- NANOG - lists.nanog.org

RE: clec vs ilec, how do you know who's lying?
by Olsen, Jason 19 Jul '05

19 Jul '05

David Hubbard: > how do I tell who's lying to me? If their lips are moving, they're probably lying. > I have supposed work order numbers for > the ilec but I don't have any direct contact So go to the website for the ILEC and find the conect information. As an example, SBC plasters information for the different teams all over their pages. If you identify that you're with your employer when you call in and summarize the problem, you'll get transferred to somebody who can answer your question on the ILEC work orders. Hell, they'll probably leap at the chance to "help" you in order to try and convince you to move away from the CLEC. -Fer Jason "Feren" Olsen DeVry, Inc. Senior Network Engineer One Tower Lane Em: jolsen(a)devry.com Oakbrook Terrace, IL 60181-4624 Ph: 630.645.1607 Fx: 630.382.2929

1 0

RE: clec vs ilec, how do you know who's lying?
by Kuhtz, Christian 19 Jul '05

19 Jul '05

> Hello everyone, not sure if this is off topic or not > since it is will be operational in nature if I can ever > get the service set up. :-) I'm having the pleasure, or > lack thereof, of ordering some data connectivity via a > very large clec which requires the ilec to provide the > local loops. Well we're about two months past the > estimated install completion and all I get from the clec > is continuous blame pointed at the ilec who has now > missed three install dates and in turn has wasted staff > time sitting there from 8 to 5 each of the days; assuming > they were really scheduled in the first place. I know the > two types of entities don't particularly like each other > but at this point how do I tell who's lying to me? I > have supposed work order numbers for the ilec but I don't > have any direct contact with them to see if they are > real numbers and if the disposition of the previous > work orders are what the clec has told me or if they are > messing things up themselves and trying to cover it up. Hmm, I don't know specifically how you'd resolve that since your customer relationship is likely with the clec, but.. Every ilec has a wholesale unit (in BellSouth territory this is called BellSouth ICS - Interconnection Services) and you could probably get in touch with them directly and run the work order numbers by them and see what they say. That's the sort of thing I did when I was on the outside and blamestorming started. ;-) Best regards, Christian The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 163

1 0

Can someone from AOL contact me offlist?
by Joseph Nuara 19 Jul '05

19 Jul '05

4 3

Re: Non-English Domain Names Likely Delayed
by Brandon Butterworth 19 Jul '05

19 Jul '05

> Unfortunately, the problem is inherent in human writing systems. > Consider rnicrosoft.com and paypaI.com. And people are no better than muppets in ensuring they don't screw themselves up > The good news is that fairly simple homograph rules can be applied Rules aren't safe, it involves humans. I presume that if a Chinese bank were to register their name then the similar .com would be blocked for them (just as the Chinese paypal alike would be blocked). What if the .com is a blogger, would the Chinese bank accept being blocked, would they exert pressure to have theirs anyway or would the blogger be fair game for lawyers/ICANN managed domain hijacking? "If it's too hard people won't understand it" brandon

1 0

RE: Non-English Domain Names Likely Delayed
by Jason Sloderbeck 19 Jul '05

19 Jul '05

I don't know of any other IEEE/NANOG/IETF/ICANN-sanctioned method to completely confuse even a savvy IT user who is trying to determine the validity of an SSL site. > There are dozens of ways we know of, and probably more that lie undiscovered, > to exploit vulnerabilities in DNS, browsers, and in human nature to conduct > phishing. Sure, there are bugs and hacks. The existence of such does not justify approving new measures (in this case, a glaring security hole) as a global standard. In fact, quite the opposite: folks are generally trying to fix such problems, not push them forward in public policy agenda. It's clear that no one intended for the side effect of a complete meltdown in the user layer of SSL (where the only thing you can do is double-check the URL in your browser and verify there's a padlock icon in your status bar), but the side effect is there and it's naive to pretend that fairness to non-English folks or globalization justifies a hole this large. Certainly, the vulnerability is just as much a problem for the targeted benefactors of this change. -Jason -- Jason Sloderbeck Positive Networks jason @ positivenetworks . net -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Crist Clark Sent: Monday, July 18, 2005 4:43 PM Cc: NANOG Subject: Re: Non-English Domain Names Likely Delayed Isn't someone more eloquent than I going to point out that that spending a lot of effort eliminating homographs from DNS to stop phishing is a security measure on par with cutting cell service to underground trains to prevent bombings? It focuses on one small vulnerability that phishers exploit, and "fixing" this one vulnerability just may make things worse. It wastes resources that could go to coming up with a *real* solution, and it may provide a false sense of security. Worrying about homographs is probably something about which we should let the trademark lawyers get there undies in a bunch (knowing ICANN, that may very well be what's driving this, not phishing worries) while the IT security community concerns itself with a usable, and actually secure, end-to-end security model for e-commerce. -- Crist J. Clark crist.clark(a)globalstar.com Globalstar Communications (408) 933-4387

