- Test - lists.nanog.org

Next hop issues inside AS852 ?
by Mike Tancsa 21 Oct '03

21 Oct '03

Anyone seeing any problems getting to AS852 ? I think the problem is coming back, as I can throw packets out to them and they seem to come back fine via 6539. However, going out and coming back via 852 seems to be hosed for me. (AS11647) From their routeserver, route-views.on>show ip bgp 64.236.16.52 BGP routing table entry for 64.236.16.0/20, version 1861266639 Paths: (2 available, best #2) Advertised to non peer-group peers: 198.32.162.100 198.32.162.102 1668 5662 154.11.0.195 from 154.11.0.151 (154.11.0.151) Origin IGP, metric 1119, localpref 180, valid, internal Originator: 154.11.0.195, Cluster list: 154.11.0.151, 154.11.0.222 1668 5662 154.11.0.195 from 154.11.0.150 (154.11.0.150) Origin IGP, metric 1119, localpref 180, valid, internal, best Originator: 154.11.0.195, Cluster list: 154.11.0.150, 154.11.0.222 route-views.on> route-views.on>traceroute www.cnn.com Translating "www.cnn.com"...domain server (209.115.142.1) [OK] Type escape sequence to abort. Tracing the route to cnn.com (64.236.16.52) 1 toroonxngr00.bb.telus.com (154.11.63.85) 4 msec 0 msec 0 msec 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 1

Whois software run by Lacnic and BR?
by Hank Nussbacher 21 Oct '03

21 Oct '03

When trying to determine a country code for 200.150.7.132, I first tried ARIN which pointed me to LACNIC - whois.lacnic.net: inetnum: 200.128/9 status: allocated owner: Comite Gestor da Internet no Brasil ownerid: BR-CGIN-LACNIC responsible: Frederico A C Neves address: Av. das Naחץes Unidas, 11541, 7° andar address: 04578-000 - Sדo Paulo - SP country: BR phone: +55 11 9119-0304 [] owner-c: CGB tech-c: CGB inetrev: 200.128/9 nserver: NS.DNS.BR nsstat: 20031015 AA nslastaa: 20031015 nserver: NS1.DNS.BR nsstat: 20031015 AA nslastaa: 20031015 nserver: NS2.DNS.BR nsstat: 20031015 AA nslastaa: 20031015 remarks: These addresses have been further assigned to Brazilian users. remarks: Contact information can be found at the WHOIS server located remarks: at whois.registro.br and at http://whois.nic.br So off to whois.nic.br: inetnum: 200.150.7/24 aut-num: AS23106 abuse-c: RBS151 owner: COMPANHIA ENERGETICA DE MINAS GERAIS ownerid: 017.155.730/0001-64 responsible: Marcus Vinicius da Silva address: Av Barbacena, 1200, 3 Andar address: 30190-131 - Belo Horizonte - MG phone: (031) 349-4469 [] owner-c: MVS9 tech-c: MVS9 inetrev: 200.150.7/24 nserver: OUTCEMIG1.CEMIG.COM.BR nsstat: 20031018 AA nslastaa: 20031018 nserver: OUTCEMIG2.CEMIG.COM.BR nsstat: 20031018 AA nslastaa: 20031018 created: 20020621 changed: 20020621 inetnum-up: 200.150.0/19 Does anyone know what standard is being used here? It looks like RIPE format but very modified. What bothers me is not the additional tags but rather that an automated script would not be able to determine country from their response. Thanks, -Hank

