- Test - lists.nanog.org

If Verisign wants to cooperate
by E.B. Dreger 21 Sep '03

21 Sep '03

I realize this thread had gotten long, but thought I'd pitch the following idea: ; TLD $ORIGIN com. * IN NS ns.wildcard.invalid. $ORIGIN wildcard.invalid. ns IN A 1.2.3.4 ; NSI default Make no mistake, I'd much rather have the wildcard eradicated. Until that happens (who says I'm not a foolish optimist?), the above would allow NetSol to run SiteFinder _and_ make it easier for providers to override via a single zone. People have expressed concern over NetSol circumventing current resolver patches using glue. They could employ the same tactics to simplify the sifting. Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

More .com/.net issues
by Steve Atkins 21 Sep '03

21 Sep '03

I'm seeing bulk access to .com and .net blocked at the moment. Other zones are available from Verisigns ftp server as usual, but .net and .com are empty (and the signature files are listing them as empty too). Anyone heard anything from Verisign about this? Cheers, Steve -- -- Steve Atkins -- steve(a)blighty.com

1 0

Re: Worst design decisions?
by jlewis＠lewis.org 21 Sep '03

21 Sep '03

The off-topic nanog thread that won't die (where are the topic police?...never around when you need one)...and then just when you think it has died, some member's virus infected Microsoft Windows PC (hey is that redundant?) replies to you with the thread's subject and no body other than a virus attachment, even though you never replied (on-list) to the thread. Whoever you are, do everyone a favor and turn off your PC. Received: from speedbd.speedbd.net (212-165-128-186.reverse.newskies.net [212.165.128.186] (may be forged)) by sloth.lewis.org (8.11.6/8.11.6) with SMTP id h8L7A4P09167 for <jlewis(a)lewis.org>; Sun, 21 Sep 2003 03:10:19 -0400 My vote for worst design decision? Easy. Lookout Virus Express. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Re: ICANN - Formal Complaint re Verisign
by David Lesher 21 Sep '03

21 Sep '03

Geotrust is not Verislime, but they *are* Choicepoint. If you don't know who Choicepoint is; well, they vacuum up your personal data and resell it to all comers. Google on "Choicepoint FTC" for a rundown. Sort of John Poindexer's version of Halliburton......a private sector Big Brother. I regard Verislime vs Choicepoint as like Joey ("The gang that couldn't shoot straight..") Leonand's outfit vs. the Colombian mobs. Sigh, I'll be sticking with Verislime for buying certs, I guess. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: Providers removing blocks on port 135?
by Miquel van Smoorenburg 21 Sep '03

21 Sep '03

In article <cistron.Pine.LNX.4.44.0309202021530.25380-100000(a)bubba.numbnuts.net>, Justin Shore <listuser(a)numbnuts.net> wrote: >Now I'm going to get even more off-topic. It occurs to me that major >changes to a protocol such as SMTP getting auth should justify utilizing a >different tcp/ip port. Think about it like this. If authenticated forms >of SMTP used a different TCP/IP port we netadms could justify leaving that >port open on these same dynamically assigned netblocks in the theory that >they are only able to connect to other authenticated SMTP services. >Doesn't that seem logical? That's not exactly a new idea. http://www.faqs.org/rfcs/rfc2476.html (december 1998). Mike.

1 0

Re: VeriSign SMTP reject server updated
by Paul Vixie 21 Sep '03

21 Sep '03

> Is it possible for the client resolver code to distinguish between a > wildcard answer and an explicit answer? no. > If this was available, it would mail clients and other things > interested in the specific domain name could get the answers they > want. While other stuff would get the wildcard answers. right.

7 7

Verisign vs ICANN
by Len Rose 21 Sep '03

21 Sep '03

I don't think anyone holds Matt personally responsible for what has happened so please remember that when responding. Verisign has broken everything and unlike the success of their grandfathered monopoly on registrations this might spell the end of their reign over these zones. This has broken the net, an intense attack on the domain name system would probably have had less impact than the havoc Verisign has caused with their point everything to Verisign hack. I'd think this was very irresponsible behaviour, and conjures up shades of past ghosts (does anyone remember CORE?) if I were an oversight authority I'd be very incredibly pissed off right about now. (stupid question) Doesn't the IAB have any authority left? It's interesting that now ICANN -- perhaps for the first time ever -- might be in the position to do something positive and prove it's not all about backroom politics. It's also ironic that someone would have had to spend years in prison for doing what they've done with or without notice or malicious intent. When people are running around hacking new code into BIND, several MTAs, and bog knows what else you can't say you didn't break anything. Throwing up piles of servers and network equipment to be able to respond to garbage IP traffic because you're aiming the world at your network isn't particularly intelligent either but what do I know about it? Len

6 6

Re: Any actual data to back up blocking Netbios ports?
by Sean Donelan 21 Sep '03

21 Sep '03

On Sat, 20 Sep 2003, Dan Hollis wrote: > I'd like to see actual numbers I'm willing to be proved wrong. Go ahead.

2 2

Appreciation for Bind patches
by Andrew Fried 21 Sep '03

21 Sep '03

I have been following the various threads relating to Verisign and wanted to make one comment that I feel has been missing. Simply put, I would like to publicly express my appreciation to Mr. Vixie for taking the time to add the "root-delegation-only" patch for Bind. I'm fairly new to NANOG, but I'm sure that others beside myself also feel a thank you is appropriate. Andrew Fried, Senior Special Agent United States Department of the Treasury Treasury Inspector General for Tax Administration Strategic Enforcement Division 5000 Ellin Road, Room C8-100 Lanham, MD 20706 202-283-5915 Office 703-980-0091 Mobile email: afried(a)cis.fed.gov

4 3

Bind 8 and delegation only ?
by John Brown 21 Sep '03

21 Sep '03

Is there any work being done on adding this support to BIND 8 ??

1 0