Re: Email Server and DNS

2013-11-04 Thread David Conrad
On Nov 4, 2013, at 8:41 AM, Franck Martin wrote: > www.maawg.org has published a sender BCP, please read it You mean http://www.maawg.org/sites/maawg/files/news/MAAWG_Senders_BCP_Ver2a-updated.pdf? Regards, -drc signature.asc Description: Message signed with OpenPGP using GPGMail

Re: RPKI and Trust Anchor question

2013-08-06 Thread David Conrad
5, 2013, at 3:22 PM, Barbara Roseman wrote: > I think David meant 2006, not 1996. > > -Barb Roseman > > On 8/5/13 12:08 PM, "David Conrad" wrote: > >> Actually, ICANN had an RPKI pilot in operation back in 1996 or so. For >> political reasons (as far as I c

Re: RPKI and Trust Anchor question

2013-08-05 Thread David Conrad
Actually, ICANN had an RPKI pilot in operation back in 1996 or so. For political reasons (as far as I can tell), the RIRs refused to let ICANN/IANA play. Unless the RIRs are willing to accept ICANN/IANA as the root TA as recommended by the IAB, ICANN can't move forward. Regards, -drc Mobi

Re: ARIN WHOIS for leads

2013-07-26 Thread David Conrad
Patrick, On Jul 26, 2013, at 8:40 AM, Patrick W. Gilmore wrote: >> Err. ICANN isn't a membership organization. It is possible to change things >> at ICANN, but the mechanisms are ... different and much slower (since it >> involves getting consensus in a multi-stakeholder environment). > > Sure

Re: ARIN WHOIS for leads

2013-07-26 Thread David Conrad
On Jul 26, 2013, at 7:58 AM, "Patrick W. Gilmore" wrote: > You can change anything you want. ARIN & ICANN are both member organizations. > Propose a change, get the votes, and POOF!, things are changed. Err. ICANN isn't a membership organization. It is possible to change things at ICANN, but th

Re: One of our own in the Guardian.

2013-07-14 Thread David Conrad
On Jul 14, 2013, at 11:12 AM, shawn wilson wrote: > You're on a continent with the second least amount of light pollution > of all of the continents on earth (iirc) and are somehow surprised > about bad net access? Africa is not homogeneous. > I would question the wisdom of planning a tech > con

Re: One of our own in the Guardian.

2013-07-14 Thread David Conrad
On Jul 14, 2013, at 6:50 AM, Mark Seiden wrote: > and here i am in the icann-selected hotel for the icann conference, and they > gave us a total of 500MB of metered usage. Trust me, the 500MB limit (per day, and resettable if you go down to the front desk and request more) is the least of you

Re: Paetec PI space?

2013-06-26 Thread David Conrad
Jon, On Jun 26, 2013, at 12:17 PM, Jon Lewis wrote: >>> We have a customer who was assigned some PI IPv4 space by Paetec back in >>> mid-90's >> They should plan to renumber out of that space in the very near future. It'd be nice for routing system hygiene, but there probably is no requirement

Re: Paetec PI space?

2013-06-26 Thread David Conrad
Joe, On Jun 26, 2013, at 11:18 AM, Joe Abley wrote: >> We have a customer who was assigned some PI IPv4 space by Paetec back in >> mid-90's > I think it's correct to say that the only entities that can assign PI IPv4 > space are RIRs and the IANA. Nope. Historically, there was no distinction

Re: Need help in flushing DNS

2013-06-19 Thread David Conrad
On Jun 19, 2013, at 11:23 PM, Jimmy Hess wrote: > On 6/20/13, Paul Ferguson wrote: >> On Wed, Jun 19, 2013 at 10:44 PM, Tom Paseka wrote: >>> On Wed, Jun 19, 2013 at 10:32 PM, Patrick W. Gilmore > I think "ztomy.com" smells really bad for some reason, looks like > 100% advertising; IIRC, Conf

Re: Geoip lookup

2013-05-24 Thread David Conrad
I replied privately to Owen, but might as well share: On May 23, 2013, at 11:57 PM, Owen DeLong wrote: True, according to (at least some of) the RIRs they reside in regions... >>> Really? Which ones? I thought they were only issued to organizations that >>> had operations in regions. > Tha

Re: Geoip lookup

2013-05-23 Thread David Conrad
On May 23, 2013, at 10:53 PM, Andreas Larsen wrote: > The whole idea of Geoip is flawed. Sure, but pragmatically, it's an 80% solution. > IP dosen't reside in countries, True, according to (at least some of) the RIRs they reside in regions... Regards, -drc

Re: What hath god wrought?

