Re: Behold - the Address-Yenta!

2010-04-08 Thread David Conrad
BIll, On Apr 8, 2010, at 9:39 AM, bmann...@vacation.karoshi.com wrote: If you're not planning to announce a route into the DFZ, we have RFC1918 or IPv6's ULA, address pools that are 100% and completely free for your use. er... you misunderstand... there is no single DFZ anywhere...

Re: Behold - the Address-Yenta!

2010-04-08 Thread David Conrad
John, In the cases I'm aware of (which were some time ago), there was (to my knowledge) no fraud involved. Or are you indicating the mechanisms I described are in some way fraudulent? Regards, -drc On Apr 8, 2010, at 12:46 PM, John Curran wrote: On Apr 8, 2010, at 3:51 PM, David Conrad

Re: legacy /8

2010-04-04 Thread David Conrad
On Apr 3, 2010, at 10:46 PM, Michael Dillon wrote: If every significant router on the market supported IPv6 five years ago,We need more of the spirit of the old days of networking when people building UUCP, and Fidonet and IP networks did less complaining about vendors and made things work

Re: legacy /8

2010-04-03 Thread David Conrad
On Apr 3, 2010, at 6:17 AM, Robert Brockway wrote: On Fri, 2 Apr 2010, jim deleskie wrote: Just like 640k or memory :) But what if I said 640 petabytes will be more than anyone will ever need. The future might prove me wrong but it probably won't happen for a long time. That's a better

Re: legacy /8

2010-04-03 Thread David Conrad
On Apr 3, 2010, at 8:25 AM, George Bonser wrote: The point is that v6 was a bad solution to the problem. Well, yes, but... Rather than simply address the address depletion problem, it also solves a lot of problems that nobody has while creating a whole bunch more that we will have. Not

Re: legacy /8

2010-04-03 Thread David Conrad
On Apr 3, 2010, at 11:22 AM, Frank Bulk wrote: If every significant router on the market supported IPv6 five years ago, why aren't transit links glowing with IPv6 connectivity? If it's not the hardware, than I'm guessing it's something else, like people or processes? Or the fact that

Re: Note change in IANA registry URLs

2010-04-02 Thread David Conrad
On Apr 1, 2010, at 11:42 PM, Robert Kisteleki wrote: I don't know what good reasons you might have to pull down the current URLs. Because the content has changed from arbitrary ASCII text files into more easily parseable XML and backporting to those arbitrary ASCII text files has proven too

Re: Note change in IANA registry URLs

2010-04-02 Thread David Conrad
On Apr 2, 2010, at 7:13 AM, Robert Kisteleki wrote: You're confusing two things: URL and content. According to the announcement, TXT files will be generated still. Why, again, must the URL change? As Leo pointed out, a message will be displayed at the historical URL. Does this address your

Re: legacy /8

2010-04-02 Thread David Conrad
On Apr 2, 2010, at 1:40 PM, Brielle Bruns wrote: Take back all the IP space from China and give them a single /20 and tell them to make do. At current consumption rates, that'd buy us another year or so. Then what? Regards, -drc

Re: [Fwd: [members-discuss] [ncc-announce] RIPE NCC Position On The ITU IPv6 Group]

2010-03-31 Thread David Conrad
On Mar 31, 2010, at 6:52 AM, Joly MacFie wrote: On Tue, Mar 30, 2010 at 8:15 PM, David Conrad d...@virtualized.org wrote: Well, actually, ICANN was in Geneva specifically for the meeting, but we weren't allowed into the room. Quite annoying, actually. Why isn't this on YouTube? You'd have

Re: [Fwd: [members-discuss] [ncc-announce] RIPE NCC Position On The ITU IPv6 Group]

2010-03-30 Thread David Conrad
Well, actually, ICANN was in Geneva specifically for the meeting, but we weren't allowed into the room. Quite annoying, actually. Regards, -drc On Mar 30, 2010, at 2:05 PM, Richard Barnes wrote: There were a few representatives of the Internet community at the meeting. All five RIRs were

Re: NSP-SEC

2010-03-18 Thread David Conrad
Why respond to an obvious troll? Regards, -drc On Mar 18, 2010, at 8:46 PM, William Pitcock wrote: Hello, Few people actually care about nsp-sec so what exactly are you getting at? Guillaume FORTAINE gforta...@live.com wrote: ...

