- Test - lists.nanog.org

XSS April Fools
by Gadi Evron 01 Apr '07

01 Apr '07

http://www.securitylab.ru/news/extra/293608.php There are "two cross site scripting attacks on Cisco.s web site and Maria Sharapova's site to announce that she has passed the Cisco certification test and will now become a security engineer." Gadi.

2 2

Re: PG&E on data centre cooling..
by Robert Bonomi 01 Apr '07

01 Apr '07

> Date: Sat, 31 Mar 2007 19:31:53 -0700 > From: Jay Hennigan <jay(a)west.net> > Subject: Re: PG&E on data centre cooling.. > > > John Kinsella wrote: > > > I sorta wonder why the default is lights on, actually...I used to always > > love walking into dark datacenters and seeing the banks of GSRs (always > > thought they had good Blink) and friends happily blinking away. > > Consider the power consumption per square foot of the gear in a typical > data center, then add in the power needed to keep it cool. I suspect > that the cost of energy to keep the lights on will be down in the noise. In addition, 1) if the lighting is 'already there', figure the cost of re-wiring to 'sensor-based' switching. The parts aren't terribly expensive, but consider the amount of labor required. Particularly if the desired switched lighting 'zones' don't match the existing circuit wiring. Don't forget the maintenance costs, either. You're probably going to have to replace bulbs more frequently -- on/off cycles _are_ added 'stress' on bulbs. 2) if it is new construction, figure the differential cost in parts, labor, *and* maintenance, of sensor-based lighting switching. This is lower than 1), but still 'non-trivial'. Now, estimate how much energy will be saved, and how long it will take for that savings to pay back the cost of the investment. "Secondary" savings from reduction in HVAC load? How many KW/sq.ft. does the gear eat? vs. how many watts/sq.ft for lighting? ['Office grade' lighting is under 2 watts/sq.ft. (and may be significantly less) using conventional fluorscents, high-intensity halogen can be lower. 'Residential level' general lighting can easily be under 1 watt/sq.ft.] It's not like you're going to reduce the load enough to shut down one of the chillers. :)

2 1

RE: On-going Internet Emergency and Domain Names
by Fergie 01 Apr '07

01 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Douglas Otis <dotis(a)mail-abuse.org> wrote: >On Sat, 2007-03-31 at 16:47 -0500, Frank Bulk wrote: >> For some operations or situations 24 hours would be too long a time to >> wait. There would need to be some mechanism where the delay could be >> bypassed. > >What operation requires a new domain be published within 24 hours? Even >banks require several days before honoring checks as protection against >fraud. A slight delay allows preemptive enforcement measures. It seems >most if not all operations could factor in this delay into their planning. > Doug and I completely agree on this issue. So again, I ask: When does a policy breakdown become an operational issue? I would posit that it does when criminals are able to abuse the system. Would love to arguments to the contrary. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDvB3q1pz9mNUZTMRAo1VAJ9rOisFN1xm4PjJsqUOeuSIWjy+OwCgpLQm gU76B10LtNBWYrE9/JjiQ+U= =vxKU -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

RE: On-going Internet Emergency and Domain Names
by Fergie 01 Apr '07

01 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Douglas Otis <dotis(a)mail-abuse.org> wrote: >The financial damage caused by crime taking advantage of DNS features to >then dance rapidly over the globe should justify rather minor changes to >the current mode of registry operations. > Amen. The Registry policies, as they stand today, enable criminals. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj4DBQFGDtNqq1pz9mNUZTMRAkcSAJd9o4g/6QjPciucwmDm+y3F03T1AJ0XCQyj X/n9+C6XfOfZi+f6M6IllQ== =IMb/ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: On-going Internet Emergency and Domain Names
by Fergie 01 Apr '07

01 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Stephen Satchell <list(a)satchell.net> wrote: >Gadi Evron wrote: >> >> Amen. Really. >> >> I'd honestly like more ideas. > >What did IETF and ICANN say when you approached them through their public-comment channels? > The IETF does not deal with registry policy issues. ICANN, from what I can tell, had this issue (doamin tasting) on their agenda as a discussion iten in Lisbon last week, but i am unaware of the discussion outcome. Having said that, if this particular policy issue can be measured by ICANN's proclivity with other domain policy issues, I think we're talking years here. And that's kind of sobering, from a policy perspective. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDtf3q1pz9mNUZTMRAvgoAKCRgrGta2dtbGCLowMMtJf4htwGqwCg3BXm nw7SEgMDEvMU3F4w8801Yos= =IPRQ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: On-going Internet Emergency and Domain Names
by Roland Dobbins 01 Apr '07

01 Apr '07

On Mar 31, 2007, at 5:16 PM, Eric Brunner-Williams in Portland Maine wrote: > The temporal value of a domain that sinks phish click stream has > some decay > property, that is, today's phish name of (check your inbox) > probably isn't > very useful to the authors of the present phish (etc) decades from > now, or > even days from now. Certainly, in a case where everything works according to plan. What about the inputs to the system, however, and the potential for abuse? Who decides the legigitmacy/reputational value of a particular domain? What about mistakes and collateral damage? ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)cisco.com> // 408.527.6376 voice Words that come from a machine have no soul. -- Duong Van Ngo

1 0

Re: On-going Internet Emergency and Domain Names
by Fergie 01 Apr '07

01 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Roland Dobbins <rdobbins(a)cisco.com> wrote: >On Mar 31, 2007, at 11:36 PM, Fergie wrote: > >> Would love to arguments to the contrary. > <Are there any similarities between the current system involving DMCA takedown notices/counterclaims and what's being posited? > Roland, I'm not so great with trick questions, but I'm sure you asked it for a very goos reason, Care to expand? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDvuzq1pz9mNUZTMRAs3OAKDJrxGY8+1ux3t3bftDp5lYqTlXkgCgm6kX LZw43cjPyA59PvY2RcF48Gc= =qYAi -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: On-going Internet Emergency and Domain Names
by Fergie 31 Mar '07

31 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Gordon Cook <cook(a)cookreport.com> wrote: >ICANN it is said would like to move to switzerland. I doubt that they much care about any of this stuff > If that is indeed the case, then this boils down to nothing less than _strictly_ an operational issue. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDuEcq1pz9mNUZTMRAoLXAJ9IhniqK47nxJk60PWYorta8B3F/ACgyHCQ 1tmX7pbPC8vrjV7Yxf7oGfA= =3iuZ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: On-going Internet Emergency and Domain Names
by Fergie 31 Mar '07

31 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Matt Ghali <matt(a)snark.net> wrote: >On Sat, 31 Mar 2007, Fergie wrote: > >> So very clever. >> >> If you're not part of the solution... etc. > >I feel so worthless standing next to you, the Solver. Sounds like a personal problem. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDuCIq1pz9mNUZTMRAj/VAKDPwS6aJhLwlro7/JJfpTo8fD0SiACgxXBV u5LwUMFRu5TJgfbwbXdP62A= =+eLD -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: On-going Internet Emergency and Domain Names
by Fergie 31 Mar '07

31 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Matt Ghali <matt(a)snark.net> wrote: >On Sat, 31 Mar 2007, Fergie wrote: > >> The Registry policies, as they stand today, enable criminals. > >and airlines enable drug smugglers. idiot. > So very clever. If you're not part of the solution... etc. Cheers, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDt11q1pz9mNUZTMRAk/yAKD0Io4pZSmtlXtnRs2DyhG3uCoufQCg4XWr htOnWKGKRCrKPm08RbRlzZk= =kJw0 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1