Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Steven J. Sobol
On Wed, 27 Apr 2005, Owen DeLong wrote: What's rDNS for the ip address(es) assigned to you? I don't know about him, but, on my ADSL connection, it is controlled by my nameservers: ;; ANSWER SECTION: 10.159.192.in-addr.arpa. 86400 IN NS ns.rop.edu. 10.159.192.in-addr.arpa.

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
Ah, but *you* wouldn't get blocked. You maintain your own rDNS and presumably have enough clue to not make the rDNS look like a pool of dynamic residential IPs that aren't terribly important. To wit: Um, that's not what I thought this discussion was about. I thought this discussion was about ISPs

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Mark Newton
On Thu, Apr 28, 2005 at 02:16:36AM -0400, Steven J. Sobol wrote: Any IP that a provider allows servers on should have distinctive, non-dynamic-looking DNS (and preferably be in a separate netblock from the dynamically-assigned IPs). What the hell is a non-dynamic-looking DNS? Sure, if

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Iljitsch van Beijnum
On 27-apr-2005, at 20:08, Dan Hollis wrote: I can definitely say worms, trojans, spam, phishing, ddos, and other attacks is up several orders of magnitude in those 20 years. Malicious packets now account for a significant percentage of all ip traffic. Eventually I expect malicious packets will

Re: using TCP53 for DNS

2005-04-28 Thread Nils Ketelsen
Patrick W. Gilmore wrote: In the thread about ns*.worldnic.com, many people were complaining about DNS responses/queries on TCP port 53. At least one DoS mitigation box uses TCP53 to protect name servers. Personally I thought this was a pretty slick trick, but it appears to have

Re: Paul Wilson and Geoff Huston of APNIC on IP address allocation ITU v/s ICANN

2005-04-28 Thread Stephane Bortzmeyer
On Wed, Apr 27, 2005 at 08:52:04PM +, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote a message of 49 lines which said: the only entities that can be members are nations/governments. This is no longer true (for several years). Corporations (Sector members) can now join (ITU is the only UN

Re: Paul Wilson and Geoff Huston of APNIC on IP address allocation ITU v/s ICANN

2005-04-28 Thread Alex Bligh
--On 28 April 2005 10:47 +0200 Stephane Bortzmeyer [EMAIL PROTECTED] wrote: This is no longer true (for several years). Corporations (Sector members) can now join (ITU is the only UN organization which does that). See http://www.itu.int/cgi-bin/htsh/mm/scripts/mm.list?_search=SEC I think Bill

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Dan Hollis
On Thu, 28 Apr 2005, Iljitsch van Beijnum wrote: The problem is that the maliciousness of packets or email is largely in the eye of the beholder. How do you propose ISPs determine which packets the receiver wants to receive, and which they don't want to receive? (At Mpps rates, of

Re: Paul Wilson and Geoff Huston of APNIC on IP address allocation ITU v/s ICANN

2005-04-28 Thread Scott W Brim
On 4/28/2005 05:00, Alex Bligh allegedly wrote: I think Bill is actually correct. ITU is a treaty organization. Only members of the UN (i.e. countries). ITU-T (and ITU-R, ITU-D) are sector organizations that telcos can join (AIUI the difference having arisen when a meaningful difference arose

RE: Schneier: ISPs should bear security burden

2005-04-28 Thread Olsen, Jason
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Hollis To: Owen DeLong Subject: Re: Schneier: ISPs should bear security burden You must not have used it much in those 20 years. I can definitely say worms, trojans, spam, phishing, ddos, and

Re: Paul Wilson and Geoff Huston of APNIC on IP address allocation ITU v/s ICANN

2005-04-28 Thread Alex Bligh
--On 28 April 2005 07:06 -0400 Scott W Brim [EMAIL PROTECTED] wrote: I think Bill is actually correct. ITU is a treaty organization. Only members of the UN (i.e. countries). ITU-T (and ITU-R, ITU-D) are sector organizations that telcos can join (AIUI the difference having arisen when a meaningful

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Adi Linden
Hey, if you've got customes willing to shell out for that, then more power to you. However, I'm not (and won't be) one of those customers. I'm willing to take responsibility for protecting my systems and choosing what traffic I do and don't want. I don't want someone else doing it for me.

