- NANOG - lists.nanog.org

Re: Schneier: ISPs should bear security burden
by Fergie (Paul Ferguson) 01 May '05

01 May '05

Oh, please. If you think that the Internet should remain an "every man for himself", wild wild west, Ok Corral, situation (not my words, mind you), then you better get with the powers that will steam-roll all of us if we let it -- money and marketing. This ain't no science project anymore. Bruce is right -- right as rain -- I don't give two damns whether you think it is an issue of marketing, or protecive self-advertising. The issue is that the _consumers_ want it, that's what they'll pay for, and it is the ISP's perogative to either honor that wish, or lose the business. We owe to our customers, and we owe it to ourselves, so let's just stop finding excise to side-step the issue. Sound about right? - ferg Owen DeLong <owen(a)delong.com> writes: So much for any sort of journalistic ethic, fact checking, or, unbiased reporting. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

14 18

Re: FCC To Require 911 for VoIP
by Jay R. Ashworth 01 May '05

01 May '05

On Sun, May 01, 2005 at 09:51:33AM -0700, Bill Woodcock wrote: > That said, a widely-implemented well-known anycast address that would > give you location information is a really cool idea. A smoother > imlementation might be to just have a well-known address that you'd > do a DNS LOC query against, since describing locations better than > postal-codes do is a problem the DNS folks have already solved. Which address would resolve differently, depending on which DNS server you're talking to? I'm not sure that's good enough; being able to identify the *network ingress point* is the thing I'm after. For wired connections, that's the access concentrator, for wireless ones, the nearest tower. It would be necessary to be able to tailor the response to the inquiry based on that, I think, to fulfill the requirement *I'm* trying to fulfill in this posited design -- which is not guaranteed to be the same as any possible regulatory requirement. Cheers, -- jra -- Jay R. Ashworth jra(a)baylink.com Designer Baylink RFC 2100 Ashworth & Associates The Things I Think '87 e24 St Petersburg FL USA http://baylink.pitas.com +1 727 647 1274 If you can read this... thank a system administrator. Or two. --me

1 0

Re: Schneier: ISPs should bear security burden
by dlr＠bungi.com 01 May '05

01 May '05

[In the message entitled "Re: Schneier: ISPs should bear security burden" on Apr 28, 10:20, "Steve Sobol" writes:] > There are some basic rules of thumb you can use. The problem is that they're > not guaranteed to work. The best solution was created years ago (Gordon > Fecyk's DUL, which lists IP ranges the ISPs specifically register as > dynamic/not supposed to host servers) and eventually came under the purview of > Kelkea/MAPS, but there wasn't a ton of ISP buy-in. If we could create a > similar list and actually get ISPs to register the appropriate netblocks (and > not mix in IPs where servers are allowed, and IPs where they aren't, in the > same block), that'd be great. Dunno what a ton of ISP buy-in is, but the MAPS DUL now contains about 190,000,000 entries. We've been working on it very hard for the last year or two. Most ISP-level subscribers figure it stops a pretty large percentage of the compromised-home-computer spam. --