2013-05-21 Thread David Conrad
On May 20, 2013, at 9:56 PM, Jay Farrell wrote: > Are you certain it was a DoS attempt? And if you were certain, are you certain the folks at DHS were aware their machine(s) were engaged in a DoS attack? You can find zombies in the oddest places... Regards, -drc

Re: "It's the end of the world as we know it" -- REM

2013-04-24 Thread David Conrad
On Apr 24, 2013, at 9:59 AM, Andrew Latham wrote: >> A demand curve would show that as prices increase, there is demand for fewer >> IPv4 addresses. And the other side of the coin: where there is demand and excess supply (e.g., allocated but unused addresses), the price increase would create an

Re: What do people use public suffix for?

2013-04-15 Thread David Conrad
On Apr 15, 2013, at 9:30 AM, Joe Abley wrote: > [...] > If you need the mechanism to work (...) then I can see why fetching and > caching a browser list over SSL (and perhaps shipping with a baseline version > of it) seems attractive. Sounds like this could've been good logic for the use of HOS

Re: public consultation on root zone KSK rollover

2013-04-05 Thread David Conrad
Randy, On Apr 6, 2013, at 7:10 AM, Randy Bush wrote: > at some point, long passed, the more pomp, the less safe i feel. Have you actually watched/participated in a root key signing ceremony? Pomp is not the term I would use. > there > is protecting against technical/engineering threats and

Re: public consultation on root zone KSK rollover

2013-04-05 Thread David Conrad
Brandon, On Apr 4, 2013, at 5:35 PM, Brandon Butterworth wrote: >> You do realize this requires changing validating resolver >> configuration data, right? > > Yes. How hard can it be (answer not required). > > While it's quaint that the elders of the internet meet and bless each > new key I don

Re: public consultation on root zone KSK rollover

2013-04-04 Thread David Conrad
On Apr 4, 2013, at 12:59 AM, Brandon Butterworth wrote: >> The topic at hand and the specific questions that have been >> asked as part of the consultation are important ones; > > Do it when you feel like, nobody should notice. Anything > this important should be routine procedure, make it daily.

Re: Can we not just fix it? WAS:Re: Open Resolver Problems

2013-03-28 Thread David Conrad
On Mar 27, 2013, at 10:11 PM, Michael DeMan wrote: > AsI think as we all know the deficiency is the design of the DNS system > overall. One of the largest DDoS attacks I've witnessed was SNMP-based, walking entire OID sub-trees (with spoofed source addresses) across thousands of CPEs that defa

Re: [c-nsp] DNS amplification

2013-03-20 Thread David Conrad
Randy, On Mar 19, 2013, at 10:53 PM, Randy Bush wrote: > i am not saying bgp and forwarding can deal with growth forever, As I said when I started tilting at this particular windmill, with enough thrust pigs can fly quite well. However, perhaps instead of attaching bigger/hotter/more expensiv

Re: [c-nsp] DNS amplification

2013-03-20 Thread David Conrad
Arturo, On Mar 20, 2013, at 5:32 AM, Arturo Servin wrote: >> For example I know there are enterprises that would like to multihome >> but they find the current mechanism a barrier to this - for a start they >> can't justify the size of PI space that would guarantee them entry to >> the global ro

Re: routing table go boom (was: Re: [c-nsp] DNS amplification)

2013-03-19 Thread David Conrad
Patrick, On Mar 19, 2013, at 12:07 PM, Patrick W. Gilmore wrote: > Which is all just a fancy way of saying you can't fix people being idiots by > changing a protocol, or hardware, or ... well, anything. One of the advantages I see in LISP(-like) solutions is that it allows multi-homing without

Re: [c-nsp] DNS amplification

2013-03-19 Thread David Conrad
Leo, On Mar 19, 2013, at 11:57 AM, Leo Bicknell wrote: > In a message written on Tue, Mar 19, 2013 at 11:33:33AM -0700, David Conrad > wrote: >> LISP doesn't replace BGP. It merely adds a layer of indirection so you don't >> have to propagate identity information

Re: [c-nsp] DNS amplification

2013-03-19 Thread David Conrad
Chris, On Mar 19, 2013, at 11:27 AM, Christopher Morrow wrote: > I also think we don't have to do this 'today', but getting the right > plans in place to migrate in the right direction seems like an ok plan > too. +1 For that plan I personally like the idea of the layer of indirection separati

Re: [c-nsp] DNS amplification

2013-03-19 Thread David Conrad
On Mar 19, 2013, at 11:11 AM, Patrick W. Gilmore wrote: > The demise of BGP from unrestrained table growth has been predicted for > decades. The exhaustion of IPv4 has been predicted for decades. > Part of this is because my million dollar router has a slower central proc > and less RAM than m