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Adi Linden
As somebody who picked a DSL provider specifically because it allows me to run any kind of server I want, I'm not highly in favor of blocking traffic from broadband users and killing the end-to-end principle that makes the Internet work, When I sign up for an internet account, does the fine

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Iljitsch van Beijnum
On 28-apr-2005, at 15:53, Adi Linden wrote: Hey, if you've got customes willing to shell out for that, then more power to you. However, I'm not (and won't be) one of those customers. I'm willing to take responsibility for protecting my systems and choosing what traffic I do and don't want. I

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Iljitsch van Beijnum
On 28-apr-2005, at 16:01, Adi Linden wrote: When I sign up for an internet account, does the fine print say that I am to accept all garbage pouring out of the RJ-45...? Why should it be the recipients job to filter all incoming traffic? Because by definition the recipient is the party who

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Adi Linden
And how exactly does that translate to the online world? It doesn't. There is none or very little punishment for lawlessness and missbehaviour in the online world. Despite the safety and environmental regulations and the fact that you have to have a driver's license and insurance (at least

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Adi Linden
And what about garbage pouring out of RJ-11 sockets? Hmmm... so because we have garbage coming out of the RJ-11 we might as well have garbage coming out of the RJ-45, too? 4 wires vs. 8 wires, twices the garabe out of the RJ-45. So I do I obtain your permission to send you a packet? By

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Steve Sobol
Mark Newton [EMAIL PROTECTED] wrote: On Thu, Apr 28, 2005 at 02:16:36AM -0400, Steven J. Sobol wrote: Any IP that a provider allows servers on should have distinctive, non-dynamic-looking DNS (and preferably be in a separate netblock from the dynamically-assigned IPs). What the

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Valdis . Kletnieks
On Thu, 28 Apr 2005 16:10:54 +0200, Iljitsch van Beijnum said: And where in the packet does it show that the packet comes from someone who has said permission? Well, if you didn't have permission, you're probably up to no good and should be setting the appropriate bits as per RFC3514

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Valdis . Kletnieks
On Thu, 28 Apr 2005 16:38:00 +0930, Mark Newton said: Just wait'll we start getting unicode DNS names in non-English alphabets. Perhaps then you can tell what to look for in a string of Kanji symbols which might be suggestive of the concept of static. We may not even have to wait that long,

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Valdis . Kletnieks
On Thu, 28 Apr 2005 09:01:26 CDT, Adi Linden said: When my PC grabs an IP address, I'd expect to see zero traffic from the world unless I make a request for content. Only then should I see traffic and only the content I requested. Remember - the RST packet is there so you can tell the other

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread James Baldwin
On 27 Apr 2005, at 17:51, Pakojo Samm wrote: Give me a *clear* unobstructed line (that stays up) at the cheapest price please. Your attitude is very much the norm, however your requirements on connectivity are more stringent. All customers want unobstructed access and, we as an ISP, want to

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Iljitsch van Beijnum
On 28-apr-2005, at 16:21, Adi Linden wrote: So I do I obtain your permission to send you a packet? By replying to my request. So ask your ISP to NAT you. (Most people do this themselves but you seem to feel filtering out unwanted packets isn't something you want to do.) You won't receive any

BT to offer six classes of service

2005-04-28 Thread Fergie (Paul Ferguson)
It will be interesting to see how this develops. BT to offer six classes of service http://www.techworld.com/networking/news/index.cfm?newsid=3574 - ferg -- Fergie, a.k.a. Paul Ferguson Engineering Architecture for the Internet [EMAIL PROTECTED] or [EMAIL PROTECTED] ferg's tech blog:

FCC To Require 911 for VoIP

2005-04-28 Thread Fergie (Paul Ferguson)
A rather important turn of events. http://www.newsfactor.com/story.xhtml?story_id=33733 - ferg -- Fergie, a.k.a. Paul Ferguson Engineering Architecture for the Internet [EMAIL PROTECTED] or [EMAIL PROTECTED] ferg's tech blog: http://fergdawg.blogspot.com/

Re: Paul Wilson and Geoff Huston of APNIC on IP address allocation ITU v/s ICANN

2005-04-28 Thread Doug Barton
Stephane Bortzmeyer wrote: So, like ICANN, governements and big corporations are represented at the ITU. Like ICANN, ordinary users are excluded. I think groups like the Non-Commercial Users Constituency (http://gnso.icann.org/non-commercial/) and the At Large Advisory Committee

Re: BT to offer six classes of service

2005-04-28 Thread Fergie (Paul Ferguson)
Additionally: BT picks partners for network upgrade http://news.com.com/BT+picks+partners+for+21st+Century+Network/2100-1037_3-5688447.html - ferg -- Fergie (Paul Ferguson) [EMAIL PROTECTED] wrote: It will be interesting to see how this develops. BT to offer six classes of service