3 2

Re: Schneier: ISPs should bear security burden
by James Baldwin 01 May '05

01 May '05

On 27 Apr 2005, at 17:51, Pakojo Samm wrote: > Give me a *clear* unobstructed line (that stays up) at > the cheapest price please. Your attitude is very much the norm, however your requirements on connectivity are more stringent. All customers want unobstructed access and, we as an ISP, want to provide it. Obstructions to service, regardless of fault or utility, generate call volume. The vast majority of subscribers, measured in millions, are not obstructed by filtered internet services. Subscribers do not understand the benefits of complete end-to-end connectivity nor do they perceive filtered connections as less valuable than other services. For those subscribers who do notice these obstruction, we offer more robust connections at a different price point. The reasoning is simple: in order to provide the best connectivity possible, measured by least obstructions perceived by the user at the lowest price point, at the highest margin possible we need to relocate the operating cost to the appropriate party. Providing all users with unfiltered transit increases our operating expense without providing the customer with any added benefit. Providing a subset of users with unfiltered transit when necessary pushes that expense onto the users requesting additional service. As you said, customer desire the cheapest stable connection they can locate. Value added services aid in retention when cheaper rates are offered by competitors and we are not willing to match that price point. Subscribers are willing to pay more for connectivity instead of incurring the cost of replacing their email address, their ISP associated software, etc. On 28 Apr 2005, at 00:55, Owen DeLong wrote: > Who are you to decide that there is no damage to blocking residential > customers? The customer makes the decision when they subscribe to a service whether or not filtered service will meet their needs. Who are you to decide that unfiltered service is required to meet the needs of all customers? > Why should an ISP decide what a residential > customer can or can't do with their internet connection. The service provider should be able to decide what services they wish to offer. If a provider of any service chooses to differentiate services based on utility and the customer is made aware of these characteristics, how is this in anyway unfair? If your objection is that, in single provider markets, it may not be financially viable to obtain your desire service level i.e. the local cable provider does not offer unfiltered connectivity and there are no other residential high bandwidth options available then I suggest you encourage diversity in the market place. You are not entitled to unfiltered internet connectivity. If you want to be entitled to unfiltered internet connectivity then petition your local government to make transit a privatized utility with all the government oversight and bureaucracy that entails. --- James Baldwin hkp://pgp.mit.edu/jbaldwin@antinode.net "Syntatic sugar causes cancer of the semicolon."

5 7

RE: Schneier: ISPs should bear security burden
by Olsen, Jason 01 May '05

01 May '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Dan Hollis > To: Owen DeLong > Subject: Re: Schneier: ISPs should bear security burden > > You must not have used it much in those 20 years. I can > definitely say worms, trojans, spam, phishing, ddos, and > other attacks is up several orders of magnitude in those 20 > years. The userbase has also increased by several orders of magnitude beyond that. 1% "bad" traffic at 100 users: 1 1% "bad" traffic at 1,000,000 users: 10,000 -JFO

3 2

Re: Schneier: ISPs should bear security burden
by Owen DeLong 01 May '05

01 May '05

> We know that almost all users are too stupid to know what they really > need or how to get it, and that they need to be protected from their own > stupidity -- as well as protecting the rest of the world from their > stupidity. Not only do I not know this, I find it to be patently false. Yes, I think a high percentage of users is too ignorant to know what they need or how to get it. However, protecting them from that ignorance only propogates and perpetuates it. Pain is one of natures most effective educators. Allowing people to experience the full (as long as it's non-fatal) effect of their ignorance often creates a strong desire for education. This incredible expansion of "We must protect people from themselves" philosophy is wasteful, expensive, and, worst of all, highly destructive to society in the long run. Government or any other regulatory body should protect people from each other, not from themselves. Similarly, while knowingly producing a dangerous product should carry some civil and criminal liabilty, the fact that we have effectively made companies and professionals liable for any act of stupidity comitted by their consumers unless they specifically disclaimed or warned (and sometimes even if they did) the consumer is about 2/3rds of the cost of medicine today. It's about 1/2 of the cost of an airline ticket. It's about 3/4 of the cost of aircraft parts. The list goes on. Owen -- If it wasn't crypto-signed, it probably didn't come from me.

2 1

Re: Slashdot: Providers Ignoring DNS TTL?
by sthaug＠nethelp.no 01 May '05

01 May '05

> In your note below you speak of 'moving on to something else' when > PPLB comes. > > PPLB destabilizes TCP. It elicits erroneous retransmissions, > squanders capacity and lowers performance. I would actually dispute this. I agree that PPLB will *occasionally* lead to out-of-order packets, which will lead to lower TCP performance *when it happens*. To many customers this is acceptable as long as PPLB gives them improved performance *most of the time*. And this is what we saw very clearly at my previous employer - PPLB worked very well, and gave clearly increased performance, *most of the time*. As mentioned in another message, I don't really believe PPLB is coming. Instead I believe PPLB is something which is probably being *less* used now than a few years ago, since other link bundling methods are more easily available now (than they were a few years ago) - and these link bundling methods occur at a layer below TCP, and are invisible to TCP (no packet reordering problems). Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

