- Test - lists.nanog.org

Security v. Privacy (was Re: Is there anything that actuallygets users to fix their computers?)
by Jamie Reid 05 Oct '03

05 Oct '03

While we were fighting blaster/nachi and others, we relied heavily on IDS's to generate alerts for the worms, then we disabled their network access and called them. Generic viruses are not an ISP's problem, but a worm is something that affects the prviders infrastructure, and is therefore a network operators business. Privacy is not an issue in this case as there is a policy being monitored by a policy monitoring tool, and enforced on a per-violation basis. It wasn't a fishing expedition that could assess the users configuration or usage, it was monitoring our network. There is no generalized way, without management access to the customers machine (via SMS or citrix or something), to check that the machine is in compliance with a network policy. An IDS can tell you if it violates policy, and you can act as your security procedures dictate. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "Sean Donelan" sean(a)donelan.com> 10/05/03 04:49pm >> [...] So from an ISPs point of view, is there a way for the ISP to quickly tell the customer if the particular computer is fixed without unduly intruding on the privacy of the customer? With home networks, there may be multiple computers behind a NAT/router/firewall. So a simple network scan doesn't always work.

1 0

David McGuire article on Verisign 10/4/2003
by Howard C. Berkowitz 05 Oct '03

05 Oct '03

Let me begin with appropriate disclaimers and identifiers. While in college in 1966-1967, I was a part-time science writer for The Washington Post, so have some familiarity with the news process. At the present time, I am an independent consultant in networking and medical computing, with experience including Internet operational design. With respect to the latter, I have four published books, including one on ISP design: _Building Service Provider Networks_ (Wiley). I am a participant in the Internet Engineering Task Force and North American Network Operators' Group. I have no financial interest in Verisign or its competitors. My concern is first with journalistic balance with respect to sources, and second with technical inaccuracy. The article quotes a Verisign executive, as well as an executive of a firm with a commercial offering similar to Verisign's Sitefinder process. In contrast, the Post cited "the close-knit group of engineers and scientists who are familiar with the technology underpinning the Internet" without naming a single name of an acknowledged expert on the Domain Name System, the Internet function that translates human-oriented names to computer-oriented Internet addresses. It would be simple to find recognized professionals with no financial interest in the type of redirection from Verisign and Paxfire. Balanced reporting should cover both sides of the story. There are a great may individuals and firms that were adversely affected by Verisign's action, and considerable sentiment in the worldwide Internet engineering community that the Verisign action was technically unsound, and in a manner that can be demonstrated objectively, interfered with the normal operations of the Internet. While I wouldn't quite call the article a Verisign press release, I'm appalled either that Mr. McGuire failed to obtain opinion from independent, financially disinterested individuals, or, alternatively, that the editorial staff removed such material. Let me summarize some of the major operational concerns, and not get into the governance issues between Verisign and ICANN. Strong arguments can be made that adding the wildcard (i.e., that which causes any undefined domain to be redirected to Sitefinder) to .com and .net breaks the operational and even protocol aspects of DNS. A great many network security tools, especially spam filters, depend on checking if domains are undefined. There is a specific DNS protocol message for undefined domain, which the wildcard defeats. Beyond security, the wildcards have an indirect effect of potentially slowing electronic mail or causing it to be dropped. One thing that Verisign seemed not to consider is that the Internet is more than the Web, and mail agent redirection to Sitefinder provides absolutely no value to the mail-using Netizen. Here's the problem. Let's say I misaddress a piece of mail to foo.com, which I shall assume is a nonexistent domain. When an ISP first tries to deliver it without the DNS wildcards, when it discovers there is no such domain, it will treat that as an error, usually returning the mail to sender with an appropriate error message. With wildcards, however, an unmodified SMTP agent will get back an address (Sitefinder) and try to set up a SMTP session with it. At best, it will discover that Sitefinder does not support mail exchange and treat the message as undeliverable, again returning it. It's more likely, however, that the SMTP software will decide that since it can find foo.com (with sitefinder's address), a temporary error is interfering with delivery. It will requeue the message for retry. Typically, mail agents try to redeliver for several days, and may or may not return intermediate warning messages. We now have the effects: --ANY mail to an incorrectly spelled name gets added to the outgoing mail queue for retry, increaasing queue length. Doing so: -- slows down mail delivery due to the need for repeatedly processing mail that will never be delivered -- consumes queue storage resources and increases ISP costs, which may be passed on to the end user --Inconveniencing the user, who, if they received a prompt error notification, might discover they spelled an address incorrectly and simply need to correct the message and resend it. With the wildcards, days may elapse before the sender even knows there is a problem. -- Howard C. Berkowitz 5012 25th Street South Arlington VA 22206 (703)998-5819 voice (703)998-5058 fax (alas, sometimes poorly operated by "helpful" cat)