Re: Paul Wilson and Geoff Huston of APNIC on IP address allocation ITU v/s ICANN

2005-04-28 Thread Iljitsch van Beijnum
On 28-apr-2005, at 19:20, Michael Froomkin - U.Miami School of Law wrote: I think the non-commercial users constituency would agree ordinary users are excluded. Well, I only ever attended one ICANN meeting but it did strike me that the attendees were very concerned about getting regular

Re: PAIX Outages

2005-04-28 Thread Richard A Steenbergen
On Wed, Apr 27, 2005 at 10:45:15AM -0400, Jay Patel wrote: I have heard rumors that SD has been having persistent switch problems with their switches at PAIX (Palo Alto), and I was kind of wondering if anyone actually cared? Personally I tend to suspect the general lack of uproar is a

Re: PAIX Outages

2005-04-28 Thread Leo Bicknell
In a message written on Thu, Apr 28, 2005 at 01:51:54PM -0400, Richard A Steenbergen wrote: Personally I tend to suspect the general lack of uproar is a rather unfortunate (for them) sign that PAIX is no longer relevant when it comes to critical backbone infrastructures. That, or a sign

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Petri Helenius
Adi Linden wrote: Its not up to the ISP to determine outbound malicious traffic, but its up to the ISP to respond in a timely manner to complaints. Many (most?) do not. If they did their support costs would explode. It is block the customer, educate the customer why they were blocked,

Federal Security Bureau asks for more authority to control Internet

2005-04-28 Thread Sean Donelan
http://en.rian.ru/russia/20050428/39757635.html The Federal Security Service proposes setting new rules for Internet providers so that it could prevent the spread of extremist ideas, track down illegal online operations, and get access to databases with mobile telephone subscribers' details

Re: Internet email performance study

2005-04-28 Thread aljuhani
- Original Message - From: Robert Beverly [EMAIL PROTECTED] To: nanog@merit.edu Cc: [EMAIL PROTECTED] Sent: Thursday, April 28, 2005 22:21 Subject: Internet email performance study Hi, (we previously posted this on the e2e mail list; apologies if you are reading it for the second

Re: Internet email performance study

2005-04-28 Thread Robert Beverly
On Thu, Apr 28, 2005 at 11:21:07PM +0300, aljuhani wrote: Another possiblity is that the domains you are monitoring are on dynamic IP addresses that changes all the time and the gap when they become non-responsive could be due to delay in updating the DNS roots with new IP address. Also

RE: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
Correct... Measuring reliability in terms of what's around that isn't success is not a valid method of measurment. One must measure the success rate. Does anyone really believe that they are more likely to encounter a timeout or connection drop today than 5, 10, 15, or even 20 years ago? I

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
Hmmm... when you're driving on a public street there is certain safety equipment you are required to have and use. You're paying more for your vehicle because of seatbelts, airbags and all the other things that are supposed to lessen the impact of an accident. Even if you're an expert driver,

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
When I sign up for an internet account, does the fine print say that I am to accept all garbage pouring out of the RJ-45...? Why should it be the recipients job to filter all incoming traffic? No... You should, for an appropriate fee, be able to find an ISP that will filter whatever you

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
If they did their support costs would explode. It is block the customer, educate the customer why they were blocked, exterminate the customers PC, unblock the customer. No doubt there'll be a repeat of the same in short time. On a cost basis, it should be: + block the

Re: Internet email performance study

2005-04-28 Thread aljuhani
On Thu, Apr 28, 2005 at 23:42, Robert Beverly [EMAIL PROTECTED] ..snip Yes, our SMTP greetings are valid and up to spec. Again, it's the non-deterministic loss that we're most concerned about. If there were a problem with the SMTP exchange, we would see our emails always rejected (for

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
On 28 Apr 2005, at 00:55, Owen DeLong wrote: Who are you to decide that there is no damage to blocking residential customers? The customer makes the decision when they subscribe to a service whether or not filtered service will meet their needs. Who are you to decide that unfiltered

Fw: Internet email performance study

2005-04-28 Thread aljuhani
Hi. Sorry there was a mistake in my previous post the subnet listed is 218.0.0.0/8 is not yours. thanks aljuhani - Original Message - From: aljuhani [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 29, 2005 00:53 Subject: Re: Internet email performance study On Thu, Apr

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread John Dupuy
At 04:17 PM 4/28/2005, you wrote: Hmmm... when you're driving on a public street there is certain safety equipment you are required to have and use. You're paying more for your vehicle because of seatbelts, airbags and all the other things that are supposed to lessen the impact of an accident.

