- Test - lists.nanog.org

RE: Non-English Domain Names Likely Delayed
by Jason Sloderbeck 19 Jul '05

19 Jul '05

I don't know of any other IEEE/NANOG/IETF/ICANN-sanctioned method to completely confuse even a savvy IT user who is trying to determine the validity of an SSL site. > There are dozens of ways we know of, and probably more that lie undiscovered, > to exploit vulnerabilities in DNS, browsers, and in human nature to conduct > phishing. Sure, there are bugs and hacks. The existence of such does not justify approving new measures (in this case, a glaring security hole) as a global standard. In fact, quite the opposite: folks are generally trying to fix such problems, not push them forward in public policy agenda. It's clear that no one intended for the side effect of a complete meltdown in the user layer of SSL (where the only thing you can do is double-check the URL in your browser and verify there's a padlock icon in your status bar), but the side effect is there and it's naive to pretend that fairness to non-English folks or globalization justifies a hole this large. Certainly, the vulnerability is just as much a problem for the targeted benefactors of this change. -Jason -- Jason Sloderbeck Positive Networks jason @ positivenetworks . net -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Crist Clark Sent: Monday, July 18, 2005 4:43 PM Cc: NANOG Subject: Re: Non-English Domain Names Likely Delayed Isn't someone more eloquent than I going to point out that that spending a lot of effort eliminating homographs from DNS to stop phishing is a security measure on par with cutting cell service to underground trains to prevent bombings? It focuses on one small vulnerability that phishers exploit, and "fixing" this one vulnerability just may make things worse. It wastes resources that could go to coming up with a *real* solution, and it may provide a false sense of security. Worrying about homographs is probably something about which we should let the trademark lawyers get there undies in a bunch (knowing ICANN, that may very well be what's driving this, not phishing worries) while the IT security community concerns itself with a usable, and actually secure, end-to-end security model for e-commerce. -- Crist J. Clark crist.clark(a)globalstar.com Globalstar Communications (408) 933-4387

2 1

RE: IPv6 push doesn't have much pull in U.S
by Kuhtz, Christian 18 Jul '05

18 Jul '05

> On 18-jul-2005, at 18:31, Kuhtz, Christian wrote: > > > If there is pressure to adopt IPv6 rapidly in a given > region, and that > > given region also happens to drive broadband technology > evolution, and > > North America ends up being dependent on cheap equipment primarily > > driven by overseas standards.. > > I don't see this. For instance, the need for non-ASCII characters in > (for instance) Asian languages has pushed Unicode. Modern systems in > NA are all capable of using Unicode. But do users in NA actually > _use_ Unicode? ASCII works fine for them 99% of the time. I don't disagree with that point at all. But what I was trying to say goes a little further and is basically the notion that you're likely to use gear that happens to speak Unicode because of other developments and while you may be fine using ASCII most of the time (given that it is a charset specifically developed to meet North American English needs some time ago), you may be receiving a parasitic benefit of it showing up elsewhere or everywhere else. It won't influence purchase decisions perhaps, you won't buy gear X because it doesn't do Unicode, but it may just show up as the defacto standard. Just like other charsets have made it into just about every current, modern operating system and application.. So, you'd adopt just because it's there and it's no worth fighting the current of being different. (GSM in North America is a similar example, I think :-) There are economic forces at work, that have very little to do with the suitability of technology for a specific locale, which may drive adoption of technology. > Same thing with IPv6. Windows and MacOS have had IPv6 on board for > years. Doesn't mean people use it. Yup. That is absolutely correct. But, if there are huge amounts of actions in a given market place, that's bound to spill over into a different market place because of global distribution of goods. Not because the other, different market asked for it, but just because it's more economical to make one set of gear that is a superset in the end. > > The key questions are > > > When will who you want to talk to speak IPv6? > > That's a key question when you've made up your mind to be one of the > last to adopt IPv6. Yes, and in terms of volume, that's where I see North America being right now.. We're on a track to be dead last (well, almost) on the path we are on right now (and have been for some years). > The real key question is: when will it start to > make sense to use IPv6 for my own stuff, regardless of what the rest > of the world does? Not if you are fine with what you have, and believe in never change a running system because one doesn't believe it's prudent to keep up with technology... > In an enterprise environment the ease of never > again having to think about how many hosts are going to end > up in the > same subnet alone may be quite compelling. But it only makes sense > when you can turn off IPv4 in most of the network and proxy or > translate communications to the outside. Well, I'm not sure I would be so bold as to say it's an either or choice, but it would have to be for substantial islands of a corporation or other type of organization to make economic sense. Just like there's still antiquated computing gear (& software on it) hopping around happily all over the place, although isolated and put into a scenario where there are gateways or dain bramage impact on the rest of the world is otherwise limited, there will be IPv4 in islands long after IPv6 achieves world domination (which has yet to be seen). If there is a business case for IPv6, it is pandemic rather than epidemic for as far as my rather cloudy crystal ball will let me see... Best regards, Christian The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 163