Re: [c-nsp] DNS amplification

2013-03-19 Thread David Conrad
Chris, On Mar 19, 2013, at 10:50 AM, Christopher Morrow wrote: >> With enough thrust, pigs fly quite well. Landing can get messy though... > I was being serious... As was I. > put modern hardware to work and it gets simpler. Yes, applying more thrust makes things simpler: all you need is mon

Re: [c-nsp] DNS amplification

2013-03-19 Thread David Conrad
On Mar 19, 2013, at 10:12 AM, Christopher Morrow wrote: > There's nothing inherent in BGP that would not work with an > unconstrained growth of the routing table, right? You just need enough > bandwidth and interrupts to deal with updates. With enough thrust, pigs fly quite well. Landing can ge

Re: using ARIN IP space outside of ARIN region

2013-03-18 Thread David Conrad
On Mar 18, 2013, at 9:41 PM, Matt Palmer wrote: > Which is ironic, because when we recently applied to ARIN for number > resources to support our US operations, we were told to use our APNIC space > instead. That's just the RIRs protecting you from yourself -- after all, everyone knows IP addre

Re: 2013.02.04 NANOG57 day 1 afternoon notes

2013-02-04 Thread David Conrad
Matt, Thanks very much (as always) for the great notes! Extremely helpful. Regards, -drc On Feb 4, 2013, at 3:31 PM, Matthew Petach wrote: > Notes from the afternoon session, including > the community meeting, but minus most of > the BCOP presentation have been posted: > > http://kestrel3.ne

Re: GeekTools Whois Proxy and RIPE/RIPE-NCC

2012-12-31 Thread David Conrad
Rodney, On Dec 31, 2012, at 7:41 AM, Rodney Joffe wrote: > Two weeks ago RIPE-NCC, who provide the whois data for IP addresses in the > RIPE region, informed us that based on decisions by their members, as of > January 1st 2013, tomorrow, they would no longer provide whois proxy query > respon

Re: Advisory — D-root is changing its IPv4 address on the 3rd of January.

2012-12-18 Thread David Conrad
On Dec 17, 2012, at 11:30 PM, ITechGeek wrote: > For anyone who is worried that the root server change might impact them, > they can go to http://www.iana.org/domains/root/files and download the root > zone file. It probably won't need to be updated again until the next round > of gTLDs is approv

Re: Advisory — D-root is changing its IPv4 address on the 3rd of January.

2012-12-15 Thread David Conrad
Nick, On Dec 15, 2012, at 4:45 PM, Nick Hilliard wrote: > On 15/12/2012 23:07, David Conrad wrote: >> The handwringing over this issue is a bit over the top. > It's a question of what's procedurally sensible. Sensible things would > include longer notice of the impendin

Re: Advisory — D-root is changing its IPv4 address on the 3rd of January.

2012-12-15 Thread David Conrad
On Dec 15, 2012, at 2:32 PM, Mark Andrews wrote: > 3 weeks is not a lot of time to inform every recursive service > operator in the world that there is a change coming. Given the impact of the change, I figure 3 weeks is plenty. > Remember nameservers will start logging warning messages as of

Re: Advisory — D-root is changing its IPv4 address on the 3rd of January.

2012-12-15 Thread David Conrad
On Dec 15, 2012, at 2:13 PM, Jared Mauch wrote: > Oh, and you can just download the root zone from > ftp://ftp.internic.net/domain/root.zone ... Or, perhaps more conveniently, zone transfer the root zone from xfr.lax.dns.icann.org or xfr.cjr.dns.icann.org (see http://dns.icann.org/services/axfr

Re: Advisory — D-root is changing its IPv4 address on the 3rd of January.

2012-12-14 Thread David Conrad
On Dec 14, 2012, at 11:02 AM, Joe Abley wrote: > Other root servers have renumbered out of institutional, general-purpose > networks into dedicated networks in the past. I think the last one was B-Root > in 2004, Actually, it was "L" in 2007... :) Regards, -drc

Re: TCP time_wait and port exhaustion for servers

2012-12-05 Thread David Conrad
On Dec 5, 2012, at 2:06 PM, Fred Baker (fred) wrote: > If you want to get into software rewriting, the simplest thing I might come > up with would be to put TCBs in some form of LRU list and, at a point where > you need a port back, close the TCB that least recently did anything. My > understan

Re: carping about CARP

2012-11-30 Thread David Conrad
On Nov 30, 2012, at 5:08 AM, Henning Brauer wrote: > and re IANA, they made it clear they would not give us a proto number As they should have. IANA abides by the rules laid down for it by the IETF/IESG/IAB. The openbsd folks couldn't be bothered to even write up a draft and chose to squat on a

Re: Adding GPS location to IPv6 header

2012-11-25 Thread David Conrad
Please don't feed the bigoted hypocritical trolls. Regards, -drc On Nov 25, 2012, at 8:28 PM, Randy wrote: > Just because it is from Iraq; does NOT mean by any streach of the imagination > that OP is a terrorist! > You need to get outside the box you are living in and learn to separate the >

Re: DNS for ben.edu

2012-10-26 Thread David Conrad
Mark, On Oct 26, 2012, at 8:47 PM, Mark Andrews wrote: > Looks to be right now. Nope. Depends on from where you ask (presumably the AT&T resolvers are anycast). This is from a machine at LINX just now: % dig @12.127.17.83 www.ben.edu ; <<>> DiG 9.9.2-vjs287.12 <<>> @12.127.17.83 www.ben.ed

Re: If you are using APNIC as an RPKI trust anchor, please update your Trust Anchor Set.

