- Test - lists.nanog.org

Soliciting your opinions on routing research: A routing policies survey
by Sharon Goldberg 13 Sep '11

13 Sep '11

Hi NANOG, 27 ops have already responded to our routing policies survey; we're hoping to gather more responses before the week is over. We're collecting information about how you configure routing policies in your network to improve the models we use in our research on routing and security. We'll also share the aggregated results with the NANOG list. The survey is anonymous and should take under 5 minutes to complete. Feel free to answer all our questions, or just a few: http://www.cs.toronto.edu/~phillipa/measurement/opsurvey/survey.php We’d also be grateful if you could forward the survey to ops at other organizations who may not be reading NANOG. Thanks all of you that have responded so far! Phillipa Gill (U of Toronto), Michael Schapira (Princeton), Sharon Goldberg (Boston University)

1 0

BGP Communities for H.E. and Deltacom?
by Graham Wooden 13 Sep '11

13 Sep '11

Hi there, Any one know what are the acceptable BGP communities are for H.E. and Deltacom? At one of our POPs we¹re using an aggregate provider and I need to help them to fix some prefixes that I am announcing from another POP (ie. Lower the metric so only use the backhaul for failure of the other side). I was hoping that they would be listed on the One Step¹s bgp community listing. Any links to such documents for both HE and Deltacom would be great and would be much appreciated. Thank you, -graham

1 0

NANOG Nomination Dates
by Patrick W. Gilmore 13 Sep '11

13 Sep '11

Everyone, I would like to remind everyone about some important dates that are coming up: * September 12, 2011 begins the nomination process for Program Committee Candidates. * September 13, 2011 the nomination process for the Board closes. As a reminder, the Program Committee is a group of sixteen individuals from the NANOG community who together are responsible for the solicitation and selection of material for NANOG meeting programs. Per the NewNOG bylaws, eligible candidates each will serve a two-year term. To be eligible to be appointed as a member of the Program Committee, an individual must have attended one NANOG conference within the prior calendar year (12 months) and be a member in good standing. Broad technical knowledge of Internet operations and familiarity with NANOG meetings are useful attributes. Having constructive opinions and ideas about how NANOG meetings might be improved is of high value. A willingness to recruit presentations for each meeting is required. Please send nominations to nominations(a)nanog.org. If you are nominating another person, please provide that person's name and email address. If you are nominating yourself, please provide a Statement of Intent and a Biography, each with a suggested limit of 150 words. For samples, please see the 2010 candidate lists, <http://www.nanog.org/governance/elections/2010elections/>. As always, if you have a questions, please email nominations(a)nanog.org. Thank you for your support, and your participation in the community. -- TTFN, patrick

1 0

Re: vyatta for bgp
by Robert Bays 13 Sep '11

13 Sep '11

> On Sep 13, 2011, at 2:45 AM, Roland Dobbins wrote: > This contradicts my experience - I've repeatedly witnessed only a few mb/sec of 64-byte packets making software-based routers fall over, including just last month. It's easy to get 6Mpps using Vyatta or most other software based routers on modern server grade hardware. If both your link and hardware capacity don't exceed the maximum load the bad guys can throw at you, then you are doomed to failure regardless without upstream cooperation. In the case of an enterprise, neither of those two things are always guaranteed. Software based routers work great for many use cases, it just depends on what you are looking for. And sometimes they are the only option, for example as services migrate into the cloud. Software based routers are only going to get better. Roland, if you are in the Bay Area I invite you to drop by Vyatta HQ in Belmont and I will show you a demo of our next generation software which is doing an 5x increase in throughput over our last generation on the same off the shelf Intel X86 processors. We expect that number to only increase over the short term. Lot's of CPU horsepower solves a multitude of woes. The one thing I do agree with you on is… > One can and should test the specific performance envelope of any prospective infrastructure purchase, of course. cheers, robert.

1 0

Re: EV SSL Certs
by Coy Hile 13 Sep '11

13 Sep '11

> > On Sun, Sep 11, 2011 at 9:08 PM, Christopher Morrow > <morrowc.lists(a)gmail.com> wrote: > >> what's the real benefit of an EV cert? (to the service owner, not the >> CA, the CA benefit is pretty clearly $$) > > The benefit is to the end user. > They see a green address bar with the company's name displayed. > > Yeah, company's name displayed -- individuals cannot apply for EVSSL certs. > > > With normal certs, the end user doesn't see a green address bar, and > instead of the company's > name displayed "(unknown)" is displayed and > "This web site does not supply ownership information." is displayed. > > If you ask me, hiding the company's name even when present on a non-EVSSL > cert is tantamount to saying "Only EV-SSL certs are really trusted anyways". > > So maybe instead of these shenanigans browser makers should have just > started displaying a "don't trust this site" warning for any non-EVSSL cert. > As an academic aside, exactly what would one set on his (internal) root CA so that internally-trusted certs signed by that CA would show up as EV certs?

