- Test - lists.nanog.org

Re: Facebook insecure by design
by Robert Bonomi 26 Oct '11

26 Oct '11

> From: "steve pirk [egrep]" <steve(a)pirk.com> > Date: Wed, 26 Oct 2011 09:24:04 -0700 > Subject: Re: Facebook insecure by design > > On Oct 24, 2011 7:55 AM, "Robert Bonomi" <bonomi(a)mail.r-bonomi.com> wrote: > > > > > > > You can even download it all and erase yourself if > > > you want out. > > > > Don't count on it. You may 'disappear' from public view, but that does > > not necessarily mean the data is truely 'gone'. Specific example -- if > you > > request a USENET posting to be removed, all they do is make it 'invisible' > > to the world. It is _not_ removed from the databases, or from inernal > > access/use. > > > > > > That is a very good point, and one of the things that is being tested now > that Buzz is going into archive mode. Users are given the option of backing > up their posts on Buzz, and then deleting their Buzz content. Many like > myself will just leave it there. It is a year+ of history, and what I posted > publicly can stay public. > > It is supposed to remove all your Buzz content from the service and I > believe it includes the content shared only with certain individuals. It > does not completely erase it, because I believe email copies of the posts > and comments that people had sent to their Gmail accounts will remain with > those users. > > Deleting a product like your Picasa web albums is permanent as far as I > know, but I will definitely ask some people on the Picasa team. Deleting > your search history and other Dashboard items is supposed to be permanent, > but as you pointed out, we are taking Google's word for it. > I _don't_ know, but I *strongly* suspect that things like search history _are_ kept -- although 'detached' from any identification of the original person. That kind of information is simply 'too valuable' -- for pattern recognition, say -- to entirely discard. I also suspect it remains as part of lots of aggregate demographics, etc. I wouldn't be surrised if they kept statistal data on 'who deletes what'. <grin>

1 0

Facebook insecure by design
by William Allen Simpson 26 Oct '11

26 Oct '11

In accord with the recent thread, "facebook spying on us?" We should also worry about other spying on us. Without some sort of rudimentary security, all that personally identifiable information is exposed on our ISP networks, over WiFi, etc. Facebook claims to be able to run over TLS connections. Not so much (see attached picture). This wasn't an "app", this is the simple default content of a page accessed after a Google search. https://www.facebook.com/ceelogreen

21 29

the route is not in our bgprouter
by Deric Kwok 26 Oct '11

26 Oct '11

Hi When we try to reach to outside ip, this route doesn't have in our bgp router How can we check whether it doesn't advertise from our upstream to us? Any web site and tools can help? Thank you

3 4

Senate Bill S.968
by Jason LeBlanc 26 Oct '11

26 Oct '11

Anyone read this? http://en.wikipedia.org/wiki/Protect_IP_Act More attempts to regulate Internet usage. Not in favor. Jason

3 2

Vancouver, BC providers
by Ravi Pina 25 Oct '11

25 Oct '11

Hi, I was looking for some metro-e options in Vancouver, BC CA specifically in the Downtown/Gastown area. I'm finding the area isn't the most built up so options are very thin. We already have service through Level3, but would like a secondary one. It doesn't have to be tier1 or even terrestrial service so much as reliable and vouched for. Any tips would be appreciated. Thanks, -r