1 0

SANOG III Announcement
by Joe Abley 05 Oct '03

05 Oct '03

> South Asian Network Operators Group (SANOG) III Annoucement > > SANOG III: 15-22 January, 2004, Bangalore, India > > SANOG III will be colocated with the South Asian IPv6 Summit in the > silicon city of India. As in the past, the SANOG program will feature > workshops, tutorials and presentations on operational areas of interest > to the South Asian Internet community. The meeting will be hosted by > IPv6 Forum India. The program structure will be as follows > > 15-18 January, 2004 -- Workshops > 19-20 January, 2004 -- Tutorials > 21-22 January, 2004 -- SANOG Meeting / IPv6 Summit > > We welcome presentations during the Meeting. We would like to hear > about your own experiences and research on making sure the Internet > works the way it is intended to. > > Please write to gaurab at lahai.com with your expression of interest. > More information at www.sanog.org

1 0

Re: Is there anything that actually gets users to fix their computers?
by Mike Nice 05 Oct '03

05 Oct '03

We created a set of RAS filters that we can call up in the user's RADIUS record - Block ICMP request, Block SMTP outgoing, etc. When the user has a virus we just set the filter. They can still get on without doing any damage, yet still download fixes, etc. They might call if they need to use SMTP instead of webmail. > ----- Original Message ----- > > > Short of turning off their network access, why won't users fix > > > their computers when the computer is infected or needs a patch?

1 0

RE: VeriSign Capitulates
by JC Dill 05 Oct '03

05 Oct '03

At 07:17 AM 10/4/2003, St. Clair, James wrote: > I would add that what you perceive as a "diverse group" is still a >realtively small sub-set of all the internet operations. Be that as it may, this group is *anything* but "close knit". This is as unified as I've seen nanog participants on any matter (technical or otherwise) over the years that I've been on nanog. That alone speaks volumes about the "technical community's general opinion" of Verisign's actions in this matter. jc

2 1

Wildcards gone here
by Christopher X. Candreva 05 Oct '03

05 Oct '03

Looks like Verisign has the wildcards out. The following is without any bind patches. [westnet]:~$ date Sat Oct 4 20:46:09 EDT 2003 [westnet]:~$ host www.opensrsS.net Host not found. Whoo Whoo Whoo Whooo ! ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

2 1

Correction requested: VeriSign
by William Allen Simpson 04 Oct '03

04 Oct '03

-------- Original Message -------- Date: Sat, 04 Oct 2003 14:52:37 -0400 To: nytnews(a)nytimes.com Re: http://www.nytimes.com/2003/10/04/technology/04WEB.html Today, ELIZABETH OLSON relied upon press releases to write an article about the VeriSign hijacking of the .com and .net domain name spaces. The article contains a number of errors and misconceptions. These are not "anecdotal and isolated issues". Network security monitors raised the alarm worldwide during the day, many hours before VeriSign admitted that they had made the change without any advance notice to network operators (in a message to NANOG by "Matt Larson <mlarson(a)verisign.com> Mon, 15 Sep 2003 19:24:29 -0400"). This action caused a valid technical Domain Name System (DNS) response to disappear. That response is widely expected by software deployed over 20 years. The difficulties with wildcards in the DNS has been under discussion for many months (and years) within the Internet Engineering community. VeriSign should have known that this action would be a technical error that would adversely affect the entire world. The result was a meltdown at many smaller internet providers, saturated links, overloaded mail servers, and lost mail. By extension, this cost network operators worldwide hundreds of millions of dollars per day. It should come as no surprise that there are now lawsuits seeking class action status. Surprisingly however, that was not mentioned in this article. Nor is this "whether managing the Internet will be allowed to become more commercial". VeriSign does not manage the Internet. VeriSign is under contract with public entities (that do manage the Internet) to register domain names as a public trust. They violated that trust. This is not "innovation". This is Fisk and Gould attempting to corner the market. Although contacting a paid VeriSign spokesperson is obviously easier than research among a diverse group of network operators, this leads to a rather one-sided view. In the future, the New York Times might consider using Internet resources, such as email, to contact competent persons. In addition to ICANN, the Internet Architecture Board (IAB) and/or the North American Network Operators Group (NANOG) are some places that such technical assistance might be available. -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

