September 2003 - Test - lists.nanog.org

Re: Root Server Operators (Re: What *are* they smoking?)
by Paul Vixie 17 Sep '03

17 Sep '03

> So, Verisign just returns a NS pointer to another name server Verisign > controls which then answers the queries with Verisign's "helpful" web > site. > > Half-life of the patch: 1 day? i don't think so. verisign is on public record as saying that the reason they implemented the wildcard was to enhance the services offered to the internet's eyeball population, who has apparently been clamouring for this. in this story, for example... http://story.news.yahoo.com/news?tmpl=story&u=/ap/20030916/ap_on_hi_te/inte… ...it was thus spake: VeriSign spokesman Brian O'Shaughnessy said Tuesday that individual service providers were free to configure their systems so customers would bypass Site Finder. But he questioned whether releasing a patch to do so would violate Internet standards. Vixie acknowledged that it could -- standards call for operators like VeriSign to have complete control over their directories -- but he said not releasing a patch would create greater chaos. therefore i believe that while they may have to change the A RR from time to time according to their transit contracts, verisign won't insert an NS RR into the sitefinder redirection. if they do, and if bind's user community still wants to avoid sitefinder, they can declare the second server "bogus", with no new code changes from isc. but that all seems terribly unlikely.

7 6

RE: Sabotage not backhoes: More cable cuts
by Justin Shore 17 Sep '03

17 Sep '03

Who Broadwing? Alan Ralsky maybe. I've had Broadwing's 3 /14s and some small misc netblocks in my Sendmail reject list for going on two years. I can't think of anything worthwhile I've missed. :) On Wed, 17 Sep 2003, Winslow, Michael wrote: > I'm sure they are important to someone > > -----Original Message----- > From: Justin Shore [mailto:listuser@numbnuts.net] > Sent: Wednesday, September 17, 2003 12:53 PM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: Re: Sabotage not backhoes: More cable cuts > > > > On Sun, 14 Sep 2003, Sean Donelan wrote: > > > > > Someone climbed a 15-foot tower in Southern Arizona cutting a fiber optic > > cable used by Broadwing and Tucson Electric Power. This was within five > > feet of the 138,000-volt power line. The site was also guarded by barbed > > wire. > > At least it's just Broadwing. I mean it not like it's anybody important > anyways... > > Justin > >

1 0

Re: Where will Verisign stop?
by E.B. Dreger 17 Sep '03

17 Sep '03

http://www.internetnews.com/bus-news/article.php/3_85721 Deja vu. If I didn't know any better, I'd think that article were written in the past few days. What's going to happen in another 4.5 years? Shall we have a contest who can write the most accurate article before the next incident happens? Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

new openssh issue
by Len Rose 17 Sep '03

17 Sep '03

Just in case no one has seen this: http://slashdot.org/articles/03/09/16/1327248.shtml?tid=126&tid=172

7 6

anyone from telia online
by Peter Galbavy 17 Sep '03

17 Sep '03

I need a little help with (what appears to be) an IGP issue withing Telia's UK network. I am stuck in a twisty maze of little resellers. Any response would be appreciated. Peter

1 0

Change to .com/.net behavior
by Matt Larson 17 Sep '03

17 Sep '03

Today VeriSign is adding a wildcard A record to the .com and .net zones. The wildcard record in the .net zone was activated from 10:45AM EDT to 13:30PM EDT. The wildcard record in the .com zone is being added now. We have prepared a white paper describing VeriSign's wildcard implementation, which is available here: http://www.verisign.com/resources/gd/sitefinder/implementation.pdf By way of background, over the course of last year, VeriSign has been engaged in various aspects of web navigation work and study. These activities were prompted by analysis of the IAB's recommendations regarding IDN navigation and discussions within the Council of European National Top-Level Domain Registries (CENTR) prompted by DNS wildcard testing in the .biz and .us top-level domains. Understanding that some registries have already implemented wildcards and that others may in the future, we believe that it would be helpful to have a set of guidelines for registries and would like to make them publicly available for that purpose. Accordingly, we drafted a white paper describing guidelines for the use of DNS wildcards in top-level domain zones. This document, which may be of interest to the NANOG community, is available here: http://www.verisign.com/resources/gd/sitefinder/bestpractices.pdf Matt -- Matt Larson <mlarson(a)verisign.com> VeriSign Naming and Directory Services

29 34

Re: Change to .com/.net behavior
by sthaug＠nethelp.no 17 Sep '03

17 Sep '03

> While I too am outraged by the actions of Verisign, I've decided to NOT > modify my servers in any way. > I might decide to block the sitefinder IP, but I will not change my > nameservers into modifying DNS responses. Doing so would be to break things, *You* cannot modify DNS responses, but it's okay for Verisign to do so? Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

3 2

Re: BIND 9 (Re: ISC Patches)
by Len Sassaman 17 Sep '03

17 Sep '03

On Wed, 17 Sep 2003, Paul Vixie wrote: > it's under consideration now. bind8 is not a priority for the bind forum, > and isc would rather put it in feature-freeze, but we're looking into it. > bind9's internals make "delegation-only" easy to implement. bind8's > internals are pretty twisty. This would certainly be appreciated. I have my BIND 8 name servers patched with a modified version of this: http://sam.zoy.org/writings/internet/verisign/patch-bind-8.4.1.0-dickhead.d… ... but it certainly isn't as clean as I'd like. --Len.

1 0

RE: new openssh issue
by Buhrmaster, Gary 17 Sep '03

17 Sep '03

According to Cisco at: http://www.cisco.com/warp/public/707/cisco-sa-20030917-openssh.shtml. this impacts CatOS, their storage router line, their HSE line, and their WLSE lines, and is not an IOS issue. Details on the web page. No fixed versions of software are available yet. Gary > -----Original Message----- > From: Avleen Vig [mailto:lists-nanog@silverwraith.com] > Sent: Wednesday, September 17, 2003 10:27 AM > To: Valdis.Kletnieks(a)vt.edu > Cc: Richard A Steenbergen; William Allen Simpson; nanog(a)nanog.org > Subject: Re: new openssh issue > > > > On Tue, Sep 16, 2003 at 03:50:04PM -0400, > Valdis.Kletnieks(a)vt.edu wrote: > > A posting to full-disclosure quotes Theo as saying HP and > Cisco are affected, > > and I don't see any reason that Juniper would *NOT* be, > given the common code > > base of the OpenSSH implementations. I'm not going to say > the routers are > > vulnerable, but I *would* say that ACLs blocking port 22 to > the router might > > be a good idea..... > > Isn't this a common practice anyway? Has been anywhere sensible I've > seen :-) >

1 0

Sabotage not backhoes: More cable cuts
by Sean Donelan 17 Sep '03

17 Sep '03

Someone climbed a 15-foot tower in Southern Arizona cutting a fiber optic cable used by Broadwing and Tucson Electric Power. This was within five feet of the 138,000-volt power line. The site was also guarded by barbed wire. This is not your typical backhoe. Rural areas have long dealt with the occasional shotgun damaged cable or microwave horn; or the farmer burying the dead cow in the back pasture. But I don't recall two reported acts of sabotage in less than 30 days before. http://www.fox11az.com/news/local/stories/KMSB_local_fiberoptic_091203.9d8b…

2 1