- NANOG - lists.nanog.org

Verisign vs ICANN
by Len Rose 21 Sep '03

21 Sep '03

I don't think anyone holds Matt personally responsible for what has happened so please remember that when responding. Verisign has broken everything and unlike the success of their grandfathered monopoly on registrations this might spell the end of their reign over these zones. This has broken the net, an intense attack on the domain name system would probably have had less impact than the havoc Verisign has caused with their point everything to Verisign hack. I'd think this was very irresponsible behaviour, and conjures up shades of past ghosts (does anyone remember CORE?) if I were an oversight authority I'd be very incredibly pissed off right about now. (stupid question) Doesn't the IAB have any authority left? It's interesting that now ICANN -- perhaps for the first time ever -- might be in the position to do something positive and prove it's not all about backroom politics. It's also ironic that someone would have had to spend years in prison for doing what they've done with or without notice or malicious intent. When people are running around hacking new code into BIND, several MTAs, and bog knows what else you can't say you didn't break anything. Throwing up piles of servers and network equipment to be able to respond to garbage IP traffic because you're aiming the world at your network isn't particularly intelligent either but what do I know about it? Len

6 6

Re: Any actual data to back up blocking Netbios ports?
by Sean Donelan 21 Sep '03

21 Sep '03

On Sat, 20 Sep 2003, Dan Hollis wrote: > I'd like to see actual numbers I'm willing to be proved wrong. Go ahead.

2 2

Appreciation for Bind patches
by Andrew Fried 21 Sep '03

21 Sep '03

I have been following the various threads relating to Verisign and wanted to make one comment that I feel has been missing. Simply put, I would like to publicly express my appreciation to Mr. Vixie for taking the time to add the "root-delegation-only" patch for Bind. I'm fairly new to NANOG, but I'm sure that others beside myself also feel a thank you is appropriate. Andrew Fried, Senior Special Agent United States Department of the Treasury Treasury Inspector General for Tax Administration Strategic Enforcement Division 5000 Ellin Road, Room C8-100 Lanham, MD 20706 202-283-5915 Office 703-980-0091 Mobile email: afried(a)cis.fed.gov

4 3

Bind 8 and delegation only ?
by John Brown 21 Sep '03

21 Sep '03

Is there any work being done on adding this support to BIND 8 ??

1 0

Re: Appreciation for Bind patches
by Paul Vixie 20 Sep '03

20 Sep '03

> I have been following the various threads relating to Verisign and wanted > to make one comment that I feel has been missing. Simply put, I would like > to publicly express my appreciation to Mr. Vixie for taking the time to add > the "root-delegation-only" patch for Bind. I'm fairly new to NANOG, but > I'm sure that others beside myself also feel a thank you is appropriate. thanks for those kind words, but rapid response of this kind is one of our obligations to the bind forum, and it's only because of our members that we're able to serve the community in this way. btw: here's the short term results of me deploying root-delegation-only on my personal mail server at home: Sep 20 22:06:25 named: enforced delegation-only for 'com' (ok61930.com) Sep 20 22:06:25 named: enforced delegation-only for 'com' (ok61930.com) Sep 20 22:08:23 named: enforced delegation-only for 'com' (helimore574.com) Sep 20 22:08:23 named: enforced delegation-only for 'com' (helimore574.com) Sep 20 22:08:42 named: enforced delegation-only for 'com' (netscape1008.com) Sep 20 22:08:43 named: enforced delegation-only for 'com' (netscape1008.com) Sep 20 22:16:02 named: enforced delegation-only for 'com' (aagf91512.com) Sep 20 22:16:02 named: enforced delegation-only for 'com' (aagf91512.com) Sep 20 23:11:48 named: enforced delegation-only for 'com' (ok62928.com) Sep 20 23:11:48 named: enforced delegation-only for 'com' (ok62928.com) Sep 20 23:14:51 named: enforced delegation-only for 'com' (2mails235.com) Sep 20 23:14:51 named: enforced delegation-only for 'com' (2mails235.com) Sep 20 23:19:44 named: enforced delegation-only for 'com' (gratis-gratiss.com) Sep 20 23:19:44 named: enforced delegation-only for 'com' (gratis-gratiss.com) Sep 20 23:31:22 named: enforced delegation-only for 'com' (bosfvp.com) Sep 20 23:31:22 named: enforced delegation-only for 'com' (bosfvp.com) Sep 20 23:31:26 named: enforced delegation-only for 'com' (xvarnf.com) Sep 20 23:31:27 named: enforced delegation-only for 'com' (xvarnf.com) Sep 20 23:31:31 named: enforced delegation-only for 'com' (abdknt.com) i send this just in case anyone doubts that spammers forge sources. after the wildcard went in and before i deployed root-delegation-only at home, those would have been spams reaching my inbox. this is not much compared to a real mail server, but it is after all just my family here. (and i can assure you all that nobody typo'd the above domain names here.)