1 0

Re: David McGuire's VeriSign article from 10/4/03 Page E01
by Owen DeLong 04 Oct '03

04 Oct '03

An open letter to the Ombudsman at the Washington Post Please also forward to David McGuire I would like to correct some errors of fact and some potentially erroneous perceptions conveyed in Mr. McGuire's article. I would appreciate it if Washington Post would correct these in a subsequent article. Perception: 1. There is no reason to believe that turning off the wildcard records in the DNS is a temporary move. ICANN has said that if there is significant evidence that these changes are not doing harm to the internet (they most definitely are), they would consider making changes to allow them to be turned back on. 2. Verisign initiated the changes without notice to ICANN, IETF, or the community at large. ICANN is, essentially, the top-level authority in such matters. IETF is the body entrusted with the engineering, design, and specifications development for the internet through the RFC process. 3. Verisign was politely asked to stop breaking the internet by ICANN quite some time before this demand letter. Verisign chose to refuse that request. Facts: 1. Verisign changed the behavior of a critical component of Internet infrastructure without hearing, notice, or even a heads up to the community until after it was implemented and the public outcry began. ICANN, while, not holding a formal hearing prior to this action, did solicit community input and review from the various organizations responsible for these issues. ICANN has not asked Verisign to change a functional part of the internet, but, to undo the changes Verisign made without hearing. This is not unreasonable and shouldn't require a hearing process that the changes didn't go through in the first place. 2. This is just the latest in a string of abuses by Verisign of their position in control of these aspects of the namespace. 3. The engineers and scientists you refer to as a close-knit group are anything but. We are a very diverse group of people from an even more diverse set of geographies. There are a number of different organizations which contain various fragments of this group, but, to my knowledge, not a single one which contains all of us. In general, our agendas are so diverse that we have tremendous trouble coming to consensus on even basic things such as the minimum IP allocation boundary. In reality, this move angered virtually everyone running any operational part of the Internet. This is the most united I have _EVER_ seen the operational portion of the Internet Community. Some further information for your consideration: 1. The Site Finder service isn't about helping lost internet users. It's about hijacking typos for profit. Verisign is trying to line it's profits while preventing others from providing similar services. Currently, an ISP can capture NXDOMAIN responses at the resolver level and, (although few do, and, most would think this was as bad as Verisign's move), redirect it to their own error handling servers. Even if an ISP does this, however, users have the option of configuring other resolvers to get their DNS services from. With Verisign placing these wildcards in the top-level zone files they have disabled this NXDOMAIN functionality for everyone. This prevents mail servers from verifying that a sender domain (or even a recipient domain) even actually exists (they all do according to DNS with the wildcard). 2. Verisign can claim that the claims are overblown all they want. They are actually mostly understated. Verisign had no right to make this change to critical infrastructure which they are operating in the public trust. The key problem here is that Verisign seems to think they own that and it is theirs to do with as they wish. The reality is that it is held in the public trust by ICANN and it's stewardship is contracted out to Verisign. 3. The statement that there is no data to indicate the core operation of DNS or the stability of the Internet has been adversely affected is a very carefully chosen set of words. While it is technically true, it creates a very different impression from what it actually says. The impression it intends to create is that there is no evidence that this broke anything. In fact, it broke quite a number of things. It did not break DNS per se, but, it did change one functional aspect of DNS in a way that was incompatible with existing systems implementations (it didn't break DNS, but, it broke several things that depend on DNS). The "stability of the internet" can be said to relate specifically to the ability to forward packets from one host to another. While it didn't impact this ability, it did affect a number of applications in an adverse manner. 4. ICANN is using anecdotal and isolated issues -- This is a most specious claim. ICANN is using real reports of real damage to functioning systems on the internet from real operators of those facilities. Sure, that's annecdotal, but, it's also annecdotal if a patient tells a doctor on the phone that his wrist has been cut and he is bleeding profusely. No rational doctor would tell this patient not to call an ambulance. No rational person in ICANNs position would not tell Verisign to undo this change post haste. 5. Verisign's claim that this is an attempt to regulate non-registry services is also untrue. The contents of the DNS zone files for the top level .com and .net zones is very much a registry service. Placing stuff in there that does not serve the public trust for which those files are contracted is very much a non-registry service, and, such things don't belong in those zone files. ICANN does not care what non-registry services Verisign wants to provide. ICANN does care about damaging polution being added to the DNS namespace by the company entrusted as a registry to manage that namespace. ICANNs right to regulate that is anything but dubious, and, Verisigns claims that it is dubious are an obvious attempt to hijack this power for yet more abuse of their contract privileges. The issues are not isolated, they are wide spread. In summary, I ask you to print an appropriate update to the facts of Mr. McGuire's piece. I ask you to check your facts and examine the situation better in order to present a less biased approach to stories about the internet in the future. I realize that because the internet operational community is so diverse it is hard to find a "spokesman". I also understand that it is easy to find the chosen spokesperson for Verisign. However, I believe that as reporters, especially for an institution like the Washington Post, you have an obligation to put in the effort to find a sampling of communities that have no designated spokespeople so that you can get their side of the story as well. In short, I don't think Mr. McGuire's biases in this article are the result of malice, but, I think they demonstrate a certain amount of laziness and nonfeasance of his journalistic responsibilities. Sincerely, Owen DeLong owen(a)delong.com P.S. The other email address I sent this to is a list which contains some portion of the North American Operations community. It might be a good resource for further comment/investigation on these issues.

