- NANOG - lists.nanog.org

Correction requested: VeriSign
by William Allen Simpson 04 Oct '03

04 Oct '03

-------- Original Message -------- Date: Sat, 04 Oct 2003 14:52:37 -0400 To: nytnews(a)nytimes.com Re: http://www.nytimes.com/2003/10/04/technology/04WEB.html Today, ELIZABETH OLSON relied upon press releases to write an article about the VeriSign hijacking of the .com and .net domain name spaces. The article contains a number of errors and misconceptions. These are not "anecdotal and isolated issues". Network security monitors raised the alarm worldwide during the day, many hours before VeriSign admitted that they had made the change without any advance notice to network operators (in a message to NANOG by "Matt Larson <mlarson(a)verisign.com> Mon, 15 Sep 2003 19:24:29 -0400"). This action caused a valid technical Domain Name System (DNS) response to disappear. That response is widely expected by software deployed over 20 years. The difficulties with wildcards in the DNS has been under discussion for many months (and years) within the Internet Engineering community. VeriSign should have known that this action would be a technical error that would adversely affect the entire world. The result was a meltdown at many smaller internet providers, saturated links, overloaded mail servers, and lost mail. By extension, this cost network operators worldwide hundreds of millions of dollars per day. It should come as no surprise that there are now lawsuits seeking class action status. Surprisingly however, that was not mentioned in this article. Nor is this "whether managing the Internet will be allowed to become more commercial". VeriSign does not manage the Internet. VeriSign is under contract with public entities (that do manage the Internet) to register domain names as a public trust. They violated that trust. This is not "innovation". This is Fisk and Gould attempting to corner the market. Although contacting a paid VeriSign spokesperson is obviously easier than research among a diverse group of network operators, this leads to a rather one-sided view. In the future, the New York Times might consider using Internet resources, such as email, to contact competent persons. In addition to ICANN, the Internet Architecture Board (IAB) and/or the North American Network Operators Group (NANOG) are some places that such technical assistance might be available. -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

1 0

Re: David McGuire's VeriSign article from 10/4/03 Page E01
by Owen DeLong 04 Oct '03

04 Oct '03

An open letter to the Ombudsman at the Washington Post Please also forward to David McGuire I would like to correct some errors of fact and some potentially erroneous perceptions conveyed in Mr. McGuire's article. I would appreciate it if Washington Post would correct these in a subsequent article. Perception: 1. There is no reason to believe that turning off the wildcard records in the DNS is a temporary move. ICANN has said that if there is significant evidence that these changes are not doing harm to the internet (they most definitely are), they would consider making changes to allow them to be turned back on. 2. Verisign initiated the changes without notice to ICANN, IETF, or the community at large. ICANN is, essentially, the top-level authority in such matters. IETF is the body entrusted with the engineering, design, and specifications development for the internet through the RFC process. 3. Verisign was politely asked to stop breaking the internet by ICANN quite some time before this demand letter. Verisign chose to refuse that request. Facts: 1. Verisign changed the behavior of a critical component of Internet infrastructure without hearing, notice, or even a heads up to the community until after it was implemented and the public outcry began. ICANN, while, not holding a formal hearing prior to this action, did solicit community input and review from the various organizations responsible for these issues. ICANN has not asked Verisign to change a functional part of the internet, but, to undo the changes Verisign made without hearing. This is not unreasonable and shouldn't require a hearing process that the changes didn't go through in the first place. 2. This is just the latest in a string of abuses by Verisign of their position in control of these aspects of the namespace. 3. The engineers and scientists you refer to as a close-knit group are anything but. We are a very diverse group of people from an even more diverse set of geographies. There are a number of different organizations which contain various fragments of this group, but, to my knowledge, not a single one which contains all of us. In general, our agendas are so diverse that we have tremendous trouble coming to consensus on even basic things such as the minimum IP allocation boundary. In reality, this move angered virtually everyone running any operational part of the Internet. This is the most united I have _EVER_ seen the operational portion of the Internet Community. Some further information for your consideration: 1. The Site Finder service isn't about helping lost internet users. It's about hijacking typos for profit. Verisign is trying to line it's profits while preventing others from providing similar services. Currently, an ISP can capture NXDOMAIN responses at the resolver level and, (although few do, and, most would think this was as bad as Verisign's move), redirect it to their own error handling servers. Even if an ISP does this, however, users have the option of configuring other resolvers to get their DNS services from. With Verisign placing these wildcards in the top-level zone files they have disabled this NXDOMAIN functionality for everyone. This prevents mail servers from verifying that a sender domain (or even a recipient domain) even actually exists (they all do according to DNS with the wildcard). 2. Verisign can claim that the claims are overblown all they want. They are actually mostly understated. Verisign had no right to make this change to critical infrastructure which they are operating in the public trust. The key problem here is that Verisign seems to think they own that and it is theirs to do with as they wish. The reality is that it is held in the public trust by ICANN and it's stewardship is contracted out to Verisign. 3. The statement that there is no data to indicate the core operation of DNS or the stability of the Internet has been adversely affected is a very carefully chosen set of words. While it is technically true, it creates a very different impression from what it actually says. The impression it intends to create is that there is no evidence that this broke anything. In fact, it broke quite a number of things. It did not break DNS per se, but, it did change one functional aspect of DNS in a way that was incompatible with existing systems implementations (it didn't break DNS, but, it broke several things that depend on DNS). The "stability of the internet" can be said to relate specifically to the ability to forward packets from one host to another. While it didn't impact this ability, it did affect a number of applications in an adverse manner. 4. ICANN is using anecdotal and isolated issues -- This is a most specious claim. ICANN is using real reports of real damage to functioning systems on the internet from real operators of those facilities. Sure, that's annecdotal, but, it's also annecdotal if a patient tells a doctor on the phone that his wrist has been cut and he is bleeding profusely. No rational doctor would tell this patient not to call an ambulance. No rational person in ICANNs position would not tell Verisign to undo this change post haste. 5. Verisign's claim that this is an attempt to regulate non-registry services is also untrue. The contents of the DNS zone files for the top level .com and .net zones is very much a registry service. Placing stuff in there that does not serve the public trust for which those files are contracted is very much a non-registry service, and, such things don't belong in those zone files. ICANN does not care what non-registry services Verisign wants to provide. ICANN does care about damaging polution being added to the DNS namespace by the company entrusted as a registry to manage that namespace. ICANNs right to regulate that is anything but dubious, and, Verisigns claims that it is dubious are an obvious attempt to hijack this power for yet more abuse of their contract privileges. The issues are not isolated, they are wide spread. In summary, I ask you to print an appropriate update to the facts of Mr. McGuire's piece. I ask you to check your facts and examine the situation better in order to present a less biased approach to stories about the internet in the future. I realize that because the internet operational community is so diverse it is hard to find a "spokesman". I also understand that it is easy to find the chosen spokesperson for Verisign. However, I believe that as reporters, especially for an institution like the Washington Post, you have an obligation to put in the effort to find a sampling of communities that have no designated spokespeople so that you can get their side of the story as well. In short, I don't think Mr. McGuire's biases in this article are the result of malice, but, I think they demonstrate a certain amount of laziness and nonfeasance of his journalistic responsibilities. Sincerely, Owen DeLong owen(a)delong.com P.S. The other email address I sent this to is a list which contains some portion of the North American Operations community. It might be a good resource for further comment/investigation on these issues.