5 5

Re: Outgoing SMTP Servers
by Brian Dickson 25 Oct '11

25 Oct '11

Owen wrote: >On Oct 25, 2011, at 3:29 AM, <Valdis.Kletnieks at vt.edu> wrote: > >> On Tue, 25 Oct 2011 02:35:31 PDT, Owen DeLong said: >> >>> If they are using someone else's mail server for outbound, how, exactly do you control >>> whether or not they use AUTH in the process? >> >> 1) You don't even really *care* if they do or not, because... >> >> 2) if some other site is running with an un-AUTHed open port 587, the miscreants will >> find it and abuse it just like any other open mail relay. The community will >> deal with it quick enough so you don't have to. And at that point, it's the >> open mail relay's IP that ends up on the block lists, not your mail relay's IP. >> >But that applies to port 25 also, so, I'm not understanding the difference. > >> Other people running open port 587s tends to be quite self-correcting. >> > >At this point, so do open port 25s. > >Owen I'll try to explain with text stick-diagrams... The players are: G - good user B - botnet host I - ISP O - open relay S - mail-submission relay V - victim SMTP/mailbox host It's all about how port-25 traffic containing SPAM gets to machine "V". (Or not, which is the preferred situation.) Possible routes include: B.25 -> (I allows 25) -> O -> V (classic open relay) [SPAM] B.25 -> (I allows 25) -> V (new mode, and what William Herrin is talking about) [SPAM] B.587 -> (I !allow 25) -> V (but that makes no sense - how does B authenticate to the victim? She doesn't!!) [BLOCKED] B.587 -> (I !allow 25) -> S (ditto - not an open unauthenticated relay, only allows authenticated relaying!!!) [BLOCKED] Meanwhile, we have: G.587 -> (I !allow 25) -> S.g.587/.25 (mail submission gateway for G) -> V.25 [NOT-SPAM && NOT-BLOCKED] S.g is either G's enterprise mail server, or G's home mail server, or G's ISP themselves, or some other S to which G can authenticate. S.g receives on 587, and sends on 25, and is a generally reputable port-25 host (whatever that means). So, basically, not blocking 587 and blocking 25 removes all the avenues for direct botnet spam. Authenticating botnet sources become trackable on auth-hosts, and easy to shut down. Is there some path not listed above that could allow a spammer (botnet host) behind the ISP to send email, without having a relay host to which it can authenticate, that I'm not seeing? Brian

1 0

ARIN and Legacy IPv4 Assignement from CA*Net (Canarie)
by Alain Hebert 25 Oct '11

25 Oct '11

Hi, From what we've been seeing there is a lot of those legacy assignement about to be freed. ( Yeah! ) We're having some issue with a few Legacy that where miss-assigned when transfered from CA*Net to ARIN back in the day. ( We kept the control on them since we had access to the POC's and OrgID, which is not the case anymore for some reason ) If anyone has a hint (off-list please) about how to go about fixing those broken assignement, we had no luck finding the process on ARIN. I can only gather that there is no records left from the CA*Net merge :( Thanks. PS: Check your ARIN records if you have subnets in the 198., 199. and 205. just in case. ----- Alain Hebert ahebert(a)pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443

2 1

Outsourcing DDOS
by samuel.cunningham＠wellsfargo.com 25 Oct '11

25 Oct '11

We are considering using Prolexic to 'defend' our Internet-facing network from DDOS attacks. Anyone have any known issues or word of warnings before we proceed? Chris Cunningham Network Engineering Secure Connectivity 704-427-3557 (Desk) 704-701-6924 (Cell) Samuel.Cunningham(a)Wellsfargo.com<mailto:Samuel.cunningham@wellsfargo.com> [X] This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient. Any review, use, distribution, or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message.

7 12

IPv6 version of www.qwest.com/www.centurylink.com has been down for 10 days
by Frank Bulk 24 Oct '11

24 Oct '11

The IPv6 version of www.qwest.com has been down for 10 days. Wget shows a 301 to www.centurylink.com, but that also fails. Emails to the nocs at both companies have gone unanswered. Unless HE is deployed in a web browser, this behavior leads to a bad end-user experience. If anyone can prod either of these two companies that would be much appreciated. Frank nagios:/home/fbulk# wget -6 www.qwest.com --2011-08-18 00:32:40-- http://www.qwest.com/ Resolving www.qwest.com... 2001:428:b21:1::20 Connecting to www.qwest.com|2001:428:b21:1::20|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: http://www.centurylink.com/ [following] --2011-08-18 00:32:40-- http://www.centurylink.com/ Resolving www.centurylink.com... 2001:428:b21:1::22 Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:02-- (try: 2) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:25-- (try: 3) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. --2011-08-18 00:33:49-- (try: 4) http://www.centurylink.com/ Connecting to www.centurylink.com|2001:428:b21:1::22|:80... failed: Connection timed out. Retrying. Etc...

5 6

HE.Net 6TO4 relay
by Meftah Tayeb 24 Oct '11

24 Oct '11

hello HE.NET did you drop the 6to4 delegated prefix 192.88.99.0/24 ? if yes please would you drop it from your BGP routing table anounced ? thank you Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6573 (20111025) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com

2 2