Re: CRS-3

2010-03-09 Thread David Conrad
On Mar 9, 2010, at 10:55 PM, Paul Ferguson wrote: Anyone have any idea how much a fully configured CRS-3 would cost? Admittedly, my information on these topics comes from NPR these days. :-) They said it costs ~US$90k, and that ATT was in trails. Somehow, I'm skeptical (not of the trials,

Re: IP4 Space

2010-03-05 Thread David Conrad
Mark, On Mar 4, 2010, at 11:46 PM, Mark Newton wrote: On 05/03/2010, at 2:50 PM, David Conrad wrote: When the IPv4 free pool is exhausted, I have a sneaking suspicion you'll quickly find that reclaiming pretty much any IPv4 space will quickly become worth the effort. Only to the extent

Re: IP4 Space

2010-03-05 Thread David Conrad
On Mar 5, 2010, at 10:44 AM, Joel Jaeggli wrote: If this is done right, direct assignment holders and ISPs are issued sufficiently large prefixes such that the prefix count per entity remains small. This sort of assumes Internet connectivity models of today, specifically that most address

Re: IP4 Space

2010-03-04 Thread David Conrad
On Mar 4, 2010, at 2:30 PM, William Herrin wrote: Because we expect far fewer end users to multihome tomorrow than do today? We do? Why do we expect this? Regards, -drc

Re: IP4 Space

2010-03-04 Thread David Conrad
On Mar 4, 2010, at 9:41 PM, Thomas Magill wrote: The most we could achieve would be to extend IPv4 freepool lifespan by roughly 26 days. Given the amount of effort sqeezing useful addresses out of such a conversion would require, I proffer that such effort is better spent moving towards IPv6

Re: [members-discuss] Re: RIPE NCC Position On The ITU IPv6 Group (fwd)

2010-03-01 Thread David Conrad
On Mar 1, 2010, at 7:42 AM, Arjan van der Oest wrote: keep in mind, most telcos and ISPs (the founders and members of the current IANA - RIRS - LIRs model resulting in a global internet which is hard to censor) do not agree on this ITU proposal... I wonder who those ITU members are then?

Re: [Fwd: [members-discuss] [ncc-announce] RIPE NCC Position On The ITU IPv6 Group]

2010-02-26 Thread David Conrad
On Feb 26, 2010, at 10:22 AM, gordon b slater wrote: I must admit to total confusion over why they need to grab IPs from the v6 address space? Surely they don't need the equivalent of band-plans for IP space? Or have I missed some v6 technical point totally? The ITU Secretariat and a few

Re: [Fwd: [members-discuss] [ncc-announce] RIPE NCC Position On The ITU IPv6 Group]

2010-02-26 Thread David Conrad
On Feb 26, 2010, at 1:58 PM, Nick Hilliard wrote: On 26/02/2010 21:13, Antonio Querubin wrote: Some googling for 'itu ipv6' turns up the following (among other things): http://www.itu.int/net/ITU-T/ipv6/itudocs.aspx Wow, there are some real classics in there. Anyone in need of a good

Re: Adopt‐an‐Haitian‐Internet ‐technician‐or‐facility

2010-02-08 Thread David Conrad
On Feb 8, 2010, at 9:57 AM, a.harrow...@gmail.com wrote: As a matter of form, how might one check out the legitimacy of requests like this? (No, I don't think this one is fake...) As a start, web of trust. This one was introduced to the list by Eric Brunner-Williams originally, a member

Re: Adopt‐an‐Haitian‐Internet ‐technician‐or‐facility

2010-02-08 Thread David Conrad
On Feb 8, 2010, at 11:09 AM, Eric Brunner-Williams wrote: Err, no. It was introduced by (unsigned) email purporting to come from Eric. Followed by another (unsigned) message with bank info purporting to come from Reynold Guerrier. A bit of a difference. True. Signed would have been

Re: 1/8 and 27/8 allocated to APNIC

2010-01-22 Thread David Conrad
On Jan 22, 2010, at 9:52 AM, Richard Barnes wrote: Would it make sense for the RIRs to just carve out the bad parts of the blocks, instead of IANA? Under current policy, would reserving bad bits make it more difficult for an RIR to get additional allocations? Under existing policies, there

Re: 1/8 and 27/8 allocated to APNIC

2010-01-21 Thread David Conrad
On Jan 21, 2010, at 5:22 PM, Jon Lewis wrote: In the event that 1.0.0.0/8 is assigned by IANA, anoNet could move to the next unassigned /8, though such an event is unlikely, as 1.0.0.0/8 has been reserved since September 1981. Sounds like a non-winning strategy to me. It's just a (random)

Re: Article on spammers and their infrastructure

2009-12-31 Thread David Conrad
On Dec 31, 2009, at 11:32 AM, Paul Timmins wrote: Cool. Then you just have to figure out how to unilaterally withdraw a resource that doesn't have a centralized automated verification system. Taking you out of whois doesn't automatically take you out of people's BGP tables, after all. See