1 0

Bye Snubby, hello Mail Rejector
by Stephen J. Wilcox 20 Sep '03

20 Sep '03

Ooh, when did Verisign get rid of their Snubby program and put in something that actually behaves like an SMTP server? Seems verisign are watching the community reaction and acting to rectify their errors.. well some of them.... $ telnet sdfjsdfjsdjflsd.com 25 Trying 64.94.110.11... Connected to sdfjsdfjsdjflsd.com. Escape character is '^]'. 220 VeriSign mail rejector (Postfix) HELO as 250 OK MAIL FROM:me 250 Ok RCPT TO:you 550 <unknown[193.0.255.132]>: Client host rejected: The domain you are trying to send mail to does not exist. DATA 554 Error: no valid recipients hello 502 Error: command not implemented 421 Error: too many errors Connection closed by foreign host.

3 2

Wildcards: ICANN and IAB posted their commentaries
by rgaglian＠adinet.com.uy 20 Sep '03

20 Sep '03

You can find them here: http://www.iab.org/documents/docs/2003-09-20-dns-wildcards.html http://www.icann.org/announcements/advisory-19sep03.htm I've just checked that VeriSign has not voluntarily suspend the service Best Roque Ing.Roque Gagliano rgaglian(a)adinet.com.uy

4 3

Looking for clue at NetSOL/Verisign
by Matthew S. Hallacy 20 Sep '03

20 Sep '03

Is there anyone with a clue at verisign who's able to actually repair a broken entry in their database? I've got a companies domain name that seems to be stuck with nameservers listed in whois, but none in the .com zone. This means that everything for this companies domain is hitting the sitefinder crap, mail is being rejected, etc. A call to netsol got me a rather clueless person who claimed that sitefinder was created by ICANN, and that it's normal for a domain to have no nameservers for up to 3 days when changing name server entries. (instead of an immediate transition) I had this problem before with the exact same set of nameservers, it required a week worth of calls to verisign and a threat of legal action before someone manually touched something in their database to fix it. Unfortunately they claimed at the time that it was normal, and the changes had been processed normally (after a week!), so I have no contact information for the clued person who fixed it. -- Matthew S. Hallacy FUBAR, LART, BOFH Certified http://www.poptix.net GPG public key 0x01938203

3 2

Worst design decisions?
by Matt 20 Sep '03

20 Sep '03

Hello all, Was doing some upgrades on a UBR7246 (to a VXR), and I got to thinking about short sighted design considerations. I was curious if any of you had some pet peeves from a design perspective to rant about. I'll start with a couple. 1) Why did Cisco design the I/O controller on the 7246 with screws in the corner, which are very difficult to get at? And worse than that, why did they not include a cheap handle on the blank in this slot? 2) Why did Cisco not include side handles on the 12000 chassis? It's a heavy chassis, and I can imagine how many techs have thrown out their back moving that chassis around. I've got a couple others in my head from 3Com and a couple of others, but I thought I'd get the ball rolling. So, what do you think?

35 44

Re: Worst design decisions?
by neil＠DOMINO.ORG 20 Sep '03

20 Sep '03

I think it was the new MG F, where if you had the top down on the car and there was moisture on the boot [trunk] when you opened the boot [trunk] people in the car would get showered! They fixed it by adding a tighter spring so that the boot [trunk] opened slowly and the water dripped down the sides slowly! The biggest design flaw that really used to drive me nuts was with AS5300 cards and the fact you needed some special tool to pull them out. Also the good old cbus complex error when doing anything on a 7500 router, and the chopping up of memory when adding subinterfaces on ATM PA card. Another great one was in the early days of Demon, BT would only present telephone lines if they where terminated via their normal domestic wall socket, so at Demon there was like 200 odd wall sockets with phone connectors to the back of total control boxes. Talk a about a cable management nightmare, as well as dimensioning the network based upon wall size! Regards, Neil.

1 0