- NANOG - lists.nanog.org

Re: .ORG problems this evening
by Todd Vierling 18 Sep '03

18 Sep '03

On Thu, 18 Sep 2003, John Fraizer wrote: : Todd, you don't make the announcement for the anycast address from your : border.. You do it from within the anycast cluster as a CONDITIONAL : announcement. IE; you use a specially written BGP daemon that makes the : announcement when the service is alive and retracts it when it isn't. Um, I did in fact previously mention running BGP on the "cluster" -- which was referring directly to the DNS service machines -- and you even responded to that message. Yes, I do understand. (Ref: One of the things I do for a living is work on a BGP4 peer implementation written from scratch.) Doing this requires implementing keepalive handling in the service monitoring side of the world correctly. Which, obviously, *the entity in question did not*. Because of this, I can no longer trust them to get it right "next time" without changing their fundamental design. It's not like this is all that hard to grasp: the services for a TLD are much more critical than a 2LD or 3LD and should be given much more thought into failover handling than just "anycast will do it for us." The other two of the Big Three gTLDs, and most ccTLDs, allow a client to attempt queries to geographically diverse DNS servers at any time, regardless of the BGP table's correctness, in order to allow some additional level of failover and reliability assessment by the DNS client. Some of these servers could run anycast, and I wouldn't even know it without looking deeper. What I can trivially see, though, is where geographically diverse servers are available on said TLDs, I can get a guarantee that at least two from each zone's NS group go to different places. Why is .ORG somehow different and special that I/we should trust a third party to do the whole operation solely via anycast, where said anycast has the possibility of becoming a single point of failure? -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

1 0

Re: Worst design decisions?
by John Neiberger 18 Sep '03

18 Sep '03

>The hands-down winner, so far, is the Cisco >CMS-formerly-known-as-Arrowpoint, which has an RJ45 console cable >which WILL NOT WORK, full stop, with the RJ45 connectors on Cisco's >own console servers. > >*wild applause* Ah, yes. I've run into that bad boy. It really stinks to come in to work in the middle of the night to troubleshoot a problem and you know there is only one serial adapter that works with the Arrowpoint CSS and you can't find it! Once I found it I marked it with bright tape and wrote a big A on it with a magic marker. I then made sure everyone in my department knew what it was and where it was. I personally feel that the biggest benefit to upgrading to the new CSS was getting a 'normal' console connection. John --

1 0

videotron contact
by Todd Mitchell - lists 18 Sep '03

18 Sep '03

If anyone from Videotron is around, please contact me off-list. Thanks. Todd Mitchell --

1 0

Re: ICANN - Formal Complaint re Verisign
by Michael.Dillon＠radianz.com 18 Sep '03

18 Sep '03

>If I remember correctly, Verisign person stated in an interview that >they estimate that >it will be worth up to $100M annually. Boycott Verisign as much as possible. You can register new names in .BIZ or .INFO or in a country specific TLD including .US http://www.us-register.com/faq-us.cfm If you just cannot convince customers to stay away from the polluted mess of .COM then please use one of the alternative registrars so that less of your money goes to Verisign. And you can get SSL certs from alternative sources such as GeoTrust http://www.geotrust.com/ If you really believe that Verisign's actions are stock manipulation or shareholder fraud and you have some evidence to support that belief then report it to the SEC http://www.sec.gov/complaint.shtml If you believe that Verisign's actions have damaged your business in any way then ask your lawyers to write a letter to Verisign demanding that they cease and desist. If necessary, then follow up with a lawsuit or join in a class action suit against Verisign. Complaining on this mailing list achieves very little but there are things that individuals and businesses can do to put their money where their mouth is and have some real impact on Verisign. --Michael Dillon

5 5

Re: ICANN - Formal Complaint re Verisign
by John Neiberger 18 Sep '03

18 Sep '03

>>>> Marc MERLIN <marc_news(a)merlins.org> 9/18/03 9:27:11 AM >>> > >On Thu, Sep 18, 2003 at 11:42:19AM +0100, Michael.Dillon(a)radianz.com wrote: >> And you can get SSL certs from alternative sources such as GeoTrust >> http://www.geotrust.com/ > >Bzzz, geotrust is Verisign > >http://www.google.com/search?sourceid=mozclient&ie=utf-8&oe=utf-8&q=Thawte+… >ought+by+Verisign > >Marc If GeoTrust is Verisign, why do they make a big deal out of competing with Verisign? http://www.geotrust.com/resources/market_share/index.htm John --