Re: ip-precedence for management traffic

2009-12-29 Thread David Conrad
On Dec 29, 2009, at 7:08 AM, Steven Bellovin wrote: On Dec 29, 2009, at 9:29 AM, Sachs, Marcus Hans (Marc) wrote: Totally out of the box, but here goes: why don't we run the entire Internet management plane out of band so that customers have minimal ability to interact with routing updates,

Re: What DNS Is Not

2009-11-26 Thread David Conrad
On Nov 25, 2009, at 8:16 PM, Paul Vixie wrote: we have to fix DNS so that provider-in-the-middle attacks no longer work. (this is why in spite of its technical excellence i am not a DNSCURVE fan, and also why in spite of its technical suckitude i'm working on DNSSEC.) As you know, as long as

Re: What DNS Is Not

2009-11-26 Thread David Conrad
On Nov 26, 2009, at 8:37 AM, Paul Vixie wrote: From: David Conrad d...@virtualized.org Date: Thu, 26 Nov 2009 07:42:15 -0800 As you know, as long as people rely on their ISPs for resolution services, DNSSEC isn't going to help. Where things get really offensive if when the ISPs _require_

Re: What DNS Is Not

2009-11-26 Thread David Conrad
Dan, On Nov 26, 2009, at 10:25 AM, Dan White wrote: On 26/11/09 07:37 -0800, David Conrad wrote: There are folks on this list who work for ISPs which are doing wildcards/synthesis/etc. They (or, more likely their management) can tell you there are obvious business reasons why they do

Re: Who has AS 1712?

2009-11-25 Thread David Conrad
On Nov 25, 2009, at 1:33 AM, Hank Nussbacher wrote: At 08:57 25/11/2009 +0100, Daniel Karrenberg wrote: shouting. This is all water under the bridge of course and we are moving on; I do not say everything is ideal now. However the RIRs are actively working to publish a complete set of

Re: What DNS Is Not

2009-11-25 Thread David Conrad
Hi, On Nov 25, 2009, at 1:22 PM, Dan White wrote: Contact ICANN/IANA and plead with them to stop assigning any more resources to said ISP. ICANN/IANA doesn't assign resources to ISPs. Regards, -drc

Re: IPv6 Deployment for the LAN

2009-10-22 Thread David Conrad
Ok, lets start with not breaking the functionality we have today in IPv4. Once you get that working again we can look at new ideas (like RA) that might have utility. Let the new stuff live/die on it's own merits. The Internet is very good at sorting out the useful technology from the crap.

Re: IPv6 Deployment for the LAN

2009-10-21 Thread David Conrad
Iljitsch, On Oct 21, 2009, at 12:46 PM, Iljitsch van Beijnum wrote: On 18 okt 2009, at 10:03, Andy Davidson wrote: Support default-routing options for DHCPv6 ! This would be a big mistake. [...] It's time for this DHC stuff to reach its final resting place. I'm curious: are you anticipating

Re: IPv6 internet broken, Verizon route prefix length policy

2009-10-12 Thread David Conrad
Mark, On Oct 12, 2009, at 3:40 PM, Mark Andrews wrote: Verizon's policy has been related to me that they will not accept or propogate any IPv6 route advertisements with prefix lengths longer than /32. Full stop. So that even includes those of us that have /48 PI space from ARIN that are

Re: IPv6 internet broken, Verizon route prefix length policy

2009-10-12 Thread David Conrad
Owen, On Oct 12, 2009, at 5:09 PM, Owen DeLong wrote: With IPv6, it probably won't be the ideal 1:1 ratio, but, it will come much closer. I wasn't aware people would be doing traffic engineering differently in IPv6 than in IPv4. Even if the average drops to 1/2, you're talking about a

Re: Practical numbers for IPv6 allocations

2009-10-06 Thread David Conrad
On Oct 6, 2009, at 6:13 PM, Nathan Ward wrote: My understanding is that the RIRs are doing sparse allocation, as opposed to reserving a few bits. I could be wrong. Last I heard, with the exception of APNIC and contrary to what they indicated they'd do prior to IANA allocating the /12s, you

Re: Practical numbers for IPv6 allocations

2009-10-06 Thread David Conrad
On Oct 6, 2009, at 6:17 PM, David Conrad wrote: On Oct 6, 2009, at 6:13 PM, Nathan Ward wrote: My understanding is that the RIRs are doing sparse allocation, as opposed to reserving a few bits. I could be wrong. Last I heard, with the exception of APNIC and contrary to what they indicated

Re: ISP customer assignments

2009-10-05 Thread David Conrad
I've been trying to stay out of this discussion because it is pointless, however as I can't help picking at scratching mosquito bites either... On Oct 5, 2009, at 4:50 PM, Michael Thomas wrote: I'm perplexed. At what size address would people stop worrying about the finite address space?