2 1

RE: IPv6 push doesn't have much pull in U.S
by Kuhtz, Christian 18 Jul '05

18 Jul '05

> On 18-jul-2005, at 18:31, Kuhtz, Christian wrote: > > > If there is pressure to adopt IPv6 rapidly in a given > region, and that > > given region also happens to drive broadband technology > evolution, and > > North America ends up being dependent on cheap equipment primarily > > driven by overseas standards.. > > I don't see this. For instance, the need for non-ASCII characters in > (for instance) Asian languages has pushed Unicode. Modern systems in > NA are all capable of using Unicode. But do users in NA actually > _use_ Unicode? ASCII works fine for them 99% of the time. I don't disagree with that point at all. But what I was trying to say goes a little further and is basically the notion that you're likely to use gear that happens to speak Unicode because of other developments and while you may be fine using ASCII most of the time (given that it is a charset specifically developed to meet North American English needs some time ago), you may be receiving a parasitic benefit of it showing up elsewhere or everywhere else. It won't influence purchase decisions perhaps, you won't buy gear X because it doesn't do Unicode, but it may just show up as the defacto standard. Just like other charsets have made it into just about every current, modern operating system and application.. So, you'd adopt just because it's there and it's no worth fighting the current of being different. (GSM in North America is a similar example, I think :-) There are economic forces at work, that have very little to do with the suitability of technology for a specific locale, which may drive adoption of technology. > Same thing with IPv6. Windows and MacOS have had IPv6 on board for > years. Doesn't mean people use it. Yup. That is absolutely correct. But, if there are huge amounts of actions in a given market place, that's bound to spill over into a different market place because of global distribution of goods. Not because the other, different market asked for it, but just because it's more economical to make one set of gear that is a superset in the end. > > The key questions are > > > When will who you want to talk to speak IPv6? > > That's a key question when you've made up your mind to be one of the > last to adopt IPv6. Yes, and in terms of volume, that's where I see North America being right now.. We're on a track to be dead last (well, almost) on the path we are on right now (and have been for some years). > The real key question is: when will it start to > make sense to use IPv6 for my own stuff, regardless of what the rest > of the world does? Not if you are fine with what you have, and believe in never change a running system because one doesn't believe it's prudent to keep up with technology... > In an enterprise environment the ease of never > again having to think about how many hosts are going to end > up in the > same subnet alone may be quite compelling. But it only makes sense > when you can turn off IPv4 in most of the network and proxy or > translate communications to the outside. Well, I'm not sure I would be so bold as to say it's an either or choice, but it would have to be for substantial islands of a corporation or other type of organization to make economic sense. Just like there's still antiquated computing gear (& software on it) hopping around happily all over the place, although isolated and put into a scenario where there are gateways or dain bramage impact on the rest of the world is otherwise limited, there will be IPv4 in islands long after IPv6 achieves world domination (which has yet to be seen). If there is a business case for IPv6, it is pandemic rather than epidemic for as far as my rather cloudy crystal ball will let me see... Best regards, Christian The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 163

