- NANOG - lists.nanog.org

Re: recap of nanog-futures on "on topic" and proposed compromise
by Fred Heutte 25 Sep '06

25 Sep '06

Creating consternation around boundary conditions and then proposing artificial self-serving "compromises" is one of the oldest games there is on mailing lists, going back pretty much to the invention of Usenet. At the risk of playing a small role in this instance, as a longtime lurker I simply point out the predictable failure pattern here. Fred ---------------- > >Basically, there is a crowd that says only network related stuff, say, >trasnit ISP's (as an example, not to say them alone) would be interested >in, is on topic. > >Others say there are other issues which are oprations related and >of interest to them. We are split. > >A compromise has now been suggested (by me). The only thing both sides >agree on is that in fact, the replies and flame wars on what is on topic >or isn't, and who should speak of what, are disruptive. > >Thus, the compromise idea is that for now and for a predetermined period >of time, we start with one small change. Debugging is done one step at a >time rather than in earthshattering moves. > >How about we, for now, only change one thing about NANOG - the specific >off topic posts that tell others to be quiet, or that they are >off-topic will be disallowed. This is really a concensus and a good way to >start making progress rather than escalating a conflict between people >who just want to get things done and see the NANOG community as a home. > >I believe it's a good temporary solution which will take us ahead, to >measure how things go, as well as be able to find out what we all agree >on afterwards. As well as increase the value of the list almost >immediately. > >This re-cap is from my perspective, naturally. We can keep arguing over >who said what or what's on or off topic forever. Consolidating on what we >all agree would be a change for the better and starting there sounds like >a good idea to me. > >Solving this in a civil fashion just became so much more attractive. > >Thanks, > > Gadi. > >

2 1

NANOG Thread
by Alexander Harrowell 24 Sep '06

24 Sep '06

After recent events, may I propose the ultimate NANOG thread.. NANOG User: Message Richard A Steenbergen: Can we keep this off-topic crap off NANOG? Gadi Evron: That message is deeply relevant to us all. I can't understand what your porblme is. Sean Donelan: Fascinating, User. I suppose ISSUE would be different if you were running a NETWORK and using ROUTER. Christopher L. Morrow: I think you have a point, Sean, but can you try not to engage with this? ISSUE is definitely off topic. RAS: Only Auntie Jane on a crappy Windows box would have ISSUE anyway. Donelan/Evron/Morrow in chorus: But Jane is our customer. RAS/Bill Manning together: Get a clue! Valdis Kletnieks: NANOG User said: <<<<<< <<<<< <<<< <<<< <<< <<< << <snip> We had ISSUE on a DEVICE in our FACILITY back in 2004. Have you got the DATA? >>>. ... .>>> >>> >>> >> Of course all this wouldn't be a problem if STANDARDS BODY had got a clue and decided to implement PROPOSAL. NANOG User: *pastes 86 hop tracert, last week's BGP update log and half the CIDR report* Valdis/RAS/Evron/Bill/Morrow: Couldn't you have sent that offlist? Get a clue! NANOG User: I'm sorry if I offended your refined sensibilities. Who do you think you are? Random Lurker desperately seeking status: Bill is right. This is the Network Operators' list. RAS: Anyway, PROPOSAL would have been a good idea, but nobody was ever going to deploy it. We ought to go straight to IPVersionX. All: IP Version X?? Get a clue! Valdis: Only someone who thinks we ought to go back to ATM would support that Bellhead POS. From a network architecture perspective, it's plain stupid. Evron: You obviously have no idea of how the botnets would exploit that. Bill: Gadi, that's off topic. Morrow: No, it's not. Third-world ISP operator: Hello, I've got SERIOUS PROBLEM on my network in POOR COUNTRY and no money. Can anyone advise on how we can fix it? Thanks Randy Bush: I can't read your message. It's got capital letters in it. Anyway, I think we need to get back to some operational content. Fergie: Hey guys, this looks interesting - <a href="http://link.to.newsstory">Chinese scientists teach monkey to write technical manual</a> Randy Bush: I can't read your message. It's got HTML in it. Valdis: RFCx says you can have capital letters AND links in your e-mail. Randy: I don't care. Evron: Major security alert! Morrow: Bullshit. RAS: No, that is on topic. Donelan: Probably more suited to LIST, but it certainly has consequences for support costs. NANOG User: Why does Sean always take RAS's side like this? Peter Dambier: It's because of the 2004 Olympics that all e-mail has to be routed to the European Commission so the SS7 signalling can be screened for correct geopolitical routing. I can see this because my traceroute is broken! << <<< <<,<< ,<< <<< <, User, I think your ISSUE could be resolved by WILDLY IMPRACTICAL SOLUTION, as long as you use an alternate root server. Valdis: Peter, you're insane. Peter Dambier: The psychiatric-industrial complex denounces all victims of ICANN mind control as "mentally ill"! Resist the empire now! NANOG User: Is that on topic for NANOG? All: That is on topic/That is off topic! Bill: Well, I think he's got a point about ICANN. RAS: They're nowhere near as bad as ARIN, though. I only wanted another /8 and it took me three whole weeks! All: Swine! Donelan: ARIN's never been a problem for me. Another NANOG User: STUPID REMARK about evil state bureaucracies forcing their eurosexual communism on us. Buy guns! Evron: So who should assign IPs? AT&T? Get a clue! Randy Bush: You would say that. Anyway, I think WILDLY IMPRACTICAL SOLUTION is actually quite a good idea, except for the alternate root bit. Back at RESEARCH CENTRE in the 1970s, Vint Cerf and I tried something similar. Bill: Namedropper! Moderator(a)mitre.edu: I think this thread should be moved to NANOG-FUTURES. RAS: Why isn't there a NANOG-CRAP? Moderator(a)mitre.edu: Are you sure there isn't? Morrow: Anyone else seeing high latency to TELCO in CITY? Crickets: chirping Random Lurker, still hoping one of the silverbacks will show him some love: So, what about IPVersion Y? All: That's not operational! *thread peters out in howling clue vacuum*