Re: ISP customer assignments

2009-10-05 Thread David Conrad
Owen, On Oct 5, 2009, at 5:05 PM, Owen DeLong wrote: If people start getting /32s because some ISPs are refusing to route /48s, then, the RIRs are not doing their stewardship job correctly and we should resolve that issue. Since when do RIRs, good stewards or not, control routing policy

(Spelling embarrassment, ignorable except for spelling pedants) Re: ISP customer assignments

2009-10-05 Thread David Conrad
On Oct 5, 2009, at 5:20 PM, David Conrad wrote: Um. How many /32s are their in IPv4? How many /32s are their in IPv6? Of course, that should be there in both cases. Wow. Regards, -drc

Re: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread David Conrad
On Sep 14, 2009, at 10:40 AM, Douglas Otis wrote: Perhaps ICANN could require registries establish a clearing-house, where at no cost, those assigned a network would register their intent to initiate bulk traffic, such as email, from specific addresses. ICANN can't require the RIRs do

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread David Conrad
Marty, On Sep 10, 2009, at 2:45 PM, Martin Hannigan wrote: Not sure when ICANN got into the business of economic bailouts, ?? The blog posting implies it: AfriNIC and LACNIC have fewest IPv4 /8s and service the regions with the most developing economies. We decided that those RIRs

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread David Conrad
On Sep 9, 2009, at 8:41 PM, Martin Hannigan wrote: Not sure when ICANN got into the business of economic bailouts, ?? but the mechanism that ICANN has defined seems patently unfair. RFC 2777 is unfair? Or are you unhappy that LACNIC and AfriNIC have 2 /8s from the least tainted pools?

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread David Conrad
On Sep 9, 2009, at 12:13 PM, Martin Hannigan wrote: The problem of tainted ipv4 allocations probably grows from here since at some point in the near future there isn't going to be much left in terms of clean space to allocate. We're running out of v4 addresses in case anyone forgot.

Re: MX Record Theories

2009-05-28 Thread David Conrad
On May 28, 2009, at 5:04 AM, Bobby Mac wrote: If you add enough recipients to an email, each domain within the send line needs to have an associated MX record. Well, it needs to resolve to an A RR somehow, but for each domain name, you get a different query. DNS by default starts with

Re: Where to buy Internet IP addresses

2009-05-06 Thread David Conrad
On May 5, 2009, at 10:12 PM, Karl Auer wrote: Look, the Ark *is* finished. It floats. It can be steered. It has space for everyone. The fact that some of the plumbing is a bit iffy is just not a major issue right now; getting everybody on board is. We have LOTS of very clever people ready

Re: Important New Requirement for IPv4 Requests

2009-04-21 Thread David Conrad
Oddly enough, someone proposed something very much along these lines at a couple of RIR meetings (see IPv4 Soft Landing), and in fact used the 'driving into a brick wall' analogy. Many of the folks who commented on that policy proposal felt it was inappropriate for RIRs to dictate

Re: ISC DLV

2009-04-05 Thread David Conrad
On Apr 5, 2009, at 12:09 AM, bmann...@vacation.karoshi.com wrote: On Sun, Apr 05, 2009 at 07:37:15PM +1000, Mark Andrews wrote: The fault has been rectified. We are still looking into the underlying cause and what procedural changes need to be made to prevent a repeat occurance. Mark

Re: IPv6 Confusion

2009-02-18 Thread David Conrad
Mikael, On Feb 17, 2009, at 9:18 PM, Mikael Abrahamsson wrote: Suggestion: next time you buy equipment from competing vendors, tell the sales folk from the losing vendors that one deciding factor was (vendor or product) IPv6 support. That (and perhaps only that) will get their attention...