2012-10-15 Thread David Conrad
George, On Oct 15, 2012, at 8:44 PM, George Michaelson wrote: > Once there is a global trust anchor, you can validate the 5 APNIC operating > CA under a single root, single TAL. Until then, an APNIC TAL is necessary. So, just to be clear, the lack of a single TAL is due to inaction on the part

Re: IPv4 address length technical design

2012-10-03 Thread David Conrad
On Oct 3, 2012, at 3:59 PM, valdis.kletni...@vt.edu wrote: > On Wed, 03 Oct 2012 17:49:56 -0500, Jimmy Hess said: >> (1) Stopped mixing the Host identification and the Network >> identification into the same bit field; > > Where's Noel Chiappa when you need him? Saying "I told you so" I suspe

Re: Announcing APNIC IP's in ARIN region

2012-09-25 Thread David Conrad
On Sep 25, 2012, at 2:05 AM, Wayne E Bouchard wrote: > It presents no technical problem but has always been considered > politically inadvisable. I mean, there are multiple registries for a > reason that goes beyond mere oranization and load sharing. Always? Actually, no. Back when the RIRs were

Re: The Department of Work and Pensions, UK has an entire /8

2012-09-19 Thread David Conrad
Robert, On Sep 19, 2012, at 1:35 PM, Robert Guerra wrote: > Am I correct in assuming that the unused IP block would not be sold as is > mentioned in the article, but instead be returned to RIPE to be reallocated? Assuming for the sake of argument that the 51/8 is actually unused (which it app

Re: The Department of Work and Pensions, UK has an entire /8

2012-09-19 Thread David Conrad
On Sep 19, 2012, at 11:02 AM, Scott Howard wrote: > On Tue, Sep 18, 2012 at 9:49 PM, Mike Hale wrote: >> So...why do you need publicly routable IP addresses if they aren't publicly >> routable? >> > Because doing anything else is Harmful! There's even an RFC that says so! > http://tools.ietf.or

Re: DNS Changer items

2012-08-15 Thread David Conrad
On Aug 15, 2012, at 5:59 PM, Nick Hilliard wrote: > Approx 2 months later after taking legal advice, the NCC formed the view > that the police and the prosecutor had no legal basis for making the > request and they consequently unlocked the objects. With the end result that someone gets some rea

Re: rpki vs. secure dns?

2012-05-29 Thread David Conrad
On May 29, 2012, at 8:23 AM, Alex Band wrote: > RPKI needs the full data set to determine if a BGP prefix has the status > 'valid', 'invalid' or 'unknown'. It can't work with partial data. I think I now understand concerns about scaling... :-) Regards, -drc

Re: rpki vs. secure dns?

2012-05-29 Thread David Conrad
On May 29, 2012, at 4:02 AM, paul vixie wrote: >>> i can tell more than that. rover is a system that only works at all >>> when everything everywhere is working well, and when changes always >>> come in perfect time-order, >> Exactly like DNSSEC. > > no. dnssec for a response only needs that resp

Re: DNS anycasting - multiple DNS servers on same subnet Vs registrar/registry policies

2012-05-29 Thread David Conrad
Jimmy, On May 28, 2012, at 9:58 PM, Jimmy Hess wrote: > The purpose of using a registrar is to establish DNS delegation, not > to validate your site's redundancy meets the absolute best possible > practices for fault tolerance. Terminology nit: the purpose of a registrar is to allow folks the fre

Re: Bogon list update for prefix for 5.1.0.0/19

2012-05-28 Thread David Conrad
On May 28, 2012, at 2:45 PM, Matthew Palmer wrote: > On Mon, May 28, 2012 at 04:31:34PM +0300, Evgeniy Aikashev wrote: >> We are AS21219 - PJSC Datagroup and owner of 5.1.0.0/19 block. Our >> customers have no access to some part of Internet if they use these IPs. >> Could you please update your bo

Re: rpki vs. secure dns?