8 10

Hijacked IP blocks
by william＠elan.net 21 Oct '03

21 Oct '03

As some of you have seen from sessions today, hijacking of ips has been noticed by many. I want to give report of what the current situation is as I've been monitoring known hijacked ip ranges and active use of those. The active list is included later in this email and is available online at http://www.completewhois.com/hijacked/hijacked_flist-bgp_routed_asannounced… First I want to thank quite a number of companies both large and smaller for helping to deal with this problem. By now very few ip blocks are left that were hijacked and are still in active use, in fact 1/2 of the ones left announcing space are victims that were resold the space (particularly in 146.20.0.0/8 block; I wish they would finally renumber out of these blocks, some of them have had 4 months to do it from original notice). New hijacked blocks do not appear to be such a common occurance by spammers which makes things easier (but we must still remember what happened before and all of you must remember to take care of the resources where you maybe listed as an admin for. If your company is beeing aquired - make sure when you leave the company new administrator is assigned from new company (if this is not possible, inform ARIN ip block will be left without active administrator and what led to this). Those of you that were administrators for companies no longer in business (even going back up to 10 years), please at some if you remember what ip block were to check on what whois currently looks like and who that companie's domains are registered to. If you find problems, address them to ARIN or to completewhois for investigation about what happend to original company. Now today at NANOG meeting I was approached by a group of people concerned that the are too many names of network engineers listed on the site. I have to point it that I make all possible efforts to contact network engineers and have them resolve questionable problems on their own - some just do not answer such emails, but others did and netblocks with references to those people no matter if those people may have been involved in hijacking or not are not mentioned on the site. I would hope that I would not have to approach you in the first place and considering recent ARIN announcement http://www.arin.net/announcements/20031014.html (with which BTW I do not fully agree with - reporting every case to authorities maybe going too far - but they may not have any choice, either do it for all or for none) So I hope that any of you that may have questinable blocks in current use would on your stop and return them to the state they were before in whois or return them to arin or continue using the blocks and apply to officially transfer them (remember ARIN currently does transfers at no extra charge, this will not last forever!!!). The group that approached me had specific concerns because while some may have been mentioned on site as directly involved in hijacking, which I think is appropriate to them; others may have been mentioned indirectly when their whois records were listed under some blocks current use section. I want to stress out that active use in no way implies any connection to hijacking, it is simply result of dns and related whois info on what active use of the block and what it has been (i.e. isp customers, irc, spam sites, etc) and having it comes very usefull for correlation between different cases and people previously asked me to include it in fact. To differentiate about this data, I'm willing to put a desclaimer up in each file regarding data listed in active use section. Please make your suggestions on the best text for this to me privately or on hijacked mail list when I bring this topic up there. I also understand that number of people do not want google and other search engines to be able to reference their names and other data if its in the current use section. Please make a suggestions on how to best achieve this without stopping google from searching other sections of the site. Would the solution of separating current use data into separate files in separate directory and putting robots.txt file there work? Should I also make sure that people are only able to reference those files when they first looked at the data in primary data file? And understand that if I do not hear your concerns, I would not know what maybe wrong with the completewhois hijacked section or what is done wrong as far as investigations go. I do answer emails even if it may take several days sometimes and have in the past made changes based on what has been suggested. Now going back to the top of this post, below is the list of actively advertised hijacked blocks (same program as has been used for bogon advertisements has been used here as well): 142.105.220.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 142.105.224.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 142.105.228.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 142.105.232.0/22 ## AS3908 : SUPERNETASBLK : SuperNet, Inc. 146.20.36.0/22 ## AS20473 : NETTRANS : NetTransactions, LLC 146.20.40.0/21 ## AS20473 : NETTRANS : NetTransactions, LLC 146.20.48.0/20 ## AS23131 : STARLAN : Starlan Communications Inc. 146.20.64.0/19 ## AS12277 : TRACON : Tracon Industries 146.20.80.0/22 ## AS3638 : GLOBALI : Shaman Exchange, Inc. 146.20.80.0/21 ## AS12277 : TRACON : Tracon Industries 146.20.88.0/22 ## AS12277 : TRACON : Tracon Industries 192.107.49.0/24 ## AS30080 : BA-CONSULTING : BA Consulting 198.182.182.0/24 ## AS16631 : COGENT-ASN : Cogent Communications 199.245.138.0/24 ## AS30080 : BA-CONSULTING : BA Consulting 203.29.33.0/24 ## AS3491 : CAIS-ASN : CAIS Internet 203.29.34.0/24 ## AS16631 : COGENT-ASN : Cogent Communications 203.30.20.0/24 ## AS3491 : CAIS-ASN : CAIS Internet 203.30.26.0/23 ## AS3491 : CAIS-ASN : CAIS Internet 203.55.84.0/22 ## AS3409 : INET-1-AS : Internetworks, Inc. 204.155.240.0/20 ## AS16631 : COGENT-ASN : Cogent Communications And for for comparison here is what this looked like on Sep 26th when I started active monitoring (I also have manual data from early August, but it would take too long to put it into email. I can say though, that there were twice as many hijacked announcements then, things have really changed for good in the last several months as more people and RIRs themselve became aware of these issues). 139.81.128.0/17 # AS22653 - GlobalCompass 142.105.0.0/21 # AS19800 - Grant County Public Utility 142.105.220.0/22 # AS3908 - Supernet 142.105.224.0/22 # AS3908 - Supernet 142.105.228.0/22 # AS3908 - Supernet 142.105.232.0/22 # AS3908 - Supernet 142.247.0.0/16 # AS577 - bell.ca (Note - this is proper announcement on behalf on behalf of MDS) 146.20.36.0/22 # AS20473 - NetTransactions 146.20.40.0/21 # AS20473 - NetTransactions 146.20.48.0/20 # AS23131 - Starlan 146.20.64.0/19 # AS12277 - Tracon 146.20.80.0/22 # AS3638 - Globali 146.20.80.0/21 # AS12277 - Tracan 146.20.88.0/22 # AS12277 - Tracan 150.112.0.0/16 # AS8121 - TCH/Layer42.net 157.112.0.0/16 # AS23720 - FUSIONGOL-AS-AP (Note - this is proper announcement, on behalf of Clipper) 166.88.0.0/16 # AS8121 - TCH/Layer42.net 167.179.0.0/16 # AS4768 - Clear Communications 192.107.49.0/24 # AS30080 - BA Consulting (hijacker used named), routed by AS3568 CW 198.133.167.0/24 # AS8121 - TCH/Layer42 199.245.138.0/24 # AS30080 - BA Consulting 203.4.160.0/24 # AS9826 - ILink.net 203.29.32.0/24 # AS9826 - ILink.Net 203.29.33.0/24 # AS3491 - CAIS 203.30.20.0/24 # AS3491 - CAIS 203.30.26.0/23 # AS3491 - CAIS 204.155.240.0/20 # AS16631 - Cogent 205.235.64.0/24 # AS29698 - Internet America LLC (hijacker named used) 205.235.69.0/24 # AS29698 - Internet America LLC

