- NANOG - lists.nanog.org

Re: How common is lack of DNS server diversity?
by Tony Rall 05 Feb '01

05 Feb '01

>Then it probably doesn't matter if you resolve their DNS, because you won't be >getting to any of their services anyway. Several folks have mentioned that they don't see a problem with dns failure caused by an inability to reach all of the nameservers for a domain - because presumably clients won't be able to reach any of the hosts in that domain. First, as we've seen demonstrated so clearly in the Microsoft case this week, nameserver unreachability does not always imply unreachability of the hosts in the domain. Second (and even if all of the hosts are truly unreachable), there is one somewhat important service that has a markedly different failure mode if the server appears to not exist - email (smtp). Folks sending mail to a domain that doesn't resolve usually get an immediate "delivery failure" response. But those sending to a resolvable domain when the target mail server is simply unreachable get their mail queued. It will typically get retried by the mail system for a few days. Only after such a long outage of the target will a delivery failure occur. (One somewhat ugly side effect of the dns outage is that some mailing lists will remove the user from their list when a delivery failure occurs. Not good to have to explain this to your users.) I lived through both situations (dns plus entire domain unreachable, and the domain unreachable but dns still works); I much prefer the results with a diverse dns setup. Tony Rall

5 5

Videotron peering contact
by Jason Lixfeld 05 Feb '01

05 Feb '01

If anyone here is, or knows who the peering contact is for Videotron in Montreal, please drop me a note. Thx in advance! Regards, -- Jason A. Lixfeld Senior Network Engineer Look Communications Inc. -- jlixfeld(a)team.look.ca .

1 0

Re: Reasons why BIND isn't being upgraded
by Paul Vixie 05 Feb '01

05 Feb '01

Simon(a)wretched.demon.co.uk (Simon Waters) writes: > The ISC.ORG web site recommends leaving the BIND version string > unchanged to assist in troubleshooting. > > I remain unconvinced that showing the version string helps much. it helped you with your survey, didn't it? hiding it doesn't help at all. people who want to know if you're vulnerable and to what have tools to find out. hiding it DOES however make it harder for people (including network owners) to do surveys. until, that is, somebody breaks into a server using some published hole and then modifies the version string so the admin's periodic audit won't show it as needing to be upgraded. so -- don't believe it if it says you're safe, use indications of unsafety as reasons to prioritize those servers for a closer audit.

16 21

RE: How common is lack of DNS server diversity?
by Roeland Meyer 05 Feb '01

05 Feb '01

> From: Adam McKenna [mailto:adam@flounder.net] > Sent: Saturday, January 27, 2001 4:09 PM > On Sat, Jan 27, 2001 at 03:23:08PM -0800, Roeland Meyer wrote: > > You obviously don't understand the difference between "concept" and > > "definition". > > > > www.open-rsc.org > > www.dnso.net > > www.icann.org > > www.dnso.org > > Very interesting.. I can also add www.pacificroot.com www.atlanticroot.com www.irsc.com and a whole bunch of others... > http://www.dnso.org/constituency/gtld/gtld.html: > > : Root servers. > : The list of 13 current root servers > : ftp://ftp.rs.internic.net/domain/named.root > : The map of 13 current root servers > : http://www.wia.org/pub/rootserv.html > : IAB Technical Comment on the Unique DNS Root > : http://www.isi.edu/in-notes/rfc2826.txt > > http://www.icann.org/committees/dns-root/y2k-statement.htm You can selectively look at anything you want. All sites had both pro and con positions. > I can't find anything that supports your comments at > open-rsc.org, and I'm > going to assume that you threw in dnso.net as a joke, since > a) you own the domain I figured that you were adult enough to make up your own mind. However, your constant string of personal insults seems to contradict such evaluation. As difficult as you try and make it, I am trying to remain neutral here. -=- Personal insults fm Adam McKenna 5, slightly over 1 per message Personal insults fm Roeland Meyer 0

5 4

RE: Vixie doing his part to make people upgrade (was:Re: Reasons why BIND isn't being upgraded)
by Roeland Meyer 05 Feb '01

05 Feb '01

> No need to continue this thread, I think everybody knows > where everybody > stands on the ORBS issue. Thank you.