Re: IPv6 Confusion

2009-02-18 Thread David Conrad
Kevin, On Feb 18, 2009, at 8:19 AM, Kevin Oberman wrote: You don't have to tell the truth to the losing sales folk... :-) Yes, I saw the smiley, but Sigh. Perhaps there needs to be an emoticon for really joking, really. no, really.. Ethical issues aside, giving incorrect information to

Re: IPv6 Confusion

2009-02-17 Thread David Conrad
On Feb 17, 2009, at 1:55 PM, Mark Andrews wrote: (which was never fully thought out -- how does a autoconfig'd device get a DNS name associated with their address in a DNSSEC-signed world again?) and letting network operators use DHCP with IPv6 the way they do with IPv4. David you

Re: IPv6 Confusion

2009-02-17 Thread David Conrad
Tony, On Feb 17, 2009, at 12:17 PM, Tony Hain wrote: This being a list of network engineers, there is a strong bias toward tools that allow explicit management of the network. This is a fine position, and those tools need to exist. There are others that don't want, or need to know about

Re: IPv6 Confusion

2009-02-17 Thread David Conrad
On Feb 17, 2009, at 3:55 PM, Mark Andrews wrote: In otherwords ISP's need to enter the 21st century. Yeah, those stupid, lazy, ISPs. I'm sure they're just sitting around every day, kicking back, eating Bon Bons(tm), and thinking of all the new and interesting ways they can burn the vast

Re: IPv6 Confusion

2009-02-17 Thread David Conrad
On Feb 17, 2009, at 7:40 PM, Mikael Abrahamsson wrote: Most of the time the vendors don't educate their sales force (both the droids and the sales engineers) about IPv6 because they themselves have made the strategic decision that IPv6 isn't important to them (personal view). Suggestion:

Re: 97.128.0.0/9 allocation to verizon wireless

2009-02-08 Thread David Conrad
On Feb 8, 2009, at 7:37 PM, Aaron Glenn wrote: so if they don't deploy IPv6 then ('extremely high growth period'), when will they? Hint: how many of the (say) Alexa top 1000 websites are IPv6 enabled? Regards, -drc

Re: Are we really this helpless? (Re: isprime DOS in progress)

2009-01-25 Thread David Conrad
Lorell, On Jan 25, 2009, at 5:27 PM, Lorell Hathcock wrote: Every time I see a post like the one below on this list, I can't help but feel like big brother has infiltrated the list. Someone stating the obvious implications of the lack of the Internet operations community to address a

Re: Are we really this helpless? (Re: isprime DOS in progress)

2009-01-24 Thread David Conrad
Jack, On Jan 23, 2009, at 9:34 PM, Jack Bates wrote: David Conrad wrote: Sad fact is that there are zillions of excuses. Unfortunately I suspect the only way we're going to make any progress on this will be for laws to be passed (or lawsuits to be filed) that impose a financial penalty

Re: hat tip to .gov hostmasters

2008-09-22 Thread David Conrad
On Sep 22, 2008, at 7:56 AM, Florian Weimer wrote: I'm not much up on DNSSEC, but don't you need to be using a resolver that recognizes DNSSEC in order for this to be useful? Yes, and you also need the trust anchors for the zones you want to validate configured. Correct, you need a

Re: hat tip to .gov hostmasters

2008-09-22 Thread David Conrad
On Sep 22, 2008, at 8:11 AM, Keith Medcalf wrote: Correct, you need a validating, security-aware stub resolver, or the ISP needs to validate the records for you. That would defeat the entire purpose of using DNSSEC. In order for DNSSEC to actually provide any improvement in security

Re: 198.32.64.12 -- Harmless mis-route or potential exploit?

2008-09-02 Thread David Conrad
On Sep 2, 2008, at 3:24 PM, Dan Mahoney, System Admin wrote: While recently trying to debug a CEF issue, I found a good number of packets in my debug cef drops output that were all directed at 198.32.64.12 (which I see as being allocated to ep.net but completely unused). As Steve Conte

Re: US government mandates? use of DNSSEC by federal agencies

2008-08-27 Thread David Conrad
On Aug 27, 2008, at 10:25 AM, Jeroen Massar wrote: Right. The real questions are the clients and the trust anchor -- what root key do you support? A distributed one. I personally don't really see an issue with downloading a public key for every TLD out there. These keys could come in a

Re: US government mandates? use of DNSSEC by federal agencies

2008-08-27 Thread David Conrad
Just speaking of the IANA ITAR... On Aug 27, 2008, at 10:35 AM, Kevin Oberman wrote: How do you propose to establish the initial trust for these keys? Current plan: - The IANA ITAR will be reachable via HTTPS, so you could trust the CA IANA uses for that website (don't know who that is

Re: US government mandates? use of DNSSEC by federal agencies

2008-08-27 Thread David Conrad
On Aug 27, 2008, at 11:03 AM, Michael Thomas wrote: Of course embedded frobs that don't auto-update like, oh say, your favorite router could be problematic. You have a router that supports DNSSEC that can't be made to do some form of auto-update? In any case, the point of my first

Re: US government mandates? use of DNSSEC by federal agencies

2008-08-27 Thread David Conrad
Michael, On Aug 27, 2008, at 5:15 PM, Michael Thomas wrote: Sure, but my point is that if DNSsec all of a sudden has some relevance which is not the case today, any false positives are going to come into pretty stark relief. Yep. As in, .gov could quite possibly setting themselves up

Re: Public shaming list for ISPs announcing other ISPs IP space by mistake

2008-08-14 Thread David Conrad
On Aug 14, 2008, at 9:47 AM, brett watson wrote: We're lacking the authority and delegation model that DNS has, I think? If one were to ignore layer 9 politics, it could be argued the authority/delegation models between DNS and address space are quite analogous. DNS: IANA maintains .

