- NANOG - lists.nanog.org

Riverhead or Lancope?
by John Obi 22 Sep '03

22 Sep '03

Nanogers, Did you ever tested Riverhead or Lancope? I know rackspace uses one or both of them. Are they good products and worth the try? Can they really decrease the the DDoS damage? Are they better than CISCO products? Are there any tips? Thanks, -J __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

3 2

Re: Windows updates and dial up users
by Jonathan Hunter 22 Sep '03

22 Sep '03

On Sun, 21 Sep 2003, Sean Donelan wrote: > "It occurred to me that one way to make things easier for dial-up users, > and even broadband users in many cases, would be to issue periodic update > CDs. Imagine a disc with all of the updates on it and a program, it could > even be written in Windows Script Host, to check a system for which > updates need to be installed, apply them in the correct order and even > reboot in between. Such a program would not be hard to write." > > [...] > > "I recently put this suggestion to Microsoft and their response basically > avoided the whole issue. Why wouldn't the company want to offer such a CD, > assuming that's the motivation behind their stonewalling?" >From this month's issue of /PC Pro/ magazine (UK, Issue 109) : "please accept our apologies for the lack of Microsoft patches or DirectX on our cover discs. Microsoft US has banned the inclusion of any of its code on magazine discs. Presumably, the company assumes we all have broadband to download up to 166MB for DirectX 9b or 134MB for Windows XP Service Pack 1a." And that's without mentioning the mean-time-till-infection of an unpatched system, of course... Regards, Jonathan

1 0

Re: VeriSign SMTP reject server updated
by Michael.Dillon＠radianz.com 22 Sep '03

22 Sep '03

>> Wrong protocol. There should be *NO* SMTP transactions for >> non-extistant domains. >After being bit by this over the weekend I would have to agree, due to >a screwup at netSOL a companies domain I manage was resolving to their >sitefinder service, and all mail just went *poof*. At anytime, Verisign could remove your .COM domain from their DNS for a short period of time which would result in all of your inbound email going to the Verisign collector servers. If this was only done for a brief interval, say 10 minutes, you might never notice that it had happened. But Versign's industrial espionage department would have your email in their hands and could do whatever they wish with it. How profitable might that be? Of course, the right way to do this would be to resend the email onward so that you never notice any missing messages at all. In fact, if I were designing the system to do this, I wouldn't log anything at the mailserver. I'd let the mail server and web server technical folks have plausible deniability. Meanwhile, I would have diverted a copy of the mailserver communications at the Ethernet switch to a secret server that does the actual logging of addresses and messages. Son of Carnivore? --Michael Dillon

2 1

Verisign's Threat to Infrastructure Stability
by Curt Akin 22 Sep '03

22 Sep '03

FWIW: To: The Department of Homeland Security Sent (via dhs.gov site form) Dated: 21 Sep 2003 14:24:37 -0000 Category: Security Threats Message: Threat to the stability and predictability of the Internet infrastructure: Verisign is solely and exclusively responsible for the maintenance (and therefore stability) of the root GTLD domain name servers for .com and .net top level domains. Verisign has recently "wildcarded" address records in such a way that attempts to access nonexistant (ie unregistered or mistyped) domain names results in a redirection to a Verisign site at sitefinder.verisign.com. This obviously profit-motive-driven act is not only in violation of certain terms of its contract with ICANN, but has had a destabilizing effect on the network operators community who expect the Internet name service to operate in a designed and predictable way. DHS would be well advised to consider the potential threat that Internet unpredictability has on this country's cyber infrastructure and to seriously consider the relocation of root server responsibility to non-profit-motive-driven organizations. We are all too busy maintaining stable environments to have to consider reactions and countermeasures to Verisign's autonomous and arrogant behavior.

3 2

Re: VeriSign SMTP reject server updated
by Michael.Dillon＠radianz.com 22 Sep '03

22 Sep '03

>before we deployed root-delegation-only here, i was also annoyed that my >e-mail tool could not tell me about misspelled domain names at "send" time >and i had to wait for the wildcard mail servers to bounce the traffic. In other words, Verisign is actually increasing the amount of misspelled domain name traffic by sabotaging the spell-checking feature of your email program. Under normal circumstances you would have noticed your error and corrected it before sending the email. This implies that Verisign could be collecting a much larger number of valid email addresses by logging these seemingly misspelled domain names and then "correcting" the misspelling by closest match against the .COM database. This would be an immensely valuable list for spammers to acquire, whether they do it by paying Verisign or by infiltrating the company to steal it. And don't pay any attention to Matt Larson's comments regarding logging. If he is unable to shut off the wildcard redirection then he has no say over what data is collected and what is done with it. Verisign could easily reassign him with a promotion and then turn on the logging and collection of email addresses. We already know that this company is unscrupulous and not to be trusted. In future we need to ensure that the registry operating the .COM domain works under some sort of contract that controls how they function. This is a public resource that we ourselves have created and not a commercial asset to be milked for profit. --Michael Dillon

