Re: Thank you, Comcast.

2016-02-26 Thread John Levine
>The difference in blocking any of the existing ports on your list and >blocking UDP/1900 is that the ports on your list are all registered >ports. Port 1900 is not registered - IANA is under the impression it's registered for SSDP. Do you have some reason to believe they're mistaken? http://w

Re: Thank you, Comcast.

2016-02-26 Thread John Levine
>> A certain number of us work from home and connect to headquarters with >> a VPN. and have SIP phones, you know. > >Not typically via/requiring the protocols you mentioned. The VoIP phones sure use SIP. R's, John

Re: Thank you, Comcast.

2016-02-26 Thread John Levine
>True, but how prevalent are 'bare' SIP phones vs. VoIP systems utilized >by remote workers via VPNs? Dunno, but I have two of them. I think that most if not all of the consumer over the top VoIP phones like Vonage use SIP. R's, John

Re: finding whois servers, was .pro whois registry down?

2016-03-10 Thread John Levine
> _whois._tcp.pro. srv 0 100 43 whois.afilias.net. A swell idea, but unfortunately the idea of putting SRV records in gTLD zones makes heads at ICANN explode. For RDAP there's a registry at IANA but it's not populated yet and it's not obvious that registries will be any more diligent about

Re: GeoIP database issues and the real world consequences

2016-04-11 Thread John Levine
In article <90136824.12309.1460396310889.JavaMail.mhammett@ThunderFuck> you write: >So they launch exhaustive and expensive searches of lakes instead? :-) I'm starting a new chain of kiosks that rent wet suits and snorkels. R's, John

Re: GeoIP database issues and the real world consequences

2016-04-11 Thread John Levine
>The problem with MaxMind (and other geoip databases I've seen that do Lat/Long >as well as Country / State / Town) is that the >data doesn't include uncertainty, so it returns "38.0/-97.0" rather than >"somewhere in a 3000 mile radius circle centered on >38.0/-97.0". > >Someone should show them

Re: GeoIP database issues and the real world consequences

2016-04-12 Thread John Levine
In article <20160411191347.gc4...@excession.tpb.net> you write: >* baldur.nordd...@gmail.com (Baldur Norddahl) [Mon 11 Apr 2016, 21:02 CEST]: >>They should stop giving out coordinates on houses period. Move the >>coordinate to the nearest street intersection if you need to be that >>precise (I woul

Re: GeoIP database issues and the real world consequences

2016-04-13 Thread John Levine
>There are similar problems with phone numbers. Google's libphonenumber, >for example, will tell you that +1 855 266 7269 is in the US. It's not, >it's Canadian. It appears that for any NANP "area code" that isn't >assigned to a particular place libphonenumber just says "it's in the US" >instead of

Re: phone fun, was GeoIP database issues and the real world consequences

2016-04-13 Thread John Levine
>> Actually, it's probably both US and Canadian. When you call an 8xx >> toll free number, the switch uses a database to route the call to >> whatever carrier handles it, who can then do whatever they want. The >> provider for that number, Callture, is in Ontario but they can >> terminate the cal

Re: phone fun, was GeoIP database issues and the real world consequences

2016-04-13 Thread John Levine
> And further to that, throw in Local Number Portability (LNP) and you > really need to know the full number in order to know which switch the > specific number is assigned to. Not all 408-921 prefixed numbers will go > to that switch in West San Jose. Right, like I said three messages ago but

Re: phone fun, was GeoIP database issues and the real world consequences

2016-04-13 Thread John Levine
>Is there the equivalent of BGP for number portability where every telco >has the full table of who owns each prefix as well as individual routes >for ported numbers ? Not really. There's a switch database used for routing calls, but that's different from LNP which is a layer sort of above that.

Re: phone fun, was GeoIP database issues and the real world consequences

2016-04-13 Thread John Levine
>I question whether (on a global scale) the odds are above 50-50 that a >number (other than a test line) is served by the switch NANPA associates >with the number. The people on nanog are not typical. I looked around for statistics and didn't find much, but it looks like only a few percent of n

Re: phone fun, was GeoIP database issues and the real world consequences

2016-04-14 Thread John Levine
>If they're land lines, the NPA/NXX will be local to the CO so you won't >have out-of-area numbers other than a rare corner case of a very >expensive foreign exchange line. If they're VoIP lines, the address is >*supposed* to be so registered, but softphones and even VoIP handsets >tend to move

Re: Verizon Policy Statement on Net Neutrality

2015-02-27 Thread John Levine
In article <11287607.8005.1425056798993.JavaMail.mhammett@ThunderFuck> you write: >More symmetry will happen when the home user does more things that care about >symmetry. It's a >simple allocation of spectrum (whether wireless, DSL or cable). MHz for upload >are taken out of MHz >for download.