Re: Public shaming list for ISPs announcing other ISPs IP space bymistake

2008-08-14 Thread David Conrad
On Aug 14, 2008, at 11:13 AM, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: ARIN holds the top of that authority and delegation hierarchy because they give out the ASnums and IP address blocks. And here I thought IANA handed out ASnums and IP address blocks to ARIN (and RIPE and LACNIC and

Re: Public shaming list for ISPs announcing other ISPs IP space bymistake

2008-08-14 Thread David Conrad
On Aug 14, 2008, at 12:15 PM, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: And here I thought IANA handed out ASnums and IP address blocks to ARIN (and RIPE and LACNIC and AfriNIC and APNIC and the IETF for specific protocol requirements)... We are talking Internet operations, not Internet

Re: Public shaming list for ISPs announcing other ISPs IP space by mistake

2008-08-14 Thread David Conrad
Danny, On Aug 14, 2008, at 8:29 PM, Danny McPherson wrote: On Aug 14, 2008, at 9:47 AM, brett watson wrote: We're lacking the authority and delegation model that DNS has, I think? If one were to ignore layer 9 politics, it could be argued the authority/delegation models between DNS and

Re: IPv6 FAQ

2008-08-08 Thread David Conrad
On Aug 8, 2008, at 3:53 PM, Deepak Jain wrote: According to: http://www.netbsd.org/docs/network/ipv6/ The fine folks at NetBSD really need to update their IPv6 FAQ. That stuff looks like the IPv6 marketing spiel from 1997 or so that has long ago been proven ... 'optimistic'. Rather than

Re: Exploit for DNS Cache Poisoning - RELEASED

2008-07-25 Thread David Conrad
Valdis, On Jul 24, 2008, at 6:05 PM, [EMAIL PROTECTED] wrote: On Thu, 24 Jul 2008 17:43:10 PDT, David Conrad said: On Jul 24, 2008, at 4:24 PM, Tomas L. Byrnes wrote: The problem is, once the ICANNt root is self-signed, the hope of ever revoking that dysfunctional mess as authority is gone

Re: Exploit for DNS Cache Poisoning - RELEASED

2008-07-24 Thread David Conrad
On Jul 24, 2008, at 4:24 PM, Tomas L. Byrnes wrote: The problem is, once the ICANNt root is self-signed, the hope of ever revoking that dysfunctional mess as authority is gone. Sorry, I don't follow -- sounds like FUD to me. Care to explain this? As far as I'm aware, as long as the KSK isn't

Re: Exploit for DNS Cache Poisoning - RELEASED

2008-07-23 Thread David Conrad
Hi, On Jul 23, 2008, at 3:51 PM, Robert D. Scott wrote: Actually you are not missing anything. It is a brute force attack. I haven't looked at the exploit code, but the vulnerability Kaminsky found is a bit more than a brute force attack. As has been pointed out in various venues, it

Re: Multiple DNS implementations vulnerable to cache poisoning

2008-07-10 Thread David Conrad
, Christopher Morrow wrote: On Wed, Jul 9, 2008 at 7:28 PM, David Conrad [EMAIL PROTECTED] wrote: On Jul 9, 2008, at 4:17 PM, Randy Bush wrote: aside from just getting some cctlds signed, i will be interested in the tools, usability, work flow, ... i.e. what is it like for a poor innocent cctld

Re: Multiple DNS implementations vulnerable to cache poisoning

2008-07-10 Thread David Conrad
On Jul 10, 2008, at 2:59 AM, Joao Damas wrote: PS: I would also want a copy of, or a secure method to access, the public part of the keys you use to sign those ccTLDs so I can place them in ISC's DLV registry IANA's 'interim trust anchor repository' will be publicly accessible (of

Re: Multiple DNS implementations vulnerable to cache poisoning

2008-07-09 Thread David Conrad
On Jul 9, 2008, at 10:39 AM, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Pressure your local ICANN officers? Mmph. https://ns.iana.org/dnssec/status.html (it's out of ICANN's hands) Huh!? ... It sounds like ICANN has the matter well in hand to me given that it is only responsible for the