2012-05-28 Thread David Conrad
On May 28, 2012, at 1:59 PM, Paul Vixie wrote: > third, rsync's dependencies on routing (as in the RPKI+ROA case) are not > circular (which i think was david conrad's point but i'll drag it to here.) Nope. My point was that anything that uses the Internet to fetch the data (including rsync) has

Re: DNS anycasting - multiple DNS servers on same subnet Vs registrar/registry policies

2012-05-28 Thread David Conrad
Anurag, On May 28, 2012, at 11:51 AM, Anurag Bhatia wrote: > I know few registry/registrars > which do not accept both (or all) name servers of domain name on same > subnet. They demand at least 1 DNS server should be on different subnet for > failover reasons (old thoughts). IMHO appropriately s

Re: rpki vs. secure dns?

2012-05-01 Thread David Conrad
Roland, On May 1, 2012, at 8:49 AM, Dobbins, Roland wrote: > On May 1, 2012, at 8:18 PM, David Conrad wrote: >>> It's hard to take seriously any proposal which is predicated upon recursive >>> dependencies. >> Do you mean the need to be able to use [X] to fetch t

Re: rpki vs. secure dns?

2012-05-01 Thread David Conrad
On May 1, 2012, at 4:34 AM, Dobbins, Roland wrote: > On Apr 28, 2012, at 5:05 AM, Paul Vixie wrote: >> is anybody taking it seriously? > It's hard to take seriously any proposal which is predicated upon recursive > dependencies. Do you mean the need to be able to use rsync to fetch the data to en

Re: rpki vs. secure dns?

2012-04-29 Thread David Conrad
Alex, On Apr 29, 2012, at 8:16 AM, Alex Band wrote: > All in all, for an RPKI-specific court order to be effective in taking a > network offline, the RIR would have to tamper with the registry, inject false > data and try to make sure it's not detected so nobody applies a local > override. I s

Re: DNS noise

2012-04-06 Thread David Conrad
Jimmy, On Apr 6, 2012, at 1:24 PM, Jimmy Hess wrote: > On Fri, Apr 6, 2012 at 1:24 PM, David Conrad wrote: >> I suspect the root server operators might not like this idea very much. > If it solves other problems adequately, they might eventually just have to > learn to like

Re: DNS noise

2012-04-06 Thread David Conrad
On Apr 6, 2012, at 11:13 AM, Jimmy Hess wrote: >> It turns out that DNSSEC makes a respectable traffic amplification vector: > This is definitely a problem. Yep. So are SNMP reflection attacks (biggest attack I've seen was one of these) and any other datagram-oriented query/response protocol. >

Re: BCP38 Deployment

2012-03-28 Thread David Conrad
On Mar 28, 2012, at 12:03 PM, Leo Bicknell wrote: > Tier 1 T640 core network with 10GE handoff > Regional Cisco GSR network with 1GE handoff > Local1006 to Arris CMTS > Subscriber Motorola Cable Modem to NetGear SOHO Gateway > User Patron with Airport Express sharing a w

Re: Quad-A records in Network Solutions ?

2012-03-28 Thread David Conrad
On Mar 28, 2012, at 11:47 AM, Carlos Martinez-Cagnazzo wrote: > I'm not a fan of conspiracy theories, but, c'mon. For a provisioning > system, an record is just a fragging string, just like any other > DNS record. How difficult to support can it be ? Of course it is more than a string. It re

Re: BCP38 Deployment

2012-03-28 Thread David Conrad
On Mar 28, 2012, at 9:39 AM, Darius Jahandarie wrote: > I think the concern of RFC3704/BCP84, i.e., multihoming, is the > primary reason we don't see ingress filtering as much as we should. I would be surprised if this were true. I'd argue that today, the vast majority of devices on the Internet

Re: BCP38 Deployment

2012-03-28 Thread David Conrad
Leo, On Mar 28, 2012, at 8:13 AM, Leo Bicknell wrote: >> #1) Money. >> #2) Laziness. > While Patrick is spot on, there is a third issue which is related > to money and laziness, but also has some unique aspects. > > BCP38 makes the assumption that the ISP does some "configuration" > to insure on

Re: [apnic-talk] root zone stats

2012-03-11 Thread David Conrad
Anurag, On Mar 11, 2012, at 9:11 AM, Anurag Bhatia wrote: > Thanks for sharing interesting data. Was wondering you have map of g TLD > server locations? Something like that of root servers? > You would probably need to ask the operators of the gTLDs. As they are (generally) commercial servic

Re: Concern about gTLD servers in India

2012-03-10 Thread David Conrad
On Mar 10, 2012, at 6:38 PM, Owen DeLong wrote: > The more telling fallacy here that really speaks to the heart of why I am > dismayed and disappointed by ICANN's management of the whole TLD mess is the > idea that a CCTLD is the property of a TLD operator to begin with. Your dismay and disappoi