Re: utility capacity, was Verizon Policy Statement on Net Neutrality

2015-02-27 Thread John Levine
>Water, gas, and to a great extent electrical systems do not work on >oversubscription, ie their aggregate capacity meets or exceeds the needs of >all their customers peak potential demand, at least from "normal" demand >standpoint. Hi, former municipal water and sewer commissioner here. We size

Re: Verizon Policy Statement on Net Neutrality

2015-02-27 Thread John Levine
In article <54f0d533.70...@vocalabs.com> you write: >My point is that the option should be there, at the consumer level. It is. Just throttle your download speed to match your upload speed. R's, John

Re: content regulation, was Verizon Policy Statement on Net Neutrality

2015-02-27 Thread John Levine
In article <54f0e159.2000...@satchell.net> you write: >One of the FUD items I keep seeing from some factions is that the FCC >will regulate content on the Internet in the same way as they did for >television during the time of the "fairness doctrine". I agree, that's not going to happen. With the

Re: Verizon Policy Statement on Net Neutrality

2015-03-01 Thread John Levine
In article <54f32f1a.9090...@meetinghouse.net> you write: >Scott, > >Asymmetric measured where? Between client and server or between >servers? I'm thinking the case where we each have a server running >locally - how do you get a high level of asymmetry in a P2P environment? There's always a lo

Re: content regulation, was Verizon Policy Statement on Net Neutrality

2015-03-01 Thread John Levine
In article <20150301124846.ga16...@gsp.org> you write: >On Sat, Feb 28, 2015 at 08:03:28PM -0500, John R. Levine wrote: >> Well, actually, it does. Every broadband network in the US >> currently blocks outgoing port 25 connections from retail customers. > >Unfortunately, that's not entirely true.

Re: content regulation, was Verizon Policy Statement on Net Neutrality

2015-03-01 Thread John Levine
In article <54f3d78a.5080...@satchell.net> you write: >On 03/01/2015 05:53 PM, Owen DeLong wrote: >> Business customers only get static from Comcast if they pay extra for it. > >That's also true for Charter. I know of one ISP offering DSL that gives >its customers static addresses. Only one. Tha

Re: Large Ontario DC busted for hosting petabytes of child abuse material

2015-03-02 Thread John Levine
In article <1c6ee78f6c1e400289fa7797f3ba6...@pur-vm-exch13n1.ox.com> you write: >Given the size and that the data is stored in encrypted RAR files, I wonder if >they >just busted a Usenet service provider rather than a P2P / file sharing site. Unlikely. There aren't that many large usenet provid

Re: FIXED - Re: Broken SSL cert caused by router?

2015-03-29 Thread John Levine
>SSLCertificateChainFile /etc/ssl/certs/gd_bundle-g2-g1.crt > >I have actually fixed it. Yeah, that's always it. Back in the good aulde days all of the SSL certs one might buy were signed directly by the CA, but now more often than not there are intermediate certs, and a valid cert needs to be ac

Re: Google's Gmail SMTP SSL has expired (again)

2015-04-04 Thread John Levine
I get a cert good through Dec 31. Certificate: Data: Version: 3 (0x2) Serial Number: 4993746626803195625 (0x454d5a195ce8dee9) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2 Validity Not Befo

Re: BGP offloading (fixing legacy router BGP scalability issues)

2015-04-06 Thread John Levine
In article you write: >On Fri, 3 Apr 2015, valdis.kletni...@vt.edu wrote: >> We've been down this road before - we've had our own problems on this >> side of the puddle with transit providers who refused to deal with problem >> customers because the provider billed by the packet, and the customers

Fixing Google geolocation screwups

2015-04-07 Thread John Levine
ewed up. Bing and other services correctly find him in Alabama. Poking around I see lots of advice about how to use Google's geolocation data, but nothing on how to update it. Anyone know the secret? TIA Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies

Thousands of hosts on a gigabit LAN, maybe not

2015-05-08 Thread John Levine
Some people I know (yes really) are building a system that will have several thousand little computers in some racks. Each of the computers runs Linux and has a gigabit ethernet interface. It occurs to me that it is unlikely that I can buy an ethernet switch with thousands of ports, and even if I