Re: Multiple DNS implementations vulnerable to cache poisoning

2008-07-09 Thread David Conrad
Love to. We can also put your trust anchors in the prototype ITAR (see the first part of https://par.icann.org/files/paris/IANAReportKim_24Jun08.pdf) . Regards, -drc On Jul 9, 2008, at 2:52 PM, Randy Bush wrote: There are 4 ccTLDs (se, bg, pr, br) that are signed. wanna crawl in a

TLDs and file extensions (Re: DNS and potential energy)

2008-07-01 Thread David Conrad
On Jun 30, 2008, at 10:43 PM, James Hess wrote: Sure, nefarious use of say .local could cause a few problems but this is I'd be more concerned about nefarious use of a TLD like .DLL, .EXE, .TXT Or other domains that look like filenames. Like .INFO, .PL, .SH, and, of course, .COM?

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-30 Thread David Conrad
On Jun 30, 2008, at 12:36 AM, Matthew Petach wrote: If my company pays for and registers a new TLD, let's call it smtp for grins, and I create an A record for smtp. in my top level zone file, how will users outside my company resolve and reach that address? I suspect the assumption is that no

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-30 Thread David Conrad
On Jun 30, 2008, at 1:53 AM, Phil Regnauld wrote: But considering the amount of flag waving and Caution: Wet Floor signs ICANN placed when it rolled out something has harmless as the IDN tests in the root, I'm surprised that they haven't thought about all the

Re: what problem are we solving? (was Re: ICANN opens up Pandora's Box of new TLDs)

2008-06-28 Thread David Conrad
On Jun 27, 2008, at 6:11 PM, Jean-François Mezei wrote: But my uneducated opinion is that this current project appears to let the .TLD loose and this will result in top level domains being meaningless, without any trust. Given the complexity of the new gTLD process, I think it safe to say

Re: what problem are we solving? (was Re: ICANN opens up Pandora's Box of new TLDs)

2008-06-28 Thread David Conrad
On Jun 27, 2008, at 8:59 PM, WWWhatsup wrote: David Conrad wrote: With that said, personally, I agree that more attention should be spent on the welfare of the registrants. Unfortunately, given I work for ICANN, my providing comments in the RAA public consultation along those lines would

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-28 Thread David Conrad
On Jun 28, 2008, at 4:19 AM, Raoul Bhatia [IPAX] wrote: Tony Finch wrote: On Thu, 26 Jun 2008, Jeroen Massar wrote: thinking of all the nice security issues which come along (home, mycomputer and .exe etc anyone ? :) .exe has the same security properties as .com not exactly, as a lot of

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-27 Thread David Conrad
Hi, On Jun 27, 2008, at 5:22 AM, Alexander Harrowell wrote: Well, at least the new TLDs will promote DNS-based cruft filtration. You can already safely ignore anything with a .name, .biz, .info, .tv suffix, to name just the worst. Does this actually work? The vast majority of spam I

Re: what problem are we solving? (was Re: ICANN opens up Pandora's Box of new TLDs)

2008-06-27 Thread David Conrad
On Jun 27, 2008, at 10:57 AM, Bill Nash wrote: I'd rather see ICANN spend time on current problems instead of making new ones. Out of curiosity, what are the problems you feel ICANN should be spending its time on? Regards, -drc

Re: what problem are we solving? (was Re: ICANN opens up Pandora's Box of new TLDs)

2008-06-27 Thread David Conrad
On Jun 27, 2008, at 11:58 AM, Phil Regnauld wrote: The process ensures that too few new TLDs will be created for it being a threat to VeriSign This remains to be seen, at least from my perspective. I have no idea how many TLDs are going to make it through the gauntlet or

Re: what problem are we solving? (was Re: ICANN opens up Pandora's Box of new TLDs)

2008-06-27 Thread David Conrad
On Jun 27, 2008, at 12:23 PM, Scott Francis wrote: If we can't even guarantee reliability with the small handful of TLDs currently in use, when we start introducing arbitrary new ones to anybody that can pay, I'm concerned that it's going to make user support even more of a headache I might

Re: what problem are we solving? (was Re: ICANN opens up Pandora's Box of new TLDs)

2008-06-27 Thread David Conrad
On Jun 27, 2008, at 2:02 PM, Scott Francis wrote: what little assurance we have that e.g. bankofamerica.com is the legitimate (or should I say, _a_ legitimate) site for the financial institution of the same name becomes less certain when we have e.g. bank.of.america, www.bankofamerica.bank,