Re: [apnic-talk] Concern about gTLD servers in India

2012-03-10 Thread David Conrad
On Mar 10, 2012, at 1:28 AM, Anurag Bhatia wrote: > Can someone share if there's huge difference in . root servers Vs gTLD > servers? Yes, there is a huge difference. For one thing (and ignoring the quantity of data), the operations of a gTLD's name servers is managed by a single entity (e.g.,

Re: Concern about gTLD servers in India

2012-03-10 Thread David Conrad
On Mar 10, 2012, at 7:24 AM, John Levine wrote: > In article <95f7df59-052d-43ba-869f-289df915c...@arbor.net> you write: >> >> On Mar 10, 2012, at 7:02 PM, Robert E. Seastrom wrote: >>> there are four gtlds >> Aren't there actually seven? > Including the new IDN TLDs, there are now 60. The IDN TL

Re: IETF - Overlapping IPv4 Address Support

2012-03-06 Thread David Conrad
You all have encouraged me to filter 'nanog.guru' in both sender _and_ recipient fields. If you insist on engaging the loons, please I beg you, cc them directly. Regards, -drc On Mar 6, 2012, at 5:49 PM, Jimmy Hess wrote: > On Tue, Mar 6, 2012 at 2:57 PM, Guru NANOG wrote: >> Adding four more

Re: dns and software, was Re: Reliable Cloud host ?

2012-03-01 Thread David Conrad
Jeroen, On Mar 1, 2012, at 9:25 AM, Jeroen Massar wrote: >> I always thought the right way to deal with IPv6 would have been to >> use a 32-bit number from the class E space as a 'network handle' >> where the actual address (be it IPv4 or IPv6) was handled by the >> kernel. > > This is the case w

Re: dns and software, was Re: Reliable Cloud host ?

2012-03-01 Thread David Conrad
Michael, On Mar 1, 2012, at 10:00 AM, Michael Thomas wrote: > My rule of thumb is for this sort of thing "does it *require* kernel level > access?" > In this case, the answer is manifestly "no". This is tilting at windmills since it's wildly unlikely anything will change, but... The idea is to

Re: dns and software, was Re: Reliable Cloud host ?

2012-03-01 Thread David Conrad
Hi, On Mar 1, 2012, at 7:22 AM, Joe Greco wrote: > On Mar 1, 2012, at 7:01 AM, Michael Thomas wrote: >> The effect of what you're recommending is to move all of this >> into the kernel, and in the process greatly expand its scope. Also: >> even if you did this, you'd be saddled with the same probl

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread David Conrad
On Feb 11, 2012, at 10:57 PM, Joel jaeggli wrote: > On 2/11/12 19:34 , Sven Olaf Kamphuis wrote: >> yes, domain names that cannot be typed in with any keyboard/charset on >> any computer out there, excellent idea, devide and conquerer, i wonder >> who came up with that idiotic plan again, probably

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)

2012-02-01 Thread David Conrad
On Feb 1, 2012, at 10:16 AM, George Bonser wrote: "We have a contractual relationship with our customer to announce that space. We have neither a contractual relationship (in this context) with the RIR nor the RIR's customer. The RIR and/or the RIR's customer should resolve t

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)

2012-02-01 Thread David Conrad
On Jan 31, 2012, at 8:53 PM, Antonio Querubin wrote: >> "We have a contractual relationship with our customer to announce that >> space. We have neither a contractual relationship (in this context) with >> the RIR nor the RIR's customer. The RIR and/or the RIR's customer should >> resolve this

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)

2012-01-31 Thread David Conrad
On Jan 31, 2012, at 5:52 PM, Mark Andrews wrote: >> "We have a contractual relationship with our customer to announce that = >> space. We have neither a contractual relationship (in this context) = >> with the RIR nor the RIR's customer. The RIR and/or the RIR's customer = >> should resolve this

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)

2012-01-31 Thread David Conrad
> I hope none of you ever get hijacked by a spammer housed at Phoenix NAP. :) In the dim past, I had a somewhat similar situation: - A largish (national telco of a small country) ISP started announcing address space a customer of theirs provided. Unfortunately, the address space wasn't the IS

Re: De-bogon not possible via arin policy.

2011-12-15 Thread David Conrad
On Dec 15, 2011, at 12:41 PM, Ricky Beam wrote: > Because it's not ARIN's job to clean up someone else's stupid. ARIN's job (well, beyond the world travel, publishing comic books, handing out raffle prizes, etc.) is to allocate and register addresses according to community-defined documented p

Re: De-bogon not possible via arin policy.

2011-12-15 Thread David Conrad
On Dec 15, 2011, at 6:07 AM, Justin M. Streiner wrote: > On Wed, 14 Dec 2011, David Conrad wrote: >> I'm confused. When justifying 'need' in an address allocation request, what >> difference does it make whether an address in use was allocated by an RIR or >&

Re: De-bogon not possible via arin policy.