1 0

Re: Reasons why BIND isn't being upgraded
by Paul A Vixie 05 Feb '01

05 Feb '01

> I'm a bit confused. ... Yes. > Will the ISC implement similar policies with its INN and DHCP software > in the foreseeable future, or is this something unique to BIND? I don't see INN or DHCP as critical to the internet's infrastructure, so, no. > CERT has NEVER been the source of early warnings. By the time they release > information it has already been dissimenated in a variety of other forums. Nevertheless CERT is the mechanism ISC has always used to get critical bug notifications out to the industry, and there are no plans to change that. If you think CERT's methods are unsuitable, please take it up with them directly.

10 11

Re: Preferential notice of new versions
by Jeffrey Meltzer 05 Feb '01

05 Feb '01

On Sat, Feb 03, 2001 at 07:10:23PM -0800, Sean Donelan typed: > As far as I can tell, ISC did not say they would stop distributing patches > through the same methods used now. If you don't want to pay, you will > get the exact same patches, through the exact same methods you get them > now. I think the issue some of us have is ISC won't *let* you pay. It's not an issue of wanting to. They're playing favorites, which just doesn't seem right. Jeff

4 3

FBI InfraGuard program
by Roeland Meyer 05 Feb '01

05 Feb '01

Has anyone here heard of it or is working with it? -- ROELAND M.J. MEYER Managing Director Morgan Hill Software Company, Inc. TEL: +001 925 373 3954 FAX: +001 925 373 9781 http://www.mhsc.com mailto: rmeyer(a)mhsc.com

3 2

Re: Preferential notice of new versions
by Sean Donelan 04 Feb '01

04 Feb '01

On Sat, 03 February 2001, Adam Rothschild wrote: > On Sat, Feb 03, 2001 at 10:00:51PM -0800, Joe Rhett wrote: > > Sure they do! Try reading the website once or twice. Then you can > > take your foot out of your mouth. > > I did. Seems pretty clear that, unless you're a TLD server operator > or large and respected OS vendor, they don't want to provide you with > early advisories, paid or otherwise. It seems pretty clear if you don't pay, you receive exactly the same advisories you receive now. No more, no less, no sooner, no later. CERT has always told a few other groups about vulnerabilities prior to their public release of advisories (vendors, some affected parties, etc). If anything, ISC's comments seem directed at CERT's procedures. Instead of trying to pass the information back and forth through CERT, ISC is adding a direct mechanism for the same groups to communicate. It doesn't affect any of the other existing communication channels. CERT issues a public alert about a vulnerability on its schedule. BUGTRAQ users continue to post exploits when and how they choose. And as always, the source code for all ISC released versions of BIND are available, so you can find all the flaws yourself. I will, and have, flogged Paul for doing stuff; but I'm afraid I don't understand the uproar about this one. I suspect there is another way to get yourself on the "list." Find and fix some significant bugs in BIND.

3 2

RE: Reasons why BIND isn't being upgraded
by Roeland Meyer 04 Feb '01

04 Feb '01

> How many of you use BIND in a commercial environment? > How many of you actually contribute money back to the authors of BIND? Commercial environment AND over 60% of my servers are Caldera Linux (<unabashed plug> VAR inside! </unabashed plug>). 100% of all binaries on those boxen are compiled in place and then the compilers are uninstalled. > Its all fine and good saying "When there's a security problem in BIND, > I want to know and I want to know now!" but guys, if you want > this wonderful level of support, either cough up some money to your software > providers, or write it yourself. I might not agree with how Paul is > going about it, but I understand his problems. So do I, <yea, Paul!>. Managing an OpenSource project, with volunteer programmers, that can take off to smell different roses, anytime, is a royal PITA! It's much worse when you can't pay for it. The OpenSource model makes ALL of its money from service and support, while giving the code away for free. This is almost the exact opposite of the traditional model. If you want support, you should pay for it. If, that is, you want BIND to continue to exist. BTW, I've seen some folks denigrate BIND as not being properly OpenSource, but not all the world is GPL and GPL isn't the sole arbiter of OpenSource. BIND is one of the pioneering OpenSource projects and Paul, for leading that effort, is to be very much commended for it. If you want support, you should pay for it. In fact, even if you don't need support, you should pay for it anyway!

2 1