4 3

New routeviews service available (Address/Prefix -> AS/ASPATH mappings)
by David Meyer 18 Sep '03

18 Sep '03

All, In response to requests from many folks asking for prefix to AS mappings, routeviews is now providing 2 new services mapping and address or prefix to its origin AS and to its ASPath. These services are available via two zones: (i). asn.routeviews.org asn.routeviews.org maps an address or prefix into its origin AS, prefix, and prefix length, as seen by route-views2.routeviews.org (the data is held in TXT records). For example, the following command % dig txt 223.128.asn.routeviews.org returns (among other things) 223.128.asn.routeviews.org. 86400 IN TXT "3582" "128.223.0.0" "16" The syntax here is: "AS" "Prefix" "Prefix Length" (ii). aspath.routeviews.org aspath.routeviews.org is similar to asn.routeviews.org, except that it maps an address or prefix into the ASpath (rather than origin AS), prefix, and prefix length, as seen by route-views2.routeviews.org (again, the data is held in TXT records). For example, the following command % dig txt 223.128.aspath.routeviews.org returns (among other things) 223.128.aspath.routeviews.org. 86400 IN TXT "286 209 3356 3701 3582" "128.223.0.0" "16" The syntax here is: "ASPath" "Prefix" "Prefix Length" These zones are built twice per-day, 11:45 and 23:45 UTC. Finally, please let us know (help(a)routeviews.org) if you have questions, comments or suggestions for ways we might otherwise improve this service. One note: note that these zones are quite large, and reloading these produces a period of a few minutes during which the server may not reply. Thanks, Dave

1 0

IP issues with .com/.net change?
by Alex Kamantauskas 18 Sep '03

18 Sep '03

Not really operational content, but I was wondering if there was an intellectual property issue with the Verisign .com/.net redirect? For instance, <http://searchthewebwithgoogle.com/> brings you to a Verisign search engine. Or, even better, <http://getyourdomainnameatregister.com/> will bring you to a Verisign website. -- /ak

5 6

Virus uptick?
by David Lesher 18 Sep '03

18 Sep '03

I'm suddenly getting 3-4x the "M$ patch" and "bounced mail" virus attacks as compared to 2-3 days ago. Is this perhaps a result of VeriSlime's actions? [Note I'm talking raw volume at my accounts; so it's not the result of local filtering breaking.] -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

4 3

Verisign suggestion
by Gerald 18 Sep '03

18 Sep '03

I'm just as irritated as most about the new executive decision that has been currently forced on us by Verisign which I really hope is reverted. Certain pieces of the news blurbs are bouncing around in my head and I came up with something for you to think about. The part of the Verisign thing that bugs me most at the moment: They don't pay a thing for all of these domains that they are now accepting queries for. It would seem to me to our benefit as an Internet community to word this in our favor and send Verisign a bill for manipulating their monopoly on the .net and .com zones. My suggestion: Since they are now accepting web queries on all of these typo domains, they should pay a reasonable fee (close to a full domain name registration fee) for each misguided soul that winds up on the Verisign web site. I believe the proceeds from this new bill they have brought upon themselves should help fund the organizations that entrusted Verisign to the task of holding the .net and .com zone. (IAB, ICANN, ... whomever is supposed to slap them back into doing what they were previously assigned them to do no more, no less) Are IAB/ICANN...etc non-profit? I really don't know who it should go to, but if there is money there, I'm sure it can improve something we collectively need. I also believe those same organizations deserve a cut of any related profit. If Yahoo/Inktomi pays $0.50 per click/search through, send $0.25 to IAB to improve $X. I think the "for free" angle any overseeing body wants to address this from. Speak to them in their language: "You just misappropriated something for free." I think we need to be ready to consider both of their responses to that: - reverting to the proper error messages (Amen we all go home...err wherever you go when you're not doing this) - making use of fixing the "for free" part. (read: using the profit for the community) Thus far, I've heard no mention of putting this to our own use. ...and for heavens sake, stop accepting any kind of request at all on port 25!! Just shut it down altogether. There is no reason for you to accept any connection of any kind on port 25! ...shutting up now, Gerald - How are ya? Never been better, ... Just once I'd like to be better.

6 6

RE: Worst design decisions?
by Colin Brown 18 Sep '03

18 Sep '03

I can't stand it when I sit down and find the keyboard in front of me has moved the "backslash" key. It drives me crazy and prompts me to find a real keyboard right away to work with. CB

1 0