February 2024 - Test - lists.nanog.org

The state-level attack on the SSL CA security model
by Martin Millnert 20 Nov '25

20 Nov '25

To my surprise, I did not see a mention in this community of the latest proof of the complete failure of the SSL CA model to actually do what it is supposed to: provide security, rather than a false sense of security. Essentially a state somewhere between Iraq and Pakistan snatched valid certs for: - mail.google.com - www.google.com - login.yahoo.com - login.skype.com - addons.mozilla.org - login.live.com - "global trustee" https://blog.torproject.org/blog/detecting-certificate-authority-compromise… http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html http://www.imperialviolet.org/2011/03/18/revocation.html (on epic failure of cert revocation lists implementations in browsers, failing open (!)) http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-cer… http://www.microsoft.com/technet/security/advisory/2524375.mspx For over a week users of browsers, and the internet at large, were/was not informed by COMODO that their security was compromised. "Why not" is beyond many of us. Announcing this high and loud even before fixes were available would not have exposed more users to threats, but less. Conclusion: protecting people must not be a priority in the SSL CA model. In some places, failure of internet security means people die, and it is high time to start serious work to replace this time-and-time again proven flawed model with something that, at the very least, does not fail this tragically. DNSSEC is a good but insufficient start in this particular case. Regards, Martin

28 39

Re: NANOG NYC Event
by Fisher, Shawn 30 Jul '25

30 Jul '25

Personally I like dinosaur bbq, great malt beverages as well, and also blue smoke is great and if you like jazz, check out downstairs. -------------------------- Sent using BlackBerry -----Original Message----- From: andrew young To: Scott Brim CC: nanog(a)nanog.org Sent: Sat May 31 18:28:57 2008 Subject: Re: NANOG NYC Event Speaking of food, ill be going to the Big Apple BBQ fest next weekend: http://bigapplebbq.org/2008/ If you love to eat BBQ, this is a big MUST to cap off your stay in NYC. if you do decided to go, be sure to get the Fastpass: http://www.bigapplebbq.org/2008/index.php?s=fastpass You dont want to wait 30 mins online for food. Don't forget a bib and leave your belt at home. :-) - ------------------------------------ Andrew Young Webair Internet Development, Inc Phone: 1 866 WEBAIR 1 FAX: 516.938.5100 http://www.webair.com andrewy(a)webair.com ------------------------------------- We are interested in any feedback you might have about the service you received. Please contact our technical support consumer care manager directly at 1.866.WEBAIR1 or e-mail customercare(a)webair.com ------------------------------------- On Sat, 2008-05-31 at 18:17 -0400, Scott Brim wrote: > On 5/31/08 12:36 PM, Rod Beck allegedly wrote: > > I strongly suggest that those heading to New York visit the great > > musems, architecture (Saint Patrick's Cathedral), and restaurants. > > You have the American Museum of Natural History, which includes an > > excellent Planetarium and just on the other side of Central Park, the > > Metropolitan Museum of Art and the Guggenheim. There are excellent > > Chinese and Indian restaurants in Lower Manhattan. > > Don't forget about Brooklyn in all this Manhattan praise :-). Consider > the Brooklyn Botanic Garden. It's too late for cherries but the rose > collections will be great. And the best pizza in New York (if you can > get in) is at > http://menupages.com/restaurantdetails.asp?areaid=0&restaurantid=31402&neig… >

15 17

Ransom DDoS attack - need help!
by halp us 18 Jul '25

18 Jul '25

All, I've been a NANOG member for many years but I'm emailing from an anonymous account to reduce the chance of the attackers finding me. A company that shall remain anonymous has received a ransom DDoS note from a very well known group that has been in the news lately. Recently they've threatened to carry out a major DDoS attack if they are not paid by a deadline which is approaching. They've performed an attack of a smaller magnitude to prove that they're serious. Based on certain details that I can't reveal here, we believe the magnitude of the upcoming attack may be in the several hundred Gbps. I would really appreciate help in a few areas (primarily with certain provider contacts/intros) so we can execute our strategy (which I can't reveal here for obvious reasons). If you email me off-list with a name/email that you've previously used on-list, I will reply from my real email. Alternatively, if you can post your experiences on-list with large scale high profile ransom DDoS attacks, I'd really appreciate it! Thanks