1 0

Anyone from optonline.net around?
by Drew Weaver 04 Oct '03

04 Oct '03

Hit me off list please. -Drew

1 0

RE: VeriSign Capitulates
by St. Clair, James 04 Oct '03

04 Oct '03

I would add that what you perceive as a "diverse group" is still a realtively small sub-set of all the internet operations. As Owen points out, the unstated message is a group of "geeks behind the scene" (my words) ended something the great Verisign was doing for the benefit of all netizens. Shame on you.. :-) -----Original Message----- From: Owen DeLong To: Allen McRay; nanog(a)merit.edu Sent: 10/3/2003 5:47 PM Subject: RE: VeriSign Capitulates Verisign press releases have never been about the facts. Instead it's about trying to manipulate public perception to their side. Verisign has never expressed any actual concern or even care about how much damage their actions do to the internet. Any expectation that this would change in this circumstance is an act of optimism or stupidity. I only hope that the press in question will be made aware of the truth of these matters and publish that information. Otherwise, you may be faced with a situation where the DOC asks ICANN why they caved to such a small special interest group's pressure. Owen --On Friday, October 3, 2003 15:43 -0500 Allen McRay <amcray(a)amcray.net> wrote: > > Outside of one other person on this list, I know no one else personally, > so where do they come up with the "close-knit" stuff? I thought that > most of the traffic I have monitored, re: this topic, has come from a > very diverse and rather large group of people from all around the world > who have been trying to say is that what VeriSign has done has caused > problems in their area of expertise, in their businesses, and for the > public in general. Also seen a lot of proof posted along with the > comments..... > > I might also mention, I understand the technology "underpinning" the > internet.... it's the attempted abuse of power by individuals and > organizations like VeriSign that I can't go along with.... > > Allen > >> VeriSign also angered the close-knit group of engineers and scientists >> who are familiar with the technology underpinning the Internet. They >> say that Site Finder undermines the worldwide Domain Name System, >> causing e-mail systems, spam-blocking technology and other >> applications to malfunction. > > >

1 0