September 2003 - Test - lists.nanog.org

News of ISC Developing BIND Patch
by John Neiberger 18 Sep '03

18 Sep '03

http://apnews.excite.com/article/20030916/D7TJOF3G0.html --

29 39

Kill Verisign Routes :: A Dynamic BGP solution
by Eric Germann 18 Sep '03

18 Sep '03

I wanted to discuss the merits of the following: I have written a proof of concept solution to nuke a route to sitefinder. Code to those who care or to the list if anyone cares. Perl is your friend :) Basic concept: Use Net::BGP to set up a peering session with my route server. Query DNS for *.com and *.net on x interval. Then take the answers (if they are valid A records) and inject them into the route server (which in our case is used solely to feed a blackhole network to sink traffic from APNIC space, etc). If an address no longer appears in the DNS (i.e. the idiots switched hosts), withdraw the route. If they set up multiple hosts, it will catch each one of them. You can set the polling interval as you please. Thoughts? Eric ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

4 6

OT: The lawsuits to verisign being.. 100 Million
by netmask 18 Sep '03

18 Sep '03

I thought it might be relevant.. The legal wars have also begun: Popular Enterprises Files $100 Million Lawsuit against VeriSign Inc. The Complaint alleges antitrust violations, unfair competition and violations of the Deceptive and Unfair Trade Practices Act based upon VeriSign's release of the http://sitefinder.verisign.com product. According to Popular Enterprises, the "Sitefinder" service allows VeriSign to monopolize unregistered ".com" and ".net" domains, and to profit by redirecting all Internet traffic for these sites to pay-for-placement sites controlled by VeriSign. If they are allowed to operate Sitefinder, VeriSign will now profit from Internet traffic directed to all unregistered domain names, including thousands of domain names that VeriSign has refused to allow the public to register. ......... http://home.businesswire.com/portal/site/google/index.jsp?epi-content=GENER… -netmask

1 0

let the lawsuits begin
by Alan Hannan 18 Sep '03

18 Sep '03

Let the lawsuits begin. " KNOXVILLE, Tenn.--(BUSINESS WIRE)--Sept. 18, 2003--Popular Enterprises LLC, the parent company of Netster.com, has filed a $100 million dollar lawsuit against VeriSign, Inc. The Complaint alleges antitrust violations, unfair competition and violations of the Deceptive and Unfair Trade Practices Act based upon VeriSign's release of the http://sitefinder.verisign.com product. " http://home.businesswire.com/portal/site/google/index.jsp?epi-content=GENER… http://search.netster.com/about/lawsuit.asp

1 0

ISC Patches
by Peter Losher 18 Sep '03

18 Sep '03

The official announcements are going out via the bind-announce(a)isc.org list, but just in case: http://www.isc.org/products/BIND/delegation-only.html Best Wishes - Peter Losher -- Peter_Losher(a)isc.org | ISC | OpenPGP 0xE8048D08 | "The bits must flow"

6 6

Re: .ORG problems this evening
by Todd Vierling 18 Sep '03

18 Sep '03

On Thu, 18 Sep 2003, John Fraizer wrote: : As has been stated by others, UltraDNS, like the roots and other TLD hosts : is under nearly constant attack. Perhaps your local nodes were effected : by an attack. IE; the pipe was full but the service was still alive so the : anycast prefix wasn't retracted. Bummer. Sucks to be you. Sucks to be anyone trying to use the service whose routers pick those nodes as the only ones available. That's the fault of the implementor, not the client. The major issue here is that no *gTLD*, particularly one of the Big Three, should be subject to a SPOF -- even if it's only a regionally visible SPOF due to anycast selection. It should *always* be possible to attempt queries to more than one physical location's servers for a gTLD. Yet last night, I could not query .ORG from several different locations in the continental US, even though there were perfectly functional servers available (in the same country, no less). BGP errors happen (everyone here should be able to attest to that readily), and they did. What's to stop some other boneheaded DoS or oversight from causing this again? And again? This particular outage was in the late evening in what appeared to be the affected area from my probing, which is why people like you don't appear to care; it "didn't affect you". What about when it happens in the middle of the day in your neck of the woods? : Doesn't really matter to me though. Bitch and moan all you like. : Demonstrate your lack of experience and understanding. Uh-huh. Quite a few people here know better; they also know I am surrounded by <cloak/> on this list and others. If my public resume were up to date and filled in more detail, you'd know otherwise. Don't try to speak for my experience from your pedestal when you don't have the information to make that kind of baseless judgment. On the other hand, if you can't see the fatal flaw in a major Internet infrastructure service depending on a single point of failure, I can point you at a few books that could enlighten you. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