2011-12-15 Thread David Conrad
Jimmy, On Dec 14, 2011, at 11:14 PM, Jimmy Hess wrote: > A RFC1918 network is not a "normal" network; and this is not a > renumbering in the same manner as a renumbering from public IP space > to new public IP space. I'll admit I haven't been following ARIN policy making for some time. Can you

Re: De-bogon not possible via arin policy.

2011-12-14 Thread David Conrad
On Dec 14, 2011, at 6:46 PM, Jimmy Hess wrote > Wait... you had started using bogon addresses / "squatted" space not > allocated and claimed the number of IP addresses your network is using that > were not > allocated by a RIR settles the need justification question? I'm confused. When justify

Re: De-bogon not possible via arin policy.

2011-12-14 Thread David Conrad
On Dec 14, 2011, at 1:15 PM, Cameron Byrne wrote: > Just fyi, de-bogoning , or private rfc 1918 is not really an option even > with strong and consistent demonstrate load. > > Any suggestions on how to navigate this policy ? Given unmet demand, I'd think the solution would be fairly obvious (alb

Re: Recent DNS attacks from China?

2011-11-30 Thread David Conrad
On Nov 30, 2011, at 9:13 AM, -Hammer- wrote: > There was a new BIND vulnerability announced... > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4313 > I strongly suspect the BIND vulnerability is unrelated. These attacks appear to be simple (if large) DDoSes. Regards, -drc

Re: Dynamic (changing) IPv6 prefix delegation

2011-11-22 Thread David Conrad
On Nov 22, 2011, at 8:19 AM, Owen DeLong wrote: >> Exactly. ISPs are in business to make as much money as they can - go figure. > How do you make more money by refusing to meet customer requests? Not rocket science. The vast majority of customers fall into a small number of categories. You make

Re: economic value of low AS numbers

2011-11-17 Thread David Conrad
On Nov 17, 2011, at 10:55 AM, Keegan Holley wrote: > You are discounting (pun intended) vanity and marketing. I am no longer > surprised at what people will be willing to pay (sometimes astonishing > amounts of) money for. > > I suppose I can't argue with that, but anyone technical enough to kn

Re: economic value of low AS numbers

2011-11-17 Thread David Conrad
On Nov 17, 2011, at 8:16 AM, Keegan Holley wrote: > Besides standing at the water cooler at 1:23PM on 12/3 telling AS123 jokes > I'm not sure a particular AS number has any relevance or any monetary value > unless there is scarcity. You are discounting (pun intended) vanity and marketing. I am no

Re: ARIN-2011-1: ARIN Inter-RIR Transfers - Last Call (expires in one week)

2011-11-10 Thread David Conrad
Bill, On Nov 10, 2011, at 5:48 AM, William Herrin wrote: > On Thu, Nov 10, 2011 at 8:28 AM, Randy Bush wrote: >> i am sure the americans who think all address space should righfully be >> theirs can dream up paranoid scenarios for anything. but dear canute, >> the tide is coming, get over it or

Re: Were A record domain names ever limited to 23 characters?

2011-10-07 Thread David Conrad
> You may be referring to a limitation of a certain OS regarding a hostname; or > some network's policy. No. See http://www.ietf.org/rfc/rfc810.txt "ASSUMPTIONS 1. A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-

Re: Botnets buying up IPv4 address space

2011-10-07 Thread David Conrad
Arturo, On Oct 7, 2011, at 12:10 PM, Arturo Servin wrote: > In fact, for this "problem" I find irrelevant that IPv4 is running out. > They are just looking for good reputation IP nodes. I suspect it is relevant to IPv4 because IPv6 has so little penetration. It probably doesn't matter if

Re: Botnets buying up IPv4 address space

2011-10-07 Thread David Conrad
On Oct 7, 2011, at 11:31 AM, Arturo Servin wrote: > What do you mean with "purchasing or renting IPv4". > > Last time that I check it was not possible in the RIR world. Seriously? http://www.networkworld.com/community/blog/microsoft-pays-nortel-75-million-ipv4-address The next phase

Re: Prefix hijacking by Michael Lindsay via Internap

2011-08-21 Thread David Conrad
Jimmy, On Aug 21, 2011, at 8:15 AM, Jimmy Hess wrote: > The system is this way BY DESIGN, and any other method would concentrate > power > which would be detrimental to the internet and counter to its > open/consensus driven nature. See recent discussions in RIPEland regarding BGPSEC+RPKI reg

Re: Prefix hijacking by Michael Lindsay via Internap

2011-08-20 Thread David Conrad
On Aug 20, 2011, at 6:01 PM, Arturo Servin wrote: > If you are claiming right over these prefixes I suggest you to contact > RIPE NCC. And that will do what exactly? Back when I worked at an RIR, a prefix was "misplaced". When I contacted the (country monopoly PTT) ISP and told them the

Re: What do you do when your Home ISP is down?