2 1

Re: NANOG Thread
by Alexander Harrowell 24 Sep '06

24 Sep '06

This inspired me: http://highclearing.com/index.php/archives/2006/04/07/4991

1 0

Re: Telehouse North outage?
by Brandon Butterworth 24 Sep '06

24 Sep '06

> Does anybody have details about a power outage at Telehouse North today? There was no power to a fair proportion of it for around 5 minutes at approx 12:50BST brandon

2 1

recap of nanog-futures on "on topic" and proposed compromise
by Gadi Evron 24 Sep '06

24 Sep '06

Basically, there is a crowd that says only network related stuff, say, trasnit ISP's (as an example, not to say them alone) would be interested in, is on topic. Others say there are other issues which are oprations related and of interest to them. We are split. A compromise has now been suggested (by me). The only thing both sides agree on is that in fact, the replies and flame wars on what is on topic or isn't, and who should speak of what, are disruptive. Thus, the compromise idea is that for now and for a predetermined period of time, we start with one small change. Debugging is done one step at a time rather than in earthshattering moves. How about we, for now, only change one thing about NANOG - the specific off topic posts that tell others to be quiet, or that they are off-topic will be disallowed. This is really a concensus and a good way to start making progress rather than escalating a conflict between people who just want to get things done and see the NANOG community as a home. I believe it's a good temporary solution which will take us ahead, to measure how things go, as well as be able to find out what we all agree on afterwards. As well as increase the value of the list almost immediately. This re-cap is from my perspective, naturally. We can keep arguing over who said what or what's on or off topic forever. Consolidating on what we all agree would be a change for the better and starting there sounds like a good idea to me. Solving this in a civil fashion just became so much more attractive. Thanks, Gadi.

2 1

Telehouse North outage?
by Cat Okita 24 Sep '06

24 Sep '06

Does anybody have details about a power outage at Telehouse North today? The first routing issues that reflected the issue appeared around 13:00BST, but I don't have any details about the cause. cheers! ========================================================================== "A cat spends her life conflicted between a deep, passionate and profound desire for fish and an equally deep, passionate and profound desire to avoid getting wet. This is the defining metaphor of my life right now."

1 0

shared hosting and attacks [FWD: [funsec] HostGator: cPanel Security Hole Exploited in Mass Hack]
by Gadi Evron 24 Sep '06