Re: Internet email performance study

2005-04-28 Thread Crist Clark
aljuhani wrote: On Thu, Apr 28, 2005 at 23:42, Robert Beverly [EMAIL PROTECTED] ..snip Yes, our SMTP greetings are valid and up to spec. Again, it's the non-deterministic loss that we're most concerned about. If there were a problem with the SMTP exchange, we would see our emails always

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
--On Thursday, April 28, 2005 12:18 PM -0400 James Baldwin [EMAIL PROTECTED] wrote: On 28 Apr 2005, at 11:51, [EMAIL PROTECTED] wrote: It would seem that relocating the costs of doing extra (filtering, etc) *should* be passed on to the people who necessitated the extra handling by

Re: FCC To Require 911 for VoIP

2005-04-28 Thread Owen DeLong
Someone should show them some of the 802.11 based cellular-like SIP phones and ask them how exactly they plan to get good geolocation data for 911 on those and the soft-phone in my laptop. Who exactly will I be talking to when I dial 911 from an internet cafe in Puerto Vallarta through my Virgina

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread william(at)elan.net
On Thu, 28 Apr 2005, John Dupuy wrote: But this analogy breaks down on so many levels, so I recommend not using it. The street system is a government controlled monopoly and...well lets not use this analogy. If you really want some analogy for Internet independent of the telecom sector or

Re: Schneier: ISPs should bear security burden

2005-04-28 Thread Owen DeLong
In my own opinion, I would not expect a transit provider to filter anything other than my BGP announcements. However, I would expect my ISP to filter a possible worm infection port(s), as it would completely saturate my lowly-end-user datapipe if they did not, making network access worthless,

Re: FCC To Require 911 for VoIP

2005-04-28 Thread Fergie (Paul Ferguson)
That's a good suggestion. :-) There's another article today on Advanced IP Pipleine that openswith the statement: So far, new FCC chairman Kevin Martin isn't long on solutions -- in fact, he's becoming part of the problem. http://www.advancedippipeline.com/161601652 I prefer to remain

Re: FCC To Require 911 for VoIP

2005-04-28 Thread Iljitsch van Beijnum
On 29-apr-2005, at 0:17, Owen DeLong wrote: Someone should show them some of the 802.11 based cellular-like SIP phones and ask them how exactly they plan to get good geolocation data for 911 on those and the soft-phone in my laptop. Who exactly will I be talking to when I dial 911 from an

Re: Internet email performance study

2005-04-28 Thread Crist Clark
Brad Knowles wrote: At 3:05 PM -0700 2005-04-28, Crist Clark wrote: http://www.albury.net.au/netstatus/derouted.html No, it doesn't. Please read their paper. In the paper and as he stated again in the response above, their definition of a loss requires the message to be delivered successfully

Re: PAIX Outages

2005-04-28 Thread Richard A Steenbergen
On Thu, Apr 28, 2005 at 02:11:40PM -0400, Leo Bicknell wrote: In a message written on Thu, Apr 28, 2005 at 01:51:54PM -0400, Richard A Steenbergen wrote: Personally I tend to suspect the general lack of uproar is a rather unfortunate (for them) sign that PAIX is no longer relevant when it

Re: FCC To Require 911 for VoIP

2005-04-28 Thread Mark Owen
Slashdotted http://yro.slashdot.org/article.pl?sid=05/04/28/1938239 A few good arguments there On 4/28/05, Fergie (Paul Ferguson) [EMAIL PROTECTED] wrote: A rather important turn of events. http://www.newsfactor.com/story.xhtml?story_id=33733 - ferg -- Fergie, a.k.a. Paul Ferguson

Re: FCC To Require 911 for VoIP

2005-04-28 Thread Owen DeLong
You're absolutely right. I submit that if the US government wants location information for VoIP 911 calls, they should create an infrastructure that allows people to determine their location. Your example shows that this infrastructure should also be available outside the US. Maybe a

Re: Federal Security Bureau asks for more authority to control Internet

2005-04-28 Thread Dave Crocker
There should be compulsory registration of mobile phone users with Internet connectivity. does this mean that someone who does not use a mobile phone, normally, must register before borrowing one to make a single call? (you said user, not instrument, so i'm assuming the answer is yes.)