3 3

Why are we still using the CA model? (Re: Microsoft deems all DigiNotar certificates untrustworthy, releases updates)
by Mike Jones 12 Sep '11

12 Sep '11

On 11 September 2011 16:55, Bjørn Mork <bjorn(a)mork.no> wrote: > You can rewrite that: Trust is the CA business. Trust has a price. If > the CA is not trusted, the price increases. > > Yes, they may end up out of business because of that price jump, but you > should not neglect the fact that trust is for sale here. > The CA model is fundamentally flawed in the fact that you have CAs whose sole "trustworthiness" is the fact that they paid for an audit (for Microsoft, lower requirements for others), they then issue intermediate certificates to other companies (many web hosts and other minor companies have them) whose sole "trustworthiness" is the fact that they paid for an intermediate certificate, all of those companies/organisations/people are then considered trustworthy enough to confirm the identity of my web server despite the fact that none of them have any connection at all to me or my website. There is already a chain of trust down the DNS tree, if that is compromised then my SSL is already compromised (if they control my domain, they can "verify" they are me and get a certificate), what happened to RFC4398 and other such proposals? EV certificates have a different status and probably still need the CA model, however with "standard" SSL certificates the only validation done these days is checking someone has control over the domain. DNSSEC deployment is advanced enough now to do that automatically at the client. We just need browsers to start checking for certificates in DNS when making a HTTPS connection (and if one is found do client side DNSSEC validation - I don't trust my ISPs DNS servers to validate something like that, considering they are the ones likely to be intercepting my connections in the first place!). It will take a while to get updated browsers rolled out to enough users for it do be practical to start using DNS based self-signed certificated instead of CA-Signed certificates, so why don't any browsers have support yet? are any of them working on it? - Mike

19 30

Re: [NANOG-announce] NANOG 53 draft agenda available
by David Meyer 12 Sep '11

12 Sep '11

Sure. NANOG support can you update please? Thanks, Dave On Mon, Sep 12, 2011 at 2:40 PM, Aaron Hughes <aaronh(a)bind.com> wrote: > David, > > I am also running the Peering Track (which will be good for IXs and such to know to contact me ahead of time). Can you please add 'Aaron Hughes, CTO 6connect' to the Peering Track as well? > > Thanks! > > Cheers, > Aaron > > On Mon, Sep 12, 2011 at 02:28:03PM -0700, David Meyer wrote: >> Please see http://www.nanog.org/meetings/nanog53/agenda.html. >> >> Note that the Loews room block expires on 09/23/2011. Note also that >> the standard registration fee runs through 10/04/2011. >> >> Looking forward to seeing you in Philadelphia. >> >> Thanks, >> >> Dave >> >> (for the NANOG PC) >> >> -- >> NANOG-announce mailing list >> NANOG-announce(a)nanog.org >> https://mailman.nanog.org/mailman/listinfo/nanog-announce > > -- > > Aaron Hughes > aaronh(a)bind.com > +1-831-824-4161 > Key fingerprint = AD 67 37 60 7D 73 C5 B7 33 18 3F 36 C3 1C C6 B8 > http://www.bind.com/ > _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

[NANOG-announce] NANOG 53 draft agenda available
by David Meyer 12 Sep '11

12 Sep '11

Please see http://www.nanog.org/meetings/nanog53/agenda.html. Note that the Loews room block expires on 09/23/2011. Note also that the standard registration fee runs through 10/04/2011. Looking forward to seeing you in Philadelphia. Thanks, Dave (for the NANOG PC) _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: vyatta for bgp
by Ben Albee 12 Sep '11

12 Sep '11

Thanks for the all the feed-back. We will only have two ipv4 BGP peers (both 5mb/sec links) to the same ISP. We are doing BGP because we plan to add a second ISP at one of our locations in the future. We are not any near a large enterprise, this will be replacing two DSL lines and a T1.

1 0

RE: Microsoft deems all DigiNotar certificates untrustworthy, releases updates
by Keith Medcalf 12 Sep '11

12 Sep '11

Damian Menscher wrote on 2011-09-11: > Because of that lost trust, any cross-signed cert would likely be > revoked by the browsers. It would also make the browser vendors > question whether the signing CA is worthy of their trust. And therein is the root of the problem: Trustworthiness is assessed by what you refer to as the "browser vendors". Unfortunately, there is no Trustworthiness assessment of those vendors. The current system provides no more authentication or confidentiality than if everyone simply used self-signed certificates. It is nothing more than theatre and provides no actual security benefit whatsoever. Anyone believing otherwise is operating under a delusion. --- Keith Medcalf () ascii ribbon campaign against html e-mail /\ www.asciiribbon.org

9 12