2 1

Re: Dos attack?
by guy 21 Oct '03

21 Oct '03

Eric, You should start with your upstream's security dept. They may have seen either this incident, a related one, or both. And they more than likely have resources at other transit providers' security depts. You pay for their service, you may as well use it, right? Guy ------------------------------------------------------------------------ Hi, We are getting a LOT of web requests containing what mostly looks like giberish. [Mon Oct 20 21:13:42 2003] [error] [client 172.133.3.204] request failed: erroneous characters after protocol string: \xb8\xcf\xc235\x9f\xc4\x1c\xebj\xd7\xc5\x8e\xe9d>\xfdMe\xed\x16\xca\xd51\xcfReF\x82\xa3qi\x89\x832<\vJ5k\x15\xa2\x0c\ x90\xed\x8bCT\xa3\xa2\x96\xd7\xe8\xa2`S#+W\xfc\xc2\xc2w*\xce\x1a<\xb9\xc3\x91\x14\xb0\x9e\xfe\x14\"7\xaa\xeaR\xd1\x9c \x13\x1a\xf0\x1aN\x8eklP\xdc\xc1\xe3\xb9w\xb0\x1aGt\x04|I4\xae\x06WC\x15NA\x80\xb1\xc5E~\xd59\x85+\xcc\x9e\xb8\xaf(\r \x1f\x97 But this is not the standard Microsoft worm stuff that I can tell. It is coming from numerous IP addresses and nearly took down a few of our servers until we started blocking them with the firewall. So I am trying to find out as much as I can about what is happening, but I don't really know where to start. I don't believe it is considered approperiate to send a list of IPs to this list. So where should I start? The list so far contains about 60 addresses. Thanks, Eric