1 0

Anyone from GLBX noc monitoring?
by Drew Weaver 18 Jul '05

18 Jul '05

Thanks, -Drew

1 0

RE: IPv6 push doesn't have much pull in U.S
by Kuhtz, Christian 18 Jul '05

18 Jul '05

:) True, but, there's actually another angle to consider. If there is pressure to adopt IPv6 rapidly in a given region, and that given region also happens to drive broadband technology evolution, and North America ends up being dependent on cheap equipment primarily driven by overseas standards.. It is conceivable that North America will have a substantial economic argument for adopting IPv6 on the trailing edge, maybe just past the leading edge if you have additional factors playing into the decision. Or one may just be oblivious to the emergence of IPv6 like it has been to up to this point, and sustain that without any harm whatsoever. The key questions are When will who you want to talk to speak IPv6? When will we have a need (and be willing to pay for) addressing every device individually and directly without intermediary? When will we have a need (and be willing to pay for) pervasive crypto & "identity"? Each person/carrier/user/whatever will answer these differently, and it has a lot to do with how you work, who you do business with, and what economic pressures may apply, and whether or not you can cope with an intermediary or non-native setup. There is no globally correct answer. Or that's at least my view. Flame away. Thanks, Christian > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Iljitsch van Beijnum > Sent: Saturday, July 16, 2005 5:33 AM > To: Fergie (Paul Ferguson) > Cc: nanog(a)merit.edu > Subject: Re: IPv6 push doesn't have much pull in U.S > > > > On 16-jul-2005, at 1:57, Fergie (Paul Ferguson) wrote: > > > Someone's been listening: > > Listening to what, exactly? Still nonsense about address space > distribution. > > And I'm sure Sprint and Verio (MCI/Worldcom/UUNET too? I have a > tunnel from them in the Netherlands, not sure what they do in > the US) > are happy to hear that they're not "major U.S. service provider[s]" > since none of those offers IPv6, right? > > Also, I mostly disagree with their conclusion: > > Currently only a handful of U.S. technologists need to worry about > IPv6--those that work in the federal government, carriers, > researchers and networking vendors. If you're not in one of those > categories, the IPv6 bug won't reach you for years to come. > > Software vendors need to look at IPv6. The OS and router > vendors have > their stuff in place. The networks will follow when the time is > right, but none of it means anything if applications can't work over > IPv6. > > I'm not saying everyone has to love IPv6, but please get those pesky > facts straight... > ***** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 162