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-27 Thread David Conrad
On Jun 27, 2008, at 1:32 PM, Roger Marquis wrote: Phil Regnauld wrote: As business models go, it's a fine example of how to build demand without really servicing the community. Of all the ways new tlds could have been implemented this has to be the most poorly thought out. Oh, no. There

Re: what problem are we solving? (was Re: ICANN opens up Pandora's Box of new TLDs)

2008-06-27 Thread David Conrad
On Jun 27, 2008, at 3:30 PM, Bill Nash wrote: On Jun 27, 2008, at 10:57 AM, Bill Nash wrote: Out of curiosity, what are the problems you feel ICANN should be spending its time on? For starters, has Verisign ever been sanctioned by ICANN for it's business practices, You mean like

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-26 Thread David Conrad
On Jun 26, 2008, at 1:34 PM, Ken Simpson wrote: How will ICANN be allocating these? https://par.icann.org/files/paris/GNSO-gTLD-Update-Paris22jun08.pdf Regards, -drc

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-26 Thread David Conrad
On Jun 26, 2008, at 8:12 PM, Jim Popovitch wrote: Is there any full disclosure clause in ICANN member contracts such that gifts from, or stock in, a Registrar would be declared? Not sure who an ICANN member would be. ICANN as a California 501c(3) has to publish all it's financial details.

Re: ICANN opens up Pandora's Box of new TLDs

2008-06-26 Thread David Conrad
On Jun 26, 2008, at 9:01 PM, Jean-François Mezei wrote: Does anyone know how if the new gTLD system will still give some veto power to some people over some domain names that are morally objectable to some people ? See pages 17 - 20 of

Re: Types of packet modifications allowed for networks

2008-06-02 Thread David Conrad
Only the end-to-end principle... Perhaps not relevant, but between any two consenting nodes, there can be severe mangling of headers as long as what comes out the other side looks pretty much the same as what went in. CSLIP is an example of this. Regards, -drc

Re: [NANOG] fair warning: less than 1000 days left to IPv4 exhaustion

2008-05-04 Thread David Conrad
On May 3, 2008, at 8:37 PM, Joel Jaeggli wrote: William Warren wrote: That also doesn't take into account how many /8's are being hoarded by organizations that don't need even 25% of that space. which one's would those be? While I wouldn't call it hoarding, can any single (non-ISP)

Re: [NANOG] fair warning: less than 1000 days left to IPv4

2008-05-04 Thread David Conrad
On May 4, 2008, at 11:37 AM, Tomas L. Byrnes wrote: The artifact of MIT and others having /8s while the entire Indian subcontinent scrapes for /29s, can hardly be considered optimal or right. While perhaps intended as hyperbole, this sort of statement annoys me as it demonstrates an

Re: [NANOG] fair warning: less than 1000 days left to IPv4 exhaustion

2008-05-02 Thread David Conrad
Has anyone ever figured out how to make multi-homing of customers who only have a /64 assigned to them work? Same way you make multi-homing of customers who only have a IPv4 /32 assigned to them work, i.e., not well. Maybe the world really will end, and it's all due to IPv6! Internet

Re: [Nanog] ATT VP: Internet to hit capacity by 2010

2008-04-20 Thread David Conrad
Not to defend ATT or the statement regarding capacity, but... On Apr 20, 2008, at 4:16 AM, Jorge Amodio wrote: The article is full of gaffes, just to mention one Internet exists, thanks to the infrastructure provided by a group of mostly private companies. I suspect this was referencing

2M today, 10M with no change in technology? An informal survey.

2007-08-25 Thread David Conrad
Hi, In another mailing list, someone has asserted that noone believes router vendors who say [they can support 2M routes today and 10M with no change in technology]. Or perhaps more accurately, the router vendors claiming this are being a bit disingenuous in that while it is possible

Re: large organization nameservers sending icmp packets to dns servers.

2007-08-08 Thread David Conrad
On Aug 8, 2007, at 8:59 AM, Jamie Bowden wrote: How is answering a query on TCP/53 any MORE dangerous than answering it on UDP/53? Really. I'd like to know how one of these security nitwits justifies it. It's the SAME piece of software answering the query either way. How many bytes of

Re: large organization nameservers sending icmp packets to dns servers.

2007-08-07 Thread David Conrad
Hi, On Aug 7, 2007, at 1:33 PM, Donald Stahl wrote: Can someone, anyone, please explain to me why blocking TCP 53 is considered such a security enhancement? It's a token gesture and does nothing to really help improve security. It does, however, cause problems. It has been argued that

<    1   2   3   4   5   >