2011-08-19 Thread David Conrad
On Aug 19, 2011, at 8:18 AM, Peter Lothberg wrote: > Why would you put yourself in such a situation? > > - Arrange for two or more diverse fiber entrances to your house > - Put atleast one Ds3 microwave link for emergency access > - Have diffrent routers terminate each link > - Redundant interconn

Re: US internet providers hijacking users' search queries

2011-08-08 Thread David Conrad
Chris, On Aug 8, 2011, at 2:56 PM, Christopher Morrow wrote: > messing with basic plumbing will have unintended consequences, they will be > bad. > > If the users her WANT to have this experience, there are lots of > in-browser/application methods to achieve this, hijacking DNS at the > resolver

Re: IPv6 end user addressing

2011-08-07 Thread David Conrad
Jonathon, On Aug 7, 2011, at 12:09 PM, Jonathon Exley wrote: > This has probably been said before, Once or twice :-) > but it makes me uncomfortable to think of everybody in the world being given > /48 subnets by default. This isn't where the worry should be. Do the math. Right now, we're a

Re: ICANN to allow commercial gTLDs

2011-06-20 Thread David Conrad
On Jun 20, 2011, at 11:19 AM, Mark Andrews wrote: > do you want to issue a RFC that bans search lists? Personally, I think search lists are a mistake and don't use them. If you do use them, then you are accepting a certain amount of ambiguity. Naked TLDs will increase that ambiguity and would r

Re: ICANN to allow commercial gTLDs

2011-06-20 Thread David Conrad
On Jun 20, 2011, at 2:35 AM, Robert E. Seastrom wrote: > Randy Bush writes: >> what's new? how about the operational technical effects, like data from >> modeling various resolvers' responses to a large root zone? Yep. That is an area that has been identified as needing additional study (see c

Re: ICANN to allow commercial gTLDs

2011-06-20 Thread David Conrad
On Jun 20, 2011, at 12:14 AM, Mark Andrews wrote: >> So they get what they ask for: Ambiguity in resolving the name space. > There is no ambiguity if tld operators don't unilaterally add address > records causing simple hostnames to resolve. EDU.COM. Regards, -drc

Re: unqualified domains, was ICANN to allow commercial gTLDs

2011-06-19 Thread David Conrad
Mark, RTFDAG. Regards, -drc On Jun 19, 2011, at 7:14 PM, Mark Andrews wrote: >> In order to obtain a gTLD, you have to sign a contractual agreement with = >> ICANN. > > David, you are missing the point. The TM holder doesn't want the > gtld, they just want to protect their trademark. The TM h

Re: unqualified domains, was ICANN to allow commercial gTLDs

2011-06-19 Thread David Conrad
On Jun 19, 2011, at 6:39 PM, Mark Andrews wrote: > I'm curious how anyone that has not signed a agreement with ICANN > can be bound to anything in any applicant guide book. In order to obtain a gTLD, you have to sign a contractual agreement with ICANN. > Also rfp-clean-30may11-en.pdf basically

Re: unqualified domains, was ICANN to allow commercial gTLDs

2011-06-19 Thread David Conrad
On Jun 19, 2011, at 5:46 PM, Mark Andrews wrote: >> I would guess that most of these are going to be purchased simply to >> prevent someone else from getting them > I would agree with this part. I suspect you underestimate the desires and power of marketing folks at larger organizations. > Addin

Re: unqualified domains, was ICANN to allow commercial gTLDs

2011-06-19 Thread David Conrad
On Jun 19, 2011, at 4:08 PM, Paul Vixie wrote: > ICANN could also have an impact on this by having applicants sign something Well, yes, ICANN could have contracted parties (e.g., the new gTLDs) do this. A bit late to get it into the Applicant's Guidebook, but maybe something could be slipped in

Re: unqualified domains, was ICANN to allow commercial gTLDs

2011-06-19 Thread David Conrad
On Jun 19, 2011, at 3:24 PM, Paul Vixie wrote: > i think we have to just discourage lookups of single-token names, universally. How? Regards, -drc

Re: unqualified domains, was ICANN to allow commercial gTLDs

2011-06-19 Thread David Conrad
On Jun 19, 2011, at 8:49 AM, Chris Adams wrote: > Once upon a time, Randy Bush said: >>> Now I'm tempted to be the guy that gets .mail >> express that temptation in dollars, and well into two commas. > Imagine the "typo-squating" someone could do with .con. See section 2.2.1.1 (and section 2.1.2)

<    1   2   3   4   5   >