2 1

Re: Non-English Domain Names Likely Delayed
by Fergie (Paul Ferguson) 18 Jul '05

18 Jul '05

Forwarded Message from Neil Harris <neil(a)tonal.clara.co.uk> --- Fergie (Paul Ferguson) wrote: >...sez Vint...due to the prevalence of phishing: > >http://www.msnbc.msn.com/id/8586332/ > >- ferg > > Paul, I'm not registered as a poster on the Nanog list, so I thought I'd let you know that this problem is already well under control. After extensive analysis and discussion, the Mozilla community and Opera have already produced a fix for this, based on only displaying Unicode IDN labels where the registry publishes and enforces well-defined anti-homograph policies, and displaying the Punycode equivalent otherwise. All that is needed is a couple of lines of code in the Punycode -> Unicode translation code in the application, and a whitelist of TLDs. See http://www.mozilla.org/projects/security/tld-idn-policy-list.html for more details. This delegates the responsibility of catching homographs to the registries, rather than trying to catch them using ad-hoc heuristics at the browser end. In many cases, this can be as simple as restricting labels within a TLD to use a small set of non-confusable characters. In others, with wider character sets, techniques such as bundling and blocking sets of confusable labels using homograph tables can be used. RFC 3743 is a case in point. For an excellent summary of the technical details, which is intended to help anyone attempting to eliminate homographs from a naming system, see the latest, much-expanded, version of Unicode TR #36, which also links to machine-readable confusables tables. http://www.unicode.org/reports/tr36/ Already, some 21 TLDs are whitelisted, including .cn, .tw, a number of European ccTLDs, .museum, and .info. Any other registrars who want to be supported can simply E-mail Gerv at the Mozilla Foundation, or his Opera counterpart, and give them a pointer to their anti-spoofing rules. You might want to summarize to the list. -- Neil

6 8

WSJ: Information Security Where the Dangers Are
by Sean Donelan 18 Jul '05

18 Jul '05

Both Steve Bellovin and Craig Labovitz show up in today's technology section of the Wall Street Journal. Information Security Where the Dangers Are By DAVID BANK and RIVA RICHMOND Staff Reporters of THE WALL STREET JOURNAL July 18, 2005; Page R1 In the world of cybercrime, the bad guys are getting smarter -- and more ambitious. In recent months, hackers have carried out a flurry of increasingly sophisticated attacks, highlighting the vulnerability of key computer networks around the world.

1 0

Phoenix
by Louisa.Coughlan＠cox.com 17 Jul '05

17 Jul '05

Is there any interest in peering in Phoenix?

3 2

RE: ICANN warns world of domain hijacking
by Bruce Tonkin 17 Jul '05

17 Jul '05

> > Is ICANN actually going to come up with a set of guidelines > ..... ? Yes - the report has some guidelines. The plan is to make these guidelines easily available to suppliers that provide domain name services. Making them enforceable will take longer, and will be done if the guidelines are not successful in getting change. Regards, Bruce

2 1

ICANN, VeriSign Will Consider Changes on .net Agreement
by Fergie (Paul Ferguson) 17 Jul '05

17 Jul '05

Via Netcraft: [snip] ICANN and VeriSign will consider changes to the new .net registry agreement in response to a mass protest by major domain name registrars, who said the deal represented a "breach of trust" between ICANN and the registrar community. In response to a joint protest by more than 30 registrars at a Luxembourg meeting, ICANN chairman Vint Cerf announced today that VeriSign and ICANN will re-examine a provision in the agreement that lifts restrictions on the price VeriSign can charge registrars for each .net domain they sell. [snip] http://news.netcraft.com/archives/2005/07/14/icann_verisign_will_consider_c… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Not exactly a policy issue, more of a technical issue.
by Drew Weaver 17 Jul '05

17 Jul '05

I'm having a problem with a catalyst 6500 series switch, wherein certain users connected to said switch report that high numbered UDP ports 27015, etc are unreachable even though there are no access-lists anywhere in my network preventing these ports from being available. I recently took the advice of many on this list and got the cat, we're switching from the Extremes over to the Cisco models slowly, and I'm sure this could possibly be something I'm doing wrong, but I'm not too certain as to what could cause it to "firewall" certain UDP ports unless there is some sort of advanced security setting I accidentally enabled when I was reading through cymru's template (although the only things I adopted were NTP, logging and a few other things like MAC address security [ thanks by the way for the great document]). None of the nmap port scans show the high number ports listening. By the way, if I take that same server and connect it to one of the Black Diamond's that is connected to the same upstream router (the switches are all hanging off of a 12000.) The port seems to be available, so the problem seems localized to just that 6500. Sorry if this is off-topic, but I wasn't entirely sure if it was or not. Thanks, -Drew

2 1