8 9

Re: Schneier: ISPs should bear security burden
by Suresh Ramasubramanian 01 May '05

01 May '05

On 4/27/05, Jerry Pasker <info(a)n-connect.net> wrote: > It means 10 different things to 10 different people. The article was > vague. "Security" could mean blocking a few ports, simple Proxy/NAT, > blocking port 25 (or 139... or 53.. heh heh) or a thousand different > things. There is a market for this, it's called "managed services." Speaking of port 25 blocking for end users [note: not for transit feeds or raw pipes] - here's my take on it. http://www.circleid.com/article/1039_0_1_0_C/ --srs -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

watchdog of BIND server
by Joe Shen 30 Apr '05

30 Apr '05

Hi , currently, I run named with -f option. As named is started at system boot time, a starting up script hang around console is a possible problem for system administration & security. Is there any configurable watchdog of BIND server deamon? E.g. once it found named is down, it will shutdown network interface to make the server out of anycast group. regards Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

2 1

Internet impact of Apple Tiger
by Irwin Lazar 30 Apr '05

30 Apr '05

Some food for thought: -- http://www.gigaom.com/2005/04/28/rss-tiger-safari-and-the-bandwidth-bottlene ck/ RSS, Tiger Safari and the Bandwidth Bottleneck In less than 48 hours many of us will be installing Tiger OS-X and with it a brand new Safari browser that can read and display RSS feeds in a simple easy to understand manner. That upgrade while great for the consumers, could come as a big shocker for those blogs whose feeds are included as part of Safari¹s default starter package. Infact it could be the biggest stress test for RSS thus far! Most RSS readers are set to poll for updates every hour, and imagine when half-a-million Tiger Safari users who start hitting a server at the same time, pulling down RSS updates, because they have not changed the default settings. Server meltdown? Or an unintended denial of service? Apple says that most of the default feeds are going to be major news sites like CNN. New York Times, and LA Times. At this time they are not including any personal blogs as part of the default list. Even for them it is not going to be easy. Lets say if one of these news operations updated their site once an hour and each update results in a nominal 5 kilobytes of RSS generated data, then 500,000 simultaneous Safari users polling at top of the hour would mean a total data transfer of over 2 gigabytes per hour. Times 24, and you have over 48 gigabytes of data transfer every day just from Safari users alone. What if more than a million Tiger Safaris were on the loose. Oh boy! While an addition 48 gigabytes of traffic a day or 1.4 terabyte a month is not that much for large sites, but it will add up. Admittedly, since I don¹t have Tiger yet, not sure if Safari RSS does time-based check (every hour at :15) or checks related to when the computer/browser is started, which is relatively random and what other feed readers do. Clearly this is an imaginary scenario, but it could happen. So what¹s the fix? ³I certainly hope that Safari does conditional GET. I can¹t imagine it doesn¹t but I could be wrong,² says Brent Simmons, founder and the man behind hit feed reader, Net News Wire, ³With conditional GET you download the feed only if it¹s different from the last time you downloaded it this cuts way down on bandwidth use.² (More on conditional GET.) ³Conditional GET which NetNewsWire and most other aggregators support is hugely important,² says Simmons. But even that can go that far, since most of these news operations churn out headlines with monotonous regularity. Long term, I think RSS is going to become a clear bandwidth hog, unless the RSS people decide and come-up with an intelligent way to fix this problem. I have been tracking my own bandwidth consumption and RSS is just sucking up gigabytes like a parched man on a hot summer day. Some say that randomizing the whole RSS polling process is the answer. How about randomizing the whole RSS polling process? Instead of pulling down RSS feeds every hour, let the feeds download randomly. Okay that will help distribute the loads on the servers more evenly, but that still doesn¹t resolve the issue of inefficient use of network resources, especially for those who pay for those kind of things. Suggestions? Scott Rafer, CEO of Feedster says, ³ISPs can start caching feed URLs but if they do it with cached times of more than 10 min, then people will route around the caches.² Om Malik on Broadband 4/28/05 2:57 AM Om Malik Connected Home, Wired, Featured Comments

5 5