Re: new DNS forwarder vulnerability

2014-03-15 Thread Jimmy Hess
On Fri, Mar 14, 2014 at 5:06 PM, Wayne E Bouchard w...@typo.org wrote: Have we ascertained if there is a typical configuration adjustment that can be made to reduce or eliminate the likelihood of impact? I think your best tactic is: Provide specified DNS resolver cache servers. Don't use

Re: Verizon FIOS issues in the Washington DC issue with HTTPS traffic?

2014-03-15 Thread William Herrin
On Fri, Mar 14, 2014 at 4:28 PM, Ulf Zimmermann u...@alameda.net wrote: We have a number of customers in the DC area on Verizon Fios who can talk to us using http, but not https. Linkedin also tweeted there are issues via Verzion Fios. Verizon support so far denies everything. Anyone else

Re: new DNS forwarder vulnerability

2014-03-15 Thread Gary Baribault
Why would a CPE have an open DNS resolver from the WAN side? Gary Baribault On 03/14/2014 12:45 PM, Livingood, Jason wrote: Well, at least all this CPE checks in for security updates every night so this should be fixable. Oh wait, no, nevermind, they don't. :-( This is getting to be the

Re: new DNS forwarder vulnerability

2014-03-15 Thread Joe Greco
Why would a CPE have an open DNS resolver from the WAN side? Honest to god, are you new to computers or something? People have been writing just good enough code since the beginning. A resolver package binds to *:53 by default. Some poor firmware guys with no security experience, deadlines,

Re: US to relinquish control of Internet

2014-03-15 Thread Florian Weimer
* John R. Levine: Let's hope you're right, but I note that the ITU isn't an inter-governmental organization, It was able to obtain a delegation for ITU.INT, so it's inter-governmental enough in DNS terms.

Re: new DNS forwarder vulnerability

2014-03-15 Thread Laszlo Hanyecz
Good question, but the reality is that a lot of them are this way. They just forward everything from any source. Maybe it was designed that way to support DDoS as a use case. Imagine a simple iptables rule like -p udp --dport 53 -j DNAT --to 4.2.2.4 I think some forwarders work this way - the

Re: new DNS forwarder vulnerability

2014-03-15 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 That's a good question, but I know that during the ongoing survey within the Open Resolver Project [http://openresolverproject.org/], Jared found thousands of CPE devices which responded as resolvers. Further work needs to go into fingerprinting

Re: US to relinquish control of Internet

2014-03-15 Thread John Levine
Let's hope you're right, but I note that the ITU isn't an inter-governmental organization, It was able to obtain a delegation for ITU.INT, so it's inter-governmental enough in DNS terms. Yes, it was delegated a month before TPC.INT was. Could you clarify the point you're making? R's, John

Re: US to relinquish control of Internet

2014-03-15 Thread Bob Evans
(As if the US has control anyway) It's all over the popular press, strange I haven't seen it here. http://thehill.com/blogs/hillicon-valley/technology/200889-us-to-relinquish-internet-control

Re: US to relinquish control of Internet

2014-03-15 Thread Larry Sheldon
On 3/15/2014 7:39 AM, Bob Evans wrote: It's nice of the DoC to relinquish control, but I really don't see it changing much other than quieting down some hype from countries that were saying they were pissed at the US for controlling the Internet. And I couldn't really see those countries doing

Re: US to relinquish control of Internet

2014-03-15 Thread Miles Fidelman
Bob Evans wrote: (As if the US has control anyway) It's all over the popular press, strange I haven't seen it here. http://thehill.com/blogs/hillicon-valley/technology/200889-us-to-relinquish-internet-control

Re: US to relinquish control of Internet

2014-03-15 Thread Jimmy Hess
On Sat, Mar 15, 2014 at 12:17 PM, John Levine jo...@iecc.com wrote: Let's hope you're right, but I note that the ITU isn't an inter-governmental organization, It was able to obtain a delegation for ITU.INT, so it's inter-governmental enough in DNS terms. Yes, it was delegated a month

Re: US to relinquish control of Internet

2014-03-15 Thread John R. Levine
The ITU is an agency of the United Nations.Which is an organization created by treaty, of which various nations' governments are members. Actually, the ITU is more than twice as old as the UN, and merged with the UN in 1947. As noted in a previous message, the ITU has both government

Re: US to relinquish control of Internet

2014-03-15 Thread Wayne E Bouchard
On Sat, Mar 15, 2014 at 08:08:47PM -0400, John R. Levine wrote: The ITU is an agency of the United Nations.Which is an organization created by treaty, of which various nations' governments are members. Actually, the ITU is more than twice as old as the UN, and merged with the UN in

Re: US to relinquish control of Internet

2014-03-15 Thread John R. Levine
What's the worst they can do at this point? Make .bobtodd and .bubbagump TLDs? This is different from some of the crap we've got now in what way?? Well, ICANN has come pretty close to delegating .HOME and .CORP to domain speculators, despite the vast amount of informal use which would get

Re: US to relinquish control of Internet

2014-03-15 Thread Owen DeLong
What's the worst they can do at this point? Make .bobtodd and .bubbagump TLDs? This is different from some of the crap we've got now in what way?? I’m not too worried about what they could do to TLDs… It would be hard to make a bigger mess than ICANN already has. On the other hand, I am

Re: US to relinquish control of Internet

2014-03-15 Thread Miles Fidelman
Owen DeLong wrote: What's the worst they can do at this point? Make .bobtodd and .bubbagump TLDs? This is different from some of the crap we've got now in what way?? I’m not too worried about what they could do to TLDs… It would be hard to make a bigger mess than ICANN already has. On the

Re: US to relinquish control of Internet

2014-03-15 Thread Jimmy Hess
On Sat, Mar 15, 2014 at 9:36 PM, Owen DeLong o...@delong.com wrote: On the other hand, I am very concerned about what they would do to the numbers side of things.. Just keep their grubby paws off the IETF and the internet standards process. I doubt there's much reason for concern. IPv4