2 1

Interesting ASN usage data point
by John Brown (CV) 21 Oct '03

21 Oct '03

Interested data point 23707 23708 23709 23710 APNIC ASN's 23711 23712 23713 25572 RIPE ASN's 27318 27319 27320 ARIN ASN's 27321 27322 30122 30123 30124 30124 30124 30124 30124 ARIN ASN's 30124 30130 30131 30132 30133 30134

2 1

pgp keysigning party at 9pm, salon F
by Joe Abley 21 Oct '03

21 Oct '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have just cut a keyring with the 34 keys sent in for tonight's key party, which you will find at: http://www.isc.org/misc/nanog29.pgp http://www.isc.org/misc/nanog29.txt (ASCII-armoured version) Fingerprints are below, and will also be available on about 30 dead-tree handouts which I'll take with me to salon F at 9pm. Joe pub 1024D/05C657DA 2003-10-13 Ingrid Erkman <ingrid_erkman(a)icgcomm.com> Key fingerprint = DAFA AB89 3674 B685 E36B 74ED FB5E 7E41 05C6 57DA sub 2048g/40D7181B 2003-10-13 pub 1024D/D33C5095 2003-05-27 Kurtis Lindqvist <kurtis(a)kurtis.pp.se> Key fingerprint = 2272 698F 6116 15F4 8D58 D631 A6AB 34A5 D33C 5095 uid Kurtis Lindqvist <kurtis(a)netnod.se> uid Kurtis Lindqvist <kurtis(a)autonomica.se> sub 2048g/7CCBFF3A 2003-05-27 pub 1024D/CCA5211A 2003-10-20 Andrew Partan <asp(a)partan.com> Key fingerprint = 8007 3813 C415 37A8 4047 D19B 102F 0E27 CCA5 211A sub 2048g/E6D754EB 2003-10-20 pub 1024D/5887668E 2002-08-09 Chris Liljenstolpe (personal key) <cds(a)io.com> Key fingerprint = 3242 6DBB 93BB 3227 11A7 0E2E 4384 FA9F 5887 668E uid Chris Liljenstolpe (personal key) <cdl(a)asgaard.org> uid Chris Liljenstolpe (Alcatel work address) <chris.liljenstolpe(a)alcatel.com> sub 1024D/51A7A252 2002-08-09 [expires: 2004-08-08] sub 2048g/B4FC4ECA 2003-09-09 [expires: 2004-09-08] sub 1024R/209293C1 2003-09-09 [expires: 2004-09-08] pub 1024D/1C71DDEA 2002-11-07 Chad Skidmore <cskidmore(a)go180.net> Key fingerprint = 6AD2 56AB 3153 18D7 BAEC 7CBF FF18 F3E4 1C71 DDEA sub 2048g/1FC903B2 2002-11-07 [expires: 2003-11-07] pub 1024D/B0413BFA 1999-11-27 Gregory Maxwell <gmaxwell(a)martin.fl.us> Key fingerprint = DE47 BC9E 6D2D A6B0 2DC6 10B1 AC85 9362 B041 3BFA uid Gregory Maxwell <greg(a)linuxpower.cx> sub 2048g/F0F0B355 1999-11-27 pub 768R/8FB07FA5 1996-01-23 Jared Mauch <jared(a)puck.nether.net> Key fingerprint = 61 90 2E DD 7A 7E 80 F2 55 C7 48 23 10 CE 2C A7 pub 1024D/1FCE8F63 2002-12-04 Jared Mauch <jared(a)puck.nether.net> Key fingerprint = E91D D981 58C0 BA4F 87EB 92B8 19F3 2B7F 1FCE 8F63 sub 2048g/1E47671E 2002-12-04 [expires: 2017-11-30] pub 1024D/4DA19C8E 2001-12-15 John Curran <jcurran(a)istaff.org> Key fingerprint = 4A71 8D23 C163 1504 E718 A718 876D 9341 4DA1 9C8E sub 4096g/52A762BA 2001-12-15 pub 1024D/B58EB3D7 2003-10-19 Jeff Gallagher <jeff.gallagher(a)aliant.ca> Key fingerprint = D614 4AD1 63E9 1B89 88A5 E454 BE4B E110 B58E B3D7 sub 2048g/716B1FC3 2003-10-19 pub 1024D/B67F56B2 2003-08-11 