1 0

Anyone from GLBX noc monitoring?
by Drew Weaver 18 Jul '05

18 Jul '05

Thanks, -Drew

1 0

RE: IPv6 push doesn't have much pull in U.S
by Kuhtz, Christian 18 Jul '05

18 Jul '05

:) True, but, there's actually another angle to consider. If there is pressure to adopt IPv6 rapidly in a given region, and that given region also happens to drive broadband technology evolution, and North America ends up being dependent on cheap equipment primarily driven by overseas standards.. It is conceivable that North America will have a substantial economic argument for adopting IPv6 on the trailing edge, maybe just past the leading edge if you have additional factors playing into the decision. Or one may just be oblivious to the emergence of IPv6 like it has been to up to this point, and sustain that without any harm whatsoever. The key questions are When will who you want to talk to speak IPv6? When will we have a need (and be willing to pay for) addressing every device individually and directly without intermediary? When will we have a need (and be willing to pay for) pervasive crypto & "identity"? Each person/carrier/user/whatever will answer these differently, and it has a lot to do with how you work, who you do business with, and what economic pressures may apply, and whether or not you can cope with an intermediary or non-native setup. There is no globally correct answer. Or that's at least my view. Flame away. Thanks, Christian > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Iljitsch van Beijnum > Sent: Saturday, July 16, 2005 5:33 AM > To: Fergie (Paul Ferguson) > Cc: nanog(a)merit.edu > Subject: Re: IPv6 push doesn't have much pull in U.S > > > > On 16-jul-2005, at 1:57, Fergie (Paul Ferguson) wrote: > > > Someone's been listening: > > Listening to what, exactly? Still nonsense about address space > distribution. > > And I'm sure Sprint and Verio (MCI/Worldcom/UUNET too? I have a > tunnel from them in the Netherlands, not sure what they do in > the US) > are happy to hear that they're not "major U.S. service provider[s]" > since none of those offers IPv6, right? > > Also, I mostly disagree with their conclusion: > > Currently only a handful of U.S. technologists need to worry about > IPv6--those that work in the federal government, carriers, > researchers and networking vendors. If you're not in one of those > categories, the IPv6 bug won't reach you for years to come. > > Software vendors need to look at IPv6. The OS and router > vendors have > their stuff in place. The networks will follow when the time is > right, but none of it means anything if applications can't work over > IPv6. > > I'm not saying everyone has to love IPv6, but please get those pesky > facts straight... > ***** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 162

2 1

Re: Non-English Domain Names Likely Delayed
by Fergie (Paul Ferguson) 18 Jul '05

18 Jul '05

Forwarded Message from Neil Harris <neil(a)tonal.clara.co.uk> --- Fergie (Paul Ferguson) wrote: >...sez Vint...due to the prevalence of phishing: > >http://www.msnbc.msn.com/id/8586332/ > >- ferg > > Paul, I'm not registered as a poster on the Nanog list, so I thought I'd let you know that this problem is already well under control. After extensive analysis and discussion, the Mozilla community and Opera have already produced a fix for this, based on only displaying Unicode IDN labels where the registry publishes and enforces well-defined anti-homograph policies, and displaying the Punycode equivalent otherwise. All that is needed is a couple of lines of code in the Punycode -> Unicode translation code in the application, and a whitelist of TLDs. See http://www.mozilla.org/projects/security/tld-idn-policy-list.html for more details. This delegates the responsibility of catching homographs to the registries, rather than trying to catch them using ad-hoc heuristics at the browser end. In many cases, this can be as simple as restricting labels within a TLD to use a small set of non-confusable characters. In others, with wider character sets, techniques such as bundling and blocking sets of confusable labels using homograph tables can be used. RFC 3743 is a case in point. For an excellent summary of the technical details, which is intended to help anyone attempting to eliminate homographs from a naming system, see the latest, much-expanded, version of Unicode TR #36, which also links to machine-readable confusables tables. http://www.unicode.org/reports/tr36/ Already, some 21 TLDs are whitelisted, including .cn, .tw, a number of European ccTLDs, .museum, and .info. Any other registrars who want to be supported can simply E-mail Gerv at the Mozilla Foundation, or his Opera counterpart, and give them a pointer to their anti-spoofing rules. You might want to summarize to the list. -- Neil

6 8

WSJ: Information Security Where the Dangers Are
by Sean Donelan 18 Jul '05

18 Jul '05

Both Steve Bellovin and Craig Labovitz show up in today's technology section of the Wall Street Journal. Information Security Where the Dangers Are By DAVID BANK and RIVA RICHMOND Staff Reporters of THE WALL STREET JOURNAL July 18, 2005; Page R1 In the world of cybercrime, the bad guys are getting smarter -- and more ambitious. In recent months, hackers have carried out a flurry of increasingly sophisticated attacks, highlighting the vulnerability of key computer networks around the world.

1 0