17 26

Re: Coherent 100G in QSFP28
by Jared Brown 17 Jul '24

17 Jul '24

On 2/28/23, Pascal Masha wrote: > How much will these cost? ADVA said 4ish grand each. Probably less than five. - Jared

2 1

TFTP over anycast
by Javier Gutierrez 07 Apr '24

07 Apr '24

Hi, I'm working on some DR design and we want to not only have this site as a DR but also performing some active/active for some of the services we hosts and I was wondering if someone had some experience with using anycast for TFTP or DHCP services? What are some of the pains/challenges you experienced and things we should lookout for? Any input is greatly appreciated. Kind regards, Javier Gutierrez

9 13

puck not responding
by Hank Nussbacher 02 Mar '24

02 Mar '24

7 9

Any info on AT&T Wireless Outage?
by Robert DeVita 02 Mar '24

02 Mar '24

Reports have it starting at 4:30 a.m.. SOS on all phones.. [cid:image001.jpg@01DA655D.39E82510] Robert DeVita CEO and Founder t: (469) 581-2160<tel:(469)%20581-2160> | m: (469) 441-8864<tel:(469)%20441-8864> e: radevita(a)mejeticks.com<mailto:radevita@mejeticks.com> | w: mejeticks.com<https://www.mejeticks.com/> a: 2323 N Akard Street , Dallas , 75201 [cid:image002.png@01DA655D.39E82510]<https://www.linkedin.com/company/mejeticks/> [cid:image003.png@01DA655D.39E82510]<https://twitter.com/mejeticks> [cid:image004.png@01DA655D.39E82510]<https://www.facebook.com/mejeticks> [cid:image005.png@01DA655D.39E82510]<https://linktr.ee/mejeticks>

19 20

List of GMAIL DNS *clients*?
by bzs＠theworld.com 29 Feb '24

29 Feb '24

Occasionally one of our log analyzers will block gmail DNS requests causing bounces when gmail claims our domain(s) are not authenticated, they can't get to our SPF etc. I'd like to whitelist them but does anyone know the list of IP blocks I need? -- -Barry Shein Software Tool & Die | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*

2 1

IPv6 connectivity to mx[1-4].smtp.goog.
by Marco Davids (Private) 27 Feb '24

27 Feb '24

Hi, At https://internet.nl we're seeing IPv6 connection issues on TCP port 25 (SMTP) to mx[1-4].smtp.goog. Either 100% DROP (so no TCP connection) or ⅔ failure to setup connection. Further testing seems to confirm the problem is bigger and on Google's side. So, this fails: echo 'quit' | nc -6 -w 3 mx1.smtp.goog. 25 and this works: echo 'quit' | nc -4 -w 3 mx1.smtp.goog. 25 (on MacOS use -G instead of -w) Is anyone else seeing this? Any idea what is causing this? -- Marco

4 3

starlink ixp peering progress
by Dave Taht 27 Feb '24

27 Feb '24

One of the things I learned today was that starlink has published an extensive guide as to how existing BGP AS holders can peer with them to get better service. https://starlink-enterprise-guide.readme.io/docs/peering-with-starlink I am curious if there is a way to see how many have peered already, how many they could actually peer with?, and progress over time since inception.... what would be the right tools for that? This is pretty impressive for peering so far: https://www.peeringdb.com/net/18747 Is there a better email list to discuss ixp stuff? -- https://blog.cerowrt.org/post/2024_predictions/ Dave Täht CSO, LibreQos

6 6