Joel Jaeggli (08112003-alternate to pgp 5 keypair) <joelja(a)twin.uoregon.edu> Key fingerprint = 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2 sub 4096g/29407F92 2003-08-11 pub 1024R/DAD87E19 2001-07-10 Johan Ihren <johani(a)autonomica.se> Key fingerprint = 0B 84 CB E5 81 08 3D C3 37 15 53 F8 6C 60 DB D5 pub 1024D/7FDE085A 2003-05-07 Jon C. R. Bennett (yahoo) <jcrb(a)yahoo.com> Key fingerprint = EFFE 158B 91CC 3182 5158 8297 D2FF 109C 7FDE 085A sub 4096g/9099A410 2003-05-07 sub 1025g/446152E9 2003-05-07 pub 1024D/E5D36C49 1998-04-19 Kevin Houle <houle(a)mindspring.com> Key fingerprint = 7F59 2D43 FF67 EDE7 4757 E0E9 BBF3 530B E5D3 6C49 uid Kevin Houle <kjh(a)cert.org> uid Kevin Houle <kevin(a)houle.org> uid Kevin Houle <kjh(a)pgh.net> uid Kevin Houle <kjh(a)sei.cmu.edu> uid Kevin Houle <Kevin_Houle(a)cmu.edu> uid Kevin Houle <kevin.houle(a)cmu.edu> uid Kevin Houle <kjh+(a)andrew.cmu.edu> sub 2048g/0615EA47 1998-04-19 pub 1024D/EBD6D9CD 1998-07-07 Kevin J. Houle <Kevin.Houle(a)cmu.edu> Key fingerprint = 2777 05E4 143E 72F1 2DEC CA25 4D73 6BD6 EBD6 D9CD uid Kevin J. Houle <kjh(a)cert.org> uid Kevin J. Houle <kjh(a)sei.cmu.edu> uid Kevin J. Houle <Kevin_Houle(a)cmu.edu> sub 2048g/C8F1320A 1998-07-07 pub 1024D/848B1194 1999-07-07 Kevin Miller <kcm(a)cmu.edu> Key fingerprint = 2B94 7C7E AF64 CDBD 9BFE 26C4 0CA5 20FE 848B 1194 uid kevinm(a)ANDREW.CMU.EDU uid Kevin Miller <kevinm(a)abtech.org> sub 2048g/D55113EB 1999-07-07 pub 1024D/9090EAFE 2003-10-12 John Kristoff <jtk(a)northwestern.edu> Key fingerprint = DBBC 33CC 2408 DFF5 CFCB 86C9 40A6 3FEF 9090 EAFE sub 4096g/216E26F4 2003-10-12 pub 1024D/C85CCA46 1999-11-16 John Kristoff <jtk(a)depaul.edu> Key fingerprint = C594 D57F 9538 CFE5 4F06 549F 207C C968 C85C CA46 sub 4096g/7E09D763 1999-11-16 pub 1024D/47DF22ED 2000-07-01 Majdi S. Abbas <msa(a)latt.net> Key fingerprint = 3B64 64C4 BD62 B949 4A9B 5F12 C12C EDFD 47DF 22ED sub 4096g/6EE7E22C 2000-07-01 pub 1024D/9DAE11D9 2001-02-22 Mark A. Schleifer <marks(a)schleifer.org> Key fingerprint = C98C CCDF 179E 5A68 DC82 BF5A ECDE E9CB 9DAE 11D9 sub 2048g/CB8FBA9B 2001-02-22 pub 1024D/0B12861B 2003-10-20 mwolf(a)speciosus.net Key fingerprint = 2534 D547 3F4B 45D0 70A6 468A A326 F3CB 0B12 861B sub 2048g/9F635B17 2003-10-20 [expires: 2006-07-15] pub 1024D/E67A242B 2003-06-17 Kris Foster <kris(a)packetheads.org> Key fingerprint = EEA7 BAC3 809A 4AE6 4A78 C7E7 06A1 91EA E67A 242B sub 1024g/B3B7D5AF 2003-06-17 pub 1024D/6E0FA224 2003-08-07 Robert Drake <rdrake(a)sprint.net> Key fingerprint = B7B4 4B3D 77FA CC9F FD07 A985 8DBA 4E07 6E0F A224 sub 1024g/BFD65DD6 2003-08-07 [expires: 2008-08-05] pub 1024D/9B986F89 1998-12-01 Nigel Titley <ntitley(a)flagtelecom.com> Key fingerprint = A987 798A 5392 78C0 68E4 99D2 3FE0 7854 9B98 6F89 uid Nigel R. Titley <nigel(a)titley.com> uid Nigel Titley <nigel(a)linx.net> uid Nigel R Titley <nigel.titley(a)level3.com> uid Nigel R Titley (Work) <nigel(a)packetexchange.net> uid Nigel R Titley (Work) <nigel.titley(a)packetexchange.net> sub 2048g/F809D7B7 1998-12-01 pub 1024D/37E00C46 2002-06-28 Michael K. Smith <mksmith(a)noanet.net> Key fingerprint = 4374 00CC C99A 4679 1D6C F465 9CE0 C7B6 37E0 0C46 sub 2048g/3D6EE614 2002-06-28 pub 1024D/CBDB98A2 2003-10-20 Robert J. Berger <rberger(a)ibd.com> Key fingerprint = 1531 F11E 23AE 22AC CE9E B21E 80FC AAAC CBDB 98A2 uid [jpeg image of size 9794] sub 2048g/3B98D9F7 2003-10-20 pub 1024R/E9197361 1996-05-24 Sean McCreary <mccreary(a)mcwest.org> Key fingerprint = FE C0 DA CD 9E C3 E3 8D C6 B2 85 14 E6 CE E9 7F pub 768R/772CA539 1998-12-03 steve(a)telecomplete.co.uk Key fingerprint = 39 6D 8E 50 3A 3B 6A 3A 5F 30 2C DC 67 F5 C0 0E uid steve(a)opaltelecom.co.uk uid Stephen J. Wilcox <steve(a)thedogsbollocks.co.uk> pub 1024D/B4D24B53 2003-05-30 Todd Christell (SpringNet) <tchristell(a)springnet.net> Key fingerprint = A051 FA08 7DFD 6D34 8F3C 0791 C610 FB2E B4D2 4B53 sub 1024g/30A62D86 2003-05-30 pub 1024D/DBB02F29 2002-08-13 Todd O'Boyle (DISA CONUS RCERT) <oboylet(a)scott.disa.mil> Key fingerprint = 7DC7 BEF0 98E3 5F45 E13A E0BF 0585 2DA8 DBB0 2F29 uid Todd O'Boyle <oboyle(a)mitre.org> uid Todd O'Boyle (The Purdue University Computer Society) <oboyle(a)csociety.org> uid Todd O'Boyle <oboyle(a)linus.mitre.org> sub 1024g/8E36CA5D 2002-08-13 [expires: 2004-08-12] pub 1024D/12B73747 2003-06-02 Tony Weasler III (ElgE Key) <tony-gpg(a)tony3.com> Key fingerprint = 2BFA E9DD 05A3 9674 ACF2 23D9 C30E BAC2 12B7 3747 sub 1792g/7C4464D1 2003-06-02 pub 1024R/EB9D36A9 1994-09-30 Tony Weasler III <tony(a)tony3.com> Key fingerprint = 7F D5 03 E8 16 43 6A 5E ED A4 07 4B 42 3E FE 7E pub 2048R/9AD09F2D 2003-10-17 Troy Lister (RSA Legacy / PGP 2.6+) v2003/2004 <PGP.RSA.L(a)TroyLister.com> Key fingerprint = 04 C4 39 71 C1 2D CA 38 70 2E 54 08 97 4F 2C 67 pub 1024D/B0D4181C 2003-10-20 William Fernando Maton <wmaton(a)ryouko.imsb.nrc.ca> Key fingerprint = 95D2 A730 47A0 308A ED87 91F7 D19E 2A31 B0D4 181C sub 2048g/19987540 2003-10-20 pub 1024D/E4DB44F2 2002-08-14 Joe Abley <Joe_Abley(a)isc.org> Key fingerprint = 9DC3 1ED0 F3DD 67A2 56D0 7521 FDFF 8F58 E4DB 44F2 uid Joe Abley <jabley(a)isc.org> sub 2048g/C2A8FC71 2002-08-14 [expires: 2005-10-19] pub 1024D/CAD509C6 2001-03-08 Joe Abley (extra-strength key for signing purposes) <jabley(a)automagic.org> Key fingerprint = 0927 4C33 D5C0 8B9B E051 989C D20F D405 CAD5 09C6 sub 4096g/C1B12A96 2001-03-08 [expires: 2005-10-19] pub 1024D/6D521472 2003-10-20 William F. Maton <wmaton(a)ottix.net> Key fingerprint = EFB5 F3F7 7ED7 1275 7875 B029 9FC1 0D01 6D52 1472 sub 2048g/4C5EB7CE 2003-10-21 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (Darwin) iD8DBQE/lHy2/f+PWOTbRPIRAsI0AJ9OCRqORIu57/66c6lkwobulawqQACfbu4l CO3D+Zox9QUo3jWgLtrP5DM= =Ie9q -----END PGP SIGNATURE-----