1 0

Anyone from optonline.net around?
by Drew Weaver 04 Oct '03

04 Oct '03

Hit me off list please. -Drew

1 0

RE: VeriSign Capitulates
by St. Clair, James 04 Oct '03

04 Oct '03

I would add that what you perceive as a "diverse group" is still a realtively small sub-set of all the internet operations. As Owen points out, the unstated message is a group of "geeks behind the scene" (my words) ended something the great Verisign was doing for the benefit of all netizens. Shame on you.. :-) -----Original Message----- From: Owen DeLong To: Allen McRay; nanog(a)merit.edu Sent: 10/3/2003 5:47 PM Subject: RE: VeriSign Capitulates Verisign press releases have never been about the facts. Instead it's about trying to manipulate public perception to their side. Verisign has never expressed any actual concern or even care about how much damage their actions do to the internet. Any expectation that this would change in this circumstance is an act of optimism or stupidity. I only hope that the press in question will be made aware of the truth of these matters and publish that information. Otherwise, you may be faced with a situation where the DOC asks ICANN why they caved to such a small special interest group's pressure. Owen --On Friday, October 3, 2003 15:43 -0500 Allen McRay <amcray(a)amcray.net> wrote: > > Outside of one other person on this list, I know no one else personally, > so where do they come up with the "close-knit" stuff? I thought that > most of the traffic I have monitored, re: this topic, has come from a > very diverse and rather large group of people from all around the world > who have been trying to say is that what VeriSign has done has caused > problems in their area of expertise, in their businesses, and for the > public in general. Also seen a lot of proof posted along with the > comments..... > > I might also mention, I understand the technology "underpinning" the > internet.... it's the attempted abuse of power by individuals and > organizations like VeriSign that I can't go along with.... > > Allen > >> VeriSign also angered the close-knit group of engineers and scientists >> who are familiar with the technology underpinning the Internet. They >> say that Site Finder undermines the worldwide Domain Name System, >> causing e-mail systems, spam-blocking technology and other >> applications to malfunction. > > >

1 0

ISP network registration virus scan
by Sean Donelan 04 Oct '03

04 Oct '03

The university netreg lists has a frequently asked question if its possible to perform a virus scan of new computers as part of the network registration process. So far, people have only been able to do a network scan (e.g. open ports), or some version of proxy check or nessus. But none of those actually tell you if there is a worm or trojan. I was wondering if anyone (or vendor) has come up with a web application which ISP's could use to check if new customers are already infected with a network worm or trojan (not a full disk scan) as part of the registration process. It seems like several of the anti-virus vendors have the parts and pieces, but none of them seem to offer such a product for ISPs. I would think an ActiveX application could check for the top 20 or so network trojans or worms (less than 1 minute to do the checks), and report the results back to the ISP (or university) network registration web site. Between universities (with new students) and ISPs (with new customers) there would seem to be a new market for such a product. But so far I haven't found an AV vendor that has put it together.