24 Sep '06

Hi, the following post is a forward of an email by Fergie to funsec. This story by itself is not relevant to NANOG, but it does illustrate a problem nearly all of us have been facing. Mass exploitation of servers in our nets, colos and hosting farms. Nearly ever (relevant, not say, just a transit one) ISP I spoke to globally has this problem. With thousands of sites on every server and virtual machines everywhere, all it takes is one insecure web application such as xxxBB or PHPxx for the server to be remote accessed, and for a remote connect-back shell to be installed. The rest is history. This is often soon followed with masses of defacements, spam, bots, ddos, etc. We all (well, never say all, every, never, ever, etc.), many of us face this. What solutions have you found? Some solutions I heard used, or utilized: 1. Remote scanning of web servers. 2. Much stronger security enforcement on servers. 3. "Quietly patching" user web applications without permission. 4. JGH - Just getting hacked. What have you encountered? What have you done, sorry, heard of someone else do, to combat this very difficult problem on your networks? The whole business of this hosting is the low cost, and everyone wastes countless man hours on killing fires. This is not about BGP, but it is an operational problem that bugs us, operators. Thanks, Gadi. ---------- Forwarded message ---------- Date: Sat, 23 Sep 2006 21:47:37 GMT From: Fergie <fergdawg(a)netzero.net> To: funsec(a)linuxbox.org Subject: [funsec] HostGator: cPanel Security Hole Exploited in Mass Hack Via Netcraft. [snip] HostGator says hackers compromised its servers using a previously unknown security hole in cPanel, the control panel software that is widely used by hosting providers. "I can tell you with all accuracy that this is definitely due to a cPanel exploit that provides root access and all cPanel servers are affected," said HostGator system administrator Tim Greer. "This issue affects all versions of cPanel, from what I can tell, from years ago to the current releases, including Stable, Release, Current and Edge." cPanel has just released a fix. "Running /scripts/upcp will fix the vulnerability in all builds," cPanel said in a message on its user forums. "Please note that this is a local exploit which requires access to a cPanel account. ... If you believe you have been exploited through this vulnerability, you are welcome to submit a support request for assistance." Hackers gained access to HostGator's servers late Thursday and began redirecting customer sites to outside web pages that exploit an unpatched VML security hole in Internet Explorer to infect web surfers with trojans. The existence of the new "0-day" exploit of cPanel leaves a large number of hosting companies vulnerable to similar attacks until they install the patch. The riusk is mitigated somewhat by the fact that it is a local exploit, meaning any attack on a host must be launched from an existing account with cPanel access. HostGator site owners said iframe code inserted into their web pages was redirecting users to the malware-laden pages. Company staff made several efforts to reconfigure servers on Friday, only to have the exploits recur. By early Saturday morning, HostGator managers were assuring users that the cause of the redirections had been isolated, and was due to a new exploit targeting cPanel. [snip] Link: http://news.netcraft.com/archives/2006/09/23/hostgator_cpanel_security_hole… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.

2 1

Re: Topicality and audiences [was Re: tech support being flooded due to IE 0day]
by Laurence F. Sheldon, Jr. 24 Sep '06

24 Sep '06

It doesn't matter who wrote: > If you don't find network operations to be relevant, then by all > means STOP POSTING TO THE GOD DAMNED NETWORK OPERATIONS MAILING LIST. > Some of those, particularly those who *gasp* run networks, still find > it relevent. If there is this much disagreement about your posts, > maybe you should find a different place to make them. In spite of repeated rants like this one (I'm too tired and lazy to disguise the author of it further, the particular author here is not important), the problem is not "What kind of list is NANOG?" It really isn't. I don't think a strong case that many active posters here are confused about that it really hard to make. There really ought to be a moratorium on the question of what kind of a list is NANOG. The question has always been, in my my mind, "What the hell does "Operations" mean to the participants here. (I have on several occasions said what I think it means to others, I'll spare me the agony of doing that again just now.) I have for years incorrectly assumed (nay, insisted) that "Operations topics" include just about everything that has to do with operating a network or networks, or network of networks. I don't think it includes the mindless, repetitive, numbing harassment of somebody that has an issue affecting his or her operation that either needs help, or wants to share a lesson learned. Frankly, a scholarly analysis of the archives (edited or not) would show, I'll bet, that there are more items about what is on topic than there are about any other subject-group. -- Requiescas in pace o email Ex turpi causa non oritur actio http://members.cox.net/larrysheldon/

5 4

Re: fyi-- [dns-operations] early key rollover for dlv.isc.org
by Fergie 23 Sep '06

23 Sep '06

But of course. So ask yourself; What is special about "3" and "65537"? - ferg -- Joseph S D Yao <jsdy(a)center.osis.gov> wrote: On Fri, Sep 22, 2006 at 11:39:51PM +0000, Fergie wrote: > Hmmm. It wouldn't have anything to do with prime numbers, now would > it? :-) Well, yes, but there are an infinite number of them. Of course, 17 is the most prime of them all. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Potentially on-Topic: is MSNBot for real?
by Mark Foster 23 Sep '06

23 Sep '06

On a website I host with nearly 9000 unique visits month-to-date (thats visits, not hits) a full 20% of the recorded 'hits' (Hitcount is ~40,000) are being generated by 'msnbot'. We see this as a large amount of http traffic from IP addresses owned by Microsoft. I've actually seen this across a number of websites (including my own) but the guest on my server has raised the issue of loading being completely misproportionate to the perceived value of the visit - and asked about potentially blocking them off entirely. Is this unusual, or what? Are search engines supposed to be amongst the biggest user agents recorded on a typical website? How much trolling and indexing is considered 'too much' ? At what point to the search engines themselves become a menace - the load the cause outweighs the value of said load? (I'd like my cpu cycles to be for real people, please...) Off-list thoughts on this welcome if the operational relevance of this issue is questioned... Cheers Mark.

2 2