating systems. And improving infrastructure, so we can deal with 15 Gbps attacks. And... There is no "one true solution" to this. That means you, as network operators, need to look at what makes sense *today*, and *DEPLOY IT*. "Someone else" isn't going to solve these issues, and waiting for them is folly. Do what you can, today, to address the problems you know about. Do what you can, today, to protect your users. Do what you can, today, to stop malicious behaviour from leaving your network. Do what you can, today, to improve your internal organization to ensure that these task can be done without a 6 month delay. Please - we all need to work on this together. But we need to do it now. --

8 10

CNNOG 4: Call for Presentations - June 22-23 2007 - Beijing, China
by Li Hua 02 Apr '07

02 Apr '07

*Call for Presentations--CNNOG 4 & NSP-SEC-China Summit** * The China Network Operators' Group (CNNOG) and first nsp-sec-china summit will hold its 4th meeting June 22-23, 2007, in Beijing, China. The meeting will be hosted by BUPT. <http://www.bupt.edu.cn/cin/index.htm> CNNOG conferences provide a forum for information exchange among network operators, engineers, and researchers. Meetings are held 1-2 times each year, and include panels, presentations, tutorial sessions, and BOFs. The CNNOG community is invited to attend and participate in this forum, which offers numerous opportunities to share ideas, explore research and development, and interact with leaders in this important field of network operations. Vendors are encouraged to work with operators to present deployment experiences with the vendor's products and interoperability. *General Session* The community is invited to develop present talks on topics relevant to the CNNOG community, including: - *Network Operations* - Present-day operational case studies - Everyday life in the NOC and tools of interest - Exchange point technologies and implementation - Peering/colocation coordination issues - State of OAM tools for IP and MPLS networks - Disaster recovery and planning - - * SP Security* - ISP security best practice - Anti-DDOS,SPAM - Botnet tracking - SP Forensics - - * Deployment Experience* - VoIP deployment, architecture, peering, and interconnect - Anycast - IPTV - wireless - 3G - - *Research, and New Technology* - Approaches to securing the global routing system (e.g., s*BGP and/or other tools) - Routing system scalability - Capacity planning standards and tools - Inter-provider MPLS/QoS/PCE - IPv6: economics, deployments, and adoption rates - Approaches to IPv6 scalability, e.g., Shim6 *Talks* A general session talk should be on a topic of interest to the general CNNOG audience, and may be up to 30 minutes long. *Lightning Talks* A lightning talk is a very short presentation or speech by any attendee on any topic relevant to the CNNOG audience. These are limited to ten minutes; this will be strictly enforced. If you have a topic that's timely, interesting, or even a crackpot idea you want to share, we encourage you to consider presenting it. Signups for lightning talks will be accepted during the CNNOG meeting. *Tutorials* Proposals are also invited for tutorial sessions from the introductory through advanced level on all related topics, including: - Disaster Recovery Planning - Troubleshooting BGP - Best Practices for Determining Traffic Matrices - Options for Blackhole and Discard Routing - BGP/MPLS Layer 3 VPNs *BOFs* BOFs (Birds of a Feather sessions) are 90-minute informal sessions on topics which are of interest to a portion of the CNNOG community. A typical BOF session includes some presentations, but usually is focused on community discussion and interaction. Frequent BOF topics include: - Peering - ISP Security - Tools A BOF session is 90 minutes. * * *How to Present* The primary speaker, moderator, or author should submit presentation information to CNNOG4(a)gmail.com *All submissions must include:* - Author's name(s) - Preferred contact email address - Submission category (General Session, Panel, Tutorial, Research Forum, or BOF) - Presentation title - Abstract - Slides (attachment or URL), in PDF (preferred) or Powerpoint format (Slides are optional for BOFs.) *The deadline for proposals is Thursday, May 31, at 11:59pm.* A limited number of slots may be available after that date for topics that are exceptionally timely, important, or critical to the operation of the Internet. Submissions will be reviewed by the CNNOG Program Committee, and presenters will be notified of acceptance by June 10. Final versions for posting are due on June 15. Website: http://www.cnnog.org/cnnog4

1 1