Re: Thousands of hosts on a gigabit LAN, maybe not

2015-05-08 Thread John Levine
>> to have 10,000 entries or more in its ARP table. > >Agreed. :) You don't really want 10,000 entries in a routing FIB >table either, but I was seriously encouraged by the work going >on in linux 4.0 and 4.1 to improve those lookups. One obvious way to deal with that is to put some manageable num

Re: [probably spam, from "NANOG" ]

2015-05-09 Thread John Levine
>> No test/plain? Delete without further ado. Sadly, it is no longer 1998. R's, John

Re: Thousands of hosts on a gigabit LAN, maybe not

2015-05-09 Thread John Levine
In article you write: >Juniper OCX1100 have 72 ports in 1U. Yeah, too bad it costs $32,000. Other than that it'd be perfect. R's, John

Re: Thousands of hosts on a gigabit LAN, maybe not

2015-05-09 Thread John Levine
>To the OP please do tell us more about what you are doing, it sounds >very interesting. There's a conference paper in preparation. I'll send a pointer when I can. R's, John

Re: Spamhaus BGP feed experiences?

2015-05-19 Thread John Levine
In article <555b8313.5080...@netassist.ua> you write: >How much false positives (i.e. blackholing traffic users want to reach)? Very little. The DROP list, which is what's in the BGP feed, is a small subset of the SBL, and only includes blocks that send no legitimate traffic at all. > >On 18.05

Re: bing on v6

2015-05-21 Thread John Levine
>And www.frontier.com has been broken for 6 days. Works fine for me over v6 although the chain of TLS certificates looks kind of funky. R's, John

Re: gmail security is a joke

2015-05-26 Thread John Levine
In article you write: >Haha I cringe when I do a password recovery at a site and they either email >the current pw to me in plain text or just as bad reset it then email it in >plain text. Its really sad that stuff this bad is still so common. If they do a reset, what difference does it make whe

grepcidr 2.99

2015-06-09 Thread John Levine
number of patterns other than running out of memory. Find it here: http://www.taugh.com/grepcidr-2/ Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. http://jl.ly

Re: grepcidr 2.99

2015-06-10 Thread John Levine
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 In article <6dfdc9f9-ee28-4263-8e5b-eb751b35b...@dataix.net> you write: >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA256 > >Hi John, > >Great contribution. Thanks > >Might I make a suggestion? with the following command it gives Invalid CIDR. In >my u

Lists of VPN exit addresses?

2015-06-10 Thread John Levine
Does anyone keep lists of the exit addresses of public VPN services? I presume there is no need to explain why this would be of interest. R's, John

Re: Lists of VPN exit addresses?

2015-06-11 Thread John Levine
In article you write: > >On 10 Jun 2015, at 18:56, John Levine wrote: > >> I presume there is no need to explain why this would be of interest. Gee, I appear to have presumed wrong. My concrete application is vetting updates to the abuse.net contact database, to recognize people

Re: Anycast provider for SMTP?

2015-06-15 Thread John Levine
>but 'well behaved smtp clients' should already be falling back right? If you have multiple SMTP servers at the same priority, it's a pretty broken client that doesn't try them all until one works. That said, there is a depressing number of pretty broken SMTP clients. R's, John

Re: Anycast provider for SMTP?

2015-06-16 Thread John Levine
>Uh huh. The numbers are clear: 99.99% of the time it works. The other >0.01% of the time you're screwed and had better pray the user is one >of the ones you can afford to lose. > >Unicast TCP breaks too, but it has the virtue of being fixable 100% of the >time. I love the wry humor on the nanog

Re: DMARC in education

2015-06-17 Thread John Levine
In article you write: >Looking at implementing DMARC for my institution. What problem do you expect this to solve? This is a real question, since you can be 100% sure that any DMARC policy will wreak havoc on any of your users who use mailing lists like this one. Academic institutions tend to

Re: Is it safe to use 240.0.0.0/4

2015-06-17 Thread John Levine
>IIRC, the short answer why it wasn't repurposed as additional unicast >addresses was that too much deployed gear has it hardcoded as >"reserved, future functionality unknown, do not use." Following an >instruction to repurpose 240/4 as unicast addresses, such gear would >not receive new firmware o

Re: OK, Google. Time to dial back the AI hype.