1 0

Re: When is Verisign's registry contract up for renewal
by Brandon Butterworth 22 Sep '03

22 Sep '03

> DNS piracy is DNS piracy if Verisign gets away with it others will have a go too brandon

1 0

Home Storage Area Network security
by Sean Donelan 22 Sep '03

22 Sep '03

I received a few comments about file servers not serving files by default. There are a bunch of home SAN products on the market. They are designed to make it very easy for customers to set up and use a home storage area network. I think these are very cool products, and although some geeks like building stuff from scratch, other folks like buying stuff assembled and working out of the box. But they seem very dangerous when connected directly to the open Internet without some access control turned on. Instead they "assume" there will always be a secure firewall in place, protecting the devices. But in all the discussion about how secure their products are, you rarely see an explicit requirement for these SAN devices to be installed behind a firewall. Just because you use Linux does not make SMB secure on the Internet. http://www.mirra.com/ Ease of Use: Just plug in Mirra, run the installer, and let it auto-detect your network settings. Name your Mirra, say .ok. to the recommended backup set (or select your own), then forget it. Remote access is simple to use as well. No IPs to configure, no firewalls to penetrate. Mirra does it for you. http://www.martian.com/howtouseit.html The NetDrive comes pre-configured from the factory, so you don't have to worry about reading a long manual or learning about setting up file serving software. Of course, if you do want to enable password protection for your files or use a special network configuration, the NetDrive's simple web-based configuration interface will let you. What protocols does it serve files under? The NetDrive uses the standard SMB protocol to share its files. This makes it compatible with Windows PCs, Macs running OS X, and Linux boxes.

4 5

Re: When is Verisign's registry contract up for renewal
by Paul Vixie 21 Sep '03

21 Sep '03

> > > website: www.alt-servers.org. > > > > what a BAD idea. worse than anything else on the table or in > > existence today. > > Splitting the root you mean? I'm not sure there was enough info on that > site to come to any other conclusion, but I wanted to make sure. this is just dns piracy, dressed up in a morality play. it won't hold.

3 2

If Verisign *really* wants to help ...
by Lyndon Nerenberg 21 Sep '03

21 Sep '03

The logical follow-on to IP-based Sitefinder is SS7-based Phonefinder. I propose we redirect all "not in service" telephone numbers to Verisign's CEOs direct telephone number. --lyndon NT as a file server is faster than a dead bat carrying Post-It notes underwater. But not by much.

7 6

RE: When is Verisign's registry contract up for renewal
by Mike Damm 21 Sep '03

21 Sep '03

This sort of not-for-profit is exactly what I proposed when the VeriSign discussion started. A non-technical response to a non-technical problem. Since my inital email, I've recruited a few other NANOG folks and put up a website: www.alt-servers.org. -Mike (Please excuse any formatting oddities, sent via OWA) -----Original Message----- From: Jared Mauch To: Henry Linneweh Cc: Paul Vixie; nanog(a)merit.edu Sent: 9/21/2003 12:28 AM Subject: Re: When is Verisign's registry contract up for renewal On Sat, Sep 20, 2003 at 11:23:04PM -0700, Henry Linneweh wrote: > My view would concur with this, these are really old battles starting back in the > netsol days and now the verisign has taken the same short sighted path. > > It is time that neutral party is in charge > -Henry R Linneweh I was thinking this earlier this week. This is a public-trust that should be operated by people whose sole job is to keep it up and working, not by a dual-role entity as it is today. Perhaps we can get someone to make a not-for-profit for this sole role. - Jared > Paul Vixie <vixie(a)vix.com> wrote: > > > > ICANN can seek specific performance of the agreement by Verisign, or > > > seek to terminate Verisign's contract as the .COM/.NET registry operator > > > and transfer the operation to a successor registry. > > > > Quiet honestly I'd like to see all of the GTLD servers given to neutral > > companies, ones that ARE not registrars. [...] > > frankly i am mystified as to why icann awards registry contracts to > for-profit entities. registrars can be for-profit, but registries should > be non-profit or public-trust or whatever that specific nation's laws allow > for in terms of requirements for open accounting, uniform dealing, and > nonconflict with the public's interest. > -- > Paul Vixie -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

5 4