4 4

Verizon DSL issues on east coast today?
by Alex Yuriev 04 Oct '03

04 Oct '03

I am seeing rather strange behaviour on VZ DSL starting from about midnight today, corresponding with 20% or so traffic drop in a few webfarms. The troubles start around lo0-0.CORE-RTR2.SYR.verizon-gni.net (130.81.4.10), and manifest themselves with large sections of the internet (including places such as usatoday) non-resolving, while other location's generate very funny traceroutes that indicate packets are being filtered, while the ssh sessions happily stay up. Alex

1 0

VeriSign Capitulates
by Tim Wilde 04 Oct '03

04 Oct '03

http://www.washingtonpost.com/wp-dyn/articles/A40241-2003Oct3.html And they act like they're the victims. Amazing. "Without so much as a hearing, ICANN today formally asked us to shut down the Site Finder service," said VeriSign spokesman Tom Galvin. "We will accede to their request while we explore all of our options." How about a public outcry? Did you miss that part? You don't deserve a hearing. Of course, they haven't removed the wildcard yet: dig is-it-gone-yet.com. @a.gtld-servers.net. +short 64.94.110.11 -- Tim Wilde twilde(a)dyndns.org Systems Administrator Dynamic DNS Network Services http://www.dyndns.org/

18 19

Internet privacy
by Allen McRay 03 Oct '03

03 Oct '03

Apologies if this is off-topic. No chance of it ever happening, correct? =;] Allen Dear Network Solutions(R) Customer, Did you know that current rules require all domain name service providers to list the information you provide when you register a domain name in a public database known as WHOIS? To help you protect your personal information and online investment, I want to let you know that Network Solutions is campaigning for stronger privacy protection in the domain name industry. As part of this effort, we have developed a new site, www.InternetPrivacyAdvocate.org, which outlines the steps we are taking to protect your personal data. The site also offers helpful tips for what you can do to keep your private data even more secure. The Internet Corporation for Assigned Names and Numbers (ICANN) is the non-profit corporation responsible for oversight of domain name registrations and for accrediting domain name service providers. As an ICANN-accredited registrar, we are also required to request that our customers verify, and if necessary, update their WHOIS contact information. Customers are responsible for ensuring this information is current, and ICANN mandates that outdated contact information can be grounds for domain name cancellation. View the WHOIS information for the domain name(s) you have registered with Network Solutions, and if necessary, update your information. To help protect your privacy, we have added enhanced capabilities, which allow you to select the Administrative and Technical contact information you would like listed in WHOIS through your Network Solutions account. To learn how to assign WHOIS contact information and about other actions you can take to protect your personal information today, visit www.InternetPrivacyAdvocate.org. Sincerely, Brian Cute Policy Director Network Solutions, Inc. ***************************************************** This e-mail was sent from a notification-only address. Please do not reply to this message. For Network Solutions customer service inquiries, please contact: customerservice(a)networksolutions.com. Unsubscribe from certain e-mail promotions from Network Solutions. Access our Privacy Policy. Access our Service Agreement. (C) 2003 Network Solutions, Inc. All rights reserved.

13 20

"Close-knit group" responds to Verisign
by Alex Kamantauskas 03 Oct '03

03 Oct '03

In a Washington Post article, it was reported that a "close-knit group of engineers" were angered by Verisign's SiteFinder service, claiming that it caused "e-mail systems, spam blocking technology and other applications to malfunction". Verisign responded that these claims are overblown. In response, the close-knit group of engineers said, _ WILDCARD THIS! _ |_| |_| | | /^^^\ | | _| |_ (| "o" |) _| |_ _| | | | _ (_---_) _ | | | |_ | | | | |' | _| |_ | `| | | | | | | / \ | | \ / / /(. .)\ \ \ / \ / / / | . | \ \ \ / \ \/ / ||Y|| \ \/ / \__/ || || \__/ () () || || ooO Ooo -- /ak

2 1

NXDOMAIN signs (was VeriSign Capitulates)
by Marc MERLIN 03 Oct '03

03 Oct '03

We could almost pretend it was because of the NXDOMAIN signs that got plastered on their HQ :) From http://slashdot.org/article.pl?sid=03/10/01/212231&mode=nocomment&tid=126&t… wednesday: ---------------------------------------------------------------------------- Verisign seems to have issues with returning proper response packets for DNS queries on unused domains, so we thought we would give them a quick reminder in case they forgot what the right answer was. You can find pictures here ( http://irc.sh.nu/download/ ) (This was on their building in Mountain View, and the signs said 'Verisign/Netsol, as if people didn't hate you enough already... How greedy/stupid are you? [Made with figlet/vim/a2ps/poster.c] ) ---------------------------------------------------------------------------- I thought it was hilarious :) Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f(a)merlins.org for PGP key

1 0