January 2004 - Test - lists.nanog.org

Re: Diversity as defense
by sgorman1＠gmu.edu 20 Jan '04

20 Jan '04

Agreed, vendor lock in is a very big problem, what the economists would call increasing returns. Interestingly most of the research on the subjest finds that a vendor achieves "lock in" and a dominant market position not by being the most competitive product. Random historical accident, policies, market fluctuations, etc. - i.e. beta vs. vhs or CP/M vs. DOS vs. Apple. Probably getting far off topic here, but if you decreased the ability of vendors to lock in customers (increase competition) could you increase diversity and security at the macro scale. On Mon, 19 Jan 2004 15:35:22 EST, sgorman1(a)gmu.edu said: > The diversity, monoculture and agricutlure analogy makes nice press, but how > realistic is diversity as a defense. Well.. if diversity were to actually exist, it would be quite helpful. Right now, if you have a Windows exploit, you might as well point and pull the trigger because you have an 86% chance of nailing the target. Add in a Linux exploit and you're well over 90%. That's Russian Roulette with a 10-shooter and one bullet. On the other hand, let's think about if there were 10 products that each have 10% market share, and even a minimal attempt at deterring fingerprinting of the target, you're looking at a 90% chance that the exploit you launch will fail and leave a nasty mark on an IDS. Suddenly, it's 9 bullets and one blank. And even worse odds if you haven't been picking up all the exploits in the series - or not all the products are vulnerable. Unfortunately, it's not a realistic scenario, because... > Is cost the biggest hurdle or limited > avaiability of competitive products, or simply no bang for the buck by > diversifying. I can sum up *every* problem I've had in getting people to migrate in just 3 words: "vendor lock in". Enough said on that topic.

2 1

Diversity as defense
by sgorman1＠gmu.edu 20 Jan '04

20 Jan '04

We've been seeing a bit of media attention of late to diversity as a technique to make networks more secure: http://news.com.com/2009-7349_3-5140971.html?tag=nefd_lede The usual suspect is Microsoft with 97% of OS's, but Cisco's 86% of the router market has been cited as well as SNMP vulnerabilities of two years ago. The diversity, monoculture and agricutlure analogy makes nice press, but how realistic is diversity as a defense. Is cost the biggest hurdle or limited avaiability of competitive products, or simply no bang for the buck by diversifying. We've run some simulations testing the effects of different levels of diversity, but wanted some feedback on feasibility. http://arxiv.org/abs/cond-mat/0401017 Any comments, feedback or discussion would be greatly appreciated. best, sean

2 1

New IPv4 Allocation to ARIN
by Steve Conte 19 Jan '04

19 Jan '04

Greetings, This is to inform you that the IANA has allocated 70/8 to ARIN. For a full list of IANA IPv4 allocations please see: <http://www.iana.org/assignments/ipv4-address-space>. Thanks, Steve --------------- Steve Conte - IANA conte(a)iana.org PGP KeyID: 0x0972C473

14 25

RE: New IPv4 Allocation to ARIN
by McBurnett, Jim 19 Jan '04

19 Jan '04

->Perhaps ARIN (or others) could supply their respective portions of ->unallocated space to a common BOGON project? -> ->pt -> Great idea.. HMM.. Rob, how about it? Say take in BGP feed from ARIN, APNIC etc. And then use that for redis? Or go even farther.... IANA-- Could you give a feed and make the same effort? Jim

1 0

Re: New IPv4 Allocation to ARIN
by Michael.Dillon＠radianz.com 19 Jan '04

19 Jan '04

>Alternatively, the RIRs might consider doing this sort of thing before >allocating IPs from new blocks. I know it's not their job to make sure >IPs are routable (especially not on every remote network), but as holders >of all the IPs, they are in the best position to setup such test sites >that would expose problems before they're dumped on members. And it would be nice if the RIRs funded and supported the bogon project that Cymru is running now. Now that the self-organizing RIRs have reached the stage where they have all signed a joint agreement, perhaps they could consider running some joint projects like these? In the interim, perhaps you could shift this address range testing under the Cymru banner? This would make it more likely that people will hear about it because the bogon project is beginning to get some notoriety. >Or, perhaps IANA could even do this before assigning an IP block to an >RIR. IANA no longer exists. It's true that the DoC has a contract with ICANN under which ICANN performs the former IANA functions but it is a mistake to assume that there is even a single vestige of an IANA organization that can think or do anything that is not already on its list of daily activities. --Michael Dillon

3 2

Re: Third-Level Domains Not Patented
by Stewart, William C (Bill), RTSLS 19 Jan '04

19 Jan '04

The patent doesn't claim to apply to domains - it claims to apply to URLs of the form name.subdomain.domain. The mere fact that this isn't correct syntax for URLs didn't prevent them from getting the patent, but it should make enforcing it on people who are using *domain names* of that form much harder, because URLs and domain names are much different semantic concepts. Of course the whole thing's a bogus crock anyway, but if they try to take it to court, and try to contend that it also covers domain name, there's more than a decade of publicly documented prior-art use of that syntax in BIND.

1 0

SMTP problems from *.ipt.aol.com
by Ajai Khattri 19 Jan '04

19 Jan '04

I have several users who connect to our mail server from an IP in the *.ipt.aol.com namespace. All are complaining about intermittent SMTP problems. I see that outbound SMTP traffic is proxied through AOL servers to our mail servers. Has there been a change recently causing this to not work? Our mail server does a name lookup on the IP and every once in awhile this will fail. Im assuming AOL DNS servers stop answering queries occassionally? Any ideas much appreciated. -- Aj. Sys. Admin / Developer

6 6

What's the best way to wiretap a network?
by Sean Donelan 18 Jan '04

18 Jan '04

Assuming lawful purposes, what is the best way to tap a network undetectable to the surveillance subject, not missing any relevant data, and not exposing the installer to undue risk?

6 6

Re: What's the best way to wiretap a network?
by Bohdan Tashchuk 18 Jan '04

18 Jan '04

> You can plug a mini-hub in line and use that as a tap point to monitor > the stream. Up side is its cheap and easy. Down side is you have to > drop to half duplex. Not a problem in most situations but in some the > drop in performance can be an issue. Don't throw out your old hubs. It's hard to find a 10/100 hub for sale any more. Even the cheap consumer devices are switches. I picked up a $25 hub at Fry's a few weeks ago just in case I ever wanted to casually snoop some traffic. But Fry's is sold out. The netoptics.com link posted was "priceless". I'm always wary of simple products that are expensive enough to have a request for quote, rather than a price, on their web page.

1 0

Nanog30 socialising
by Stephen J. Wilcox 18 Jan '04

18 Jan '04

Hi, I'm looking forwards to the Miami weather, should make a change from the usual wet n grayness that we've had around here the past few weeks.. I usually fly in on the Sat and leave Wed AM but am considering an extra day either side - is anyone else going to be around any extra days wanting to do some tourist things, evening meal and a bar? Not sure whats around there to do, perhaps folks have some ideas and want to arrange something? Anyhow I need to get my flight and hotel booked so anyone who is around let me know and I'll add on those days! Steve

4 3