3 3

Re: Worst design decisions?
by Miquel van Smoorenburg 18 Sep '03

18 Sep '03

In article <cistron.Pine.NEB.4.58.0309181101380.8936(a)server.duh.org>, Todd Vierling <tv(a)duh.org> wrote: > >On Thu, 18 Sep 2003 up(a)3.am wrote: > >: Without a question: PS/2 style keyboard and mouse connectors. Impossible >: to tell from each other, > >And this part is somewhat funny, too, because the PS/2 connector layout is >capable of having both devices share the same bus (there's two unconnected >pins, which some laptops use to provide alternate CLK/DATA signals). > >If PS/2 mice used the unconnected pins rather than the same CLK/DATA pins as >the keyboard, all machines could simply have two connectors using all six >pins and you'd be able to plug either device into either socket. Actually a PC can detect if a mouse or keyboard is plugged in and behave appropiately - there were PCs (I forget which) on which it didn't matter what port you used for kbd or mouse, it all just worked. In fact 2 kbds is quite possible as well. So that is basically a software problem. Mike.

1 0

Rogers Cable Contact
by Alexander Kiwerski 18 Sep '03

18 Sep '03

Can someone from the Rogers Cable NOC (Tier-III) contact me off-list? Thanks, Alexander Kiwerski Senior Network Engineer Winstar-IDT Network Operations & Security Desk: +1 206 574 3121 Mobile: +1 206 571 0274

1 0

RE: Worst design decisions?
by Ejay Hire 18 Sep '03

18 Sep '03

Who needs a console port on a Bay? Site angler will save the day! ... Err, sorry, coming off of a power outage with nothing to do but drink coffee. -e -----Original Message----- From: Peter E. Fry [mailto:pfry@swbell.net] Sent: Thursday, September 18, 2003 11:02 AM To: nanog(a)merit.edu Subject: Re: Worst design decisions? David Barak wrote: > Personally my issues are console-cable related: is > there a benefit to the HUGE variety of console pinouts > used by the various hardware vendors? Just look at > vendor C as an example [...] Is that the best example you can come up with? Ever use any Bay equipment...? Heh. Makes me want to add "I hate it when that happens", as in "Ever put your head in a vise and crank it down real tight...?" Peter E. Fry

2 1

Re: DNS anycast considered harmful (was: .ORG problems this evening)
by Todd Vierling 18 Sep '03

18 Sep '03

On Thu, 18 Sep 2003, Stephane Bortzmeyer wrote: : > Still doesn't help .ORG, which is 100% anycast and thus has no DNS-based : > redundancy : : Wrong since there are two IP addresses. They may fail at the same time : (which apparently happened to you) but there is a least an element of : non-BGP redundancy (I'm not aware of any TLD running with only one : anycasted name server, although it would still have some redundancy). Okay, let me qualify then: "...no DNS-based redundancy when both routes point to the same place and that particular place goes off the air while its BGP advertisements stay up and running..." DNS-based redundancy typically implies going to different servers at different locations, regardless of what BGP says. The fact that anycast took me to the same place for both IPs, and that same place went down all at once, means that I was effectively looking at a single point of failure with no way for DNS to pick another place to look. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

5 7