1 0

And in other news...
by Bret Baptist 20 Oct '03

20 Oct '03

The NANOG mailing list has been renamed to VOTDG. This stands for Verisign Off Topic Discussion Group. -- Bret Baptist Systems and Technical Support Specialist bbaptist(a)iexposure.com Internet Exposure, Inc. http://www.iexposure.com (612)676-1946 x17 Web Development-Web Marketing-ISP Services ------------------------------------------ Today is the tomorrow you worried about yesterday.

3 2

Re: data request on Sitefinder
by Dave Israel 20 Oct '03

20 Oct '03

On 10/20/2003 at 16:31:45 -0400, Steven M. Bellovin said: > > A number of people havce responded that they don't want to be forced to > pay for a change that will benefit Verisign. That's a policy issue I'm > trying to avoid here. I'm looking for pure technical answers -- how > much lead time do you need to make such changes safely? I think that the policy problem adds to the technical one. If the community were behind Sitefinder and supported Verisign's design goals, it would be possible to hammer out everything in a short period of time. But because the hearts and minds of those who would make the changes are not won, those responsible for implementing changes would drag their feet, hoard necessary resources, and use the incomplete state of their implementation as an obstacle to change and, should the change happen anyway, use this "evidence" of Verisign's "bad behavior" as an excuse to act openly against the service, on ways that have already been demonstrated. Thus, the human factor will make any purely technical estimate useless. Sadly, I do not feel qualified to give a detailed estimate on your question, as presented, which I find intriguing from a purely theoretical point of view, except to say that there are always going to be one-offs, unique builds, etc that willneed to be changed individually, and even without the sour feeling towards Sitefinder, there will be procrastination and compteting priorities. This is not, and never will be, the only thing that needs working on. Even with complete technical buy-in, I wouldn't expect the mass of users to be covered by these changes until the middle of next year if work started today. -Dave

1 0

Observation on SiteFinder
by Ray Bellis 20 Oct '03

20 Oct '03

Has it occurred to anyone else that the side effects of Verisign's wildcard record might have been very much reduced if the wildcard had only worked if the address being resolved actually started 'www.' ? Not that I ever want to see Verisign's abomination resurrected, of course... Ray -- Ray Bellis, MA(Oxon) - Technical Director community internet plc - ts.com Ltd Windsor House, 12 High Street, Kidlington, Oxford, OX5 2PJ tel: +44 1865 856000 email: ray.bellis(a)community.net.uk fax: +44 1865 856001 web: http://www.community.net.uk/

2 2

More on Versign Vs. ... .. ...
by Robert Mathews 20 Oct '03

20 Oct '03

Trouble Grows at the Internet's Root By Kevin Murphy http://www.cbronline.com/latestnews/165c8acb5f79bb5780256dc50018bddd

1 0