2015-06-30 Thread John Levine
>Is the WSJ a wholly owned subsidiary of GOOG? It looks to me like a WSJ >journalist said that. If you read the paper, which is linked from the article and takes about five minutes, you'll find that article is cheap clickbait and has approximately nothing to do with the topic of the paper. As f

Re: Dual stack IPv6 for IPv4 depletion

2015-07-04 Thread John Levine
In article you write: >But what is the "best compromise" strategy? Dual stack + CGN? Some kind of >intelligent 6to4 NAT? Depends on the application(s). One that seems to work OK is to dual stack everyone and put them behind a NAT unless they ask to have a private IP. Depending on who your cust

Re: Overlay broad patent on IPv6?

2015-07-13 Thread John Levine
In article you write: >http://www.google.com/patents/US20130254423 This is not a patent. It is a patent application. Most applications do not turn into patents, or at least not with all of the claims included. If you look at the claims, which are what matter, this is for a rather specific hac

Re: Dual stack IPv6 for IPv4 depletion

2015-07-14 Thread John Levine
>I think it's reasonable to be at least somewhat judicious with our >spanking new IPv6 pool. That's not IPv4-think. That's just reasonable >caution. It's optimizing for the wrong thing. While the supply of IPv6 addresses exceeds any plausible demand, the supply of route slots in routers does not

Re: M$ no v6 or just me?

2015-07-14 Thread John Levine
In article you write: >Surely Microsoft has IPv6 connectivity? Is there a problem with my dns, or is >Microsoft not available over v6? Looks like it's your DNS. ; <<>> DiG 9.10.2-P2 <<>> www.microsoft.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR

Re: Dual stack IPv6 for IPv4 depletion

2015-07-15 Thread John Levine
>Same way it happens today. Business starts out small, uses IP space from >their single ISP. Couple years later, they're bigger and want to dual-home >for better uptime or other reasons. Unless there is something stopping them >from advertising their ISP 'A' space out to ISP 'B' in IPv6 land, we

Re: Dual stack IPv6 for IPv4 depletion

2015-07-15 Thread John Levine
>I suspect a 16 /8 right about now would be very welcome for everybody >other then the ipv6 adherents. It would, if the software supported it. But it doesn't. Is there any reason to think the world would update its TCP stacks to handle those extra IPv4 addresses any sooner than it'd update its s

Re: Dual stack IPv6 for IPv4 depletion

2015-07-16 Thread John Levine
>Just as nobody is preventing you from going ipv6 only right now, I >advocate against hindering anybody going ipv4 only for as long as they >want/can. Nobody's hindering you. You can get NAT boxes of all shapes and sizes. If you want to mess around with class E addresses on your own network, g

Re: GoDaddy : DDoS : : Contact

2015-08-02 Thread John Levine
>> DDoS = multiple IPs >> >> DoS = single IP > >It seems most people colloquially use DDoS for both, and reserve DoS for >magic-packet blocking exploits like the latest BIND CVE, FYI. Given how easy it still is to put a fake source address in an IP packet, it seems optimistic to assume that just

Re: Need help in flushing DNS

2013-06-19 Thread John Levine
>Reaching out to DNS operators around the globe. Linkedin.com has had some >issues with DNS >and would like DNS operators to flush their DNS. If you see www.linkedin.com >resolving NS to >ns1617.ztomy.com or ns2617.ztomy.com then please flush your DNS. > >Any other info please reach out to me off

Re: This is a coordinated hacking. (Was Re: Need help in flushing DNS)

2013-06-21 Thread John Levine
>"Registrar Primary" and "Registrar Auditor" There are certainly registrars who are more security oriented than Netsol. If you haven't followed all of the corporate buying and selling, Netsol is now part of web.com, so their business is more to support web hosting than to be a registrar. I expec

Re: This is a coordinated hacking. (Was Re: Need help in flushing DNS)

2013-06-21 Thread John Levine
In article <001a01ce6ef9$bf74d4a0$3e5e7de0$@iname.com> you write: >It's 120M if you add the .COM and the .NET's together, both of which NetSol >is responsible for. >http://www.verisigninc.com/en_US/products-and-services/domain-name-services/ >registry-products/tld-zone-access/index.xhtml In late b

Re: /25's prefixes announced into global routing table?

2013-06-21 Thread John Levine
> The forwarding hardware is generally going to be the limit, and >that's going to be painful enough as we approach a half million >prefixes. I would expect that we might finally see some pushback against networks that announce lots of disaggregated prefixes. The current CIDR report notes t

Re: .nyc - here we go...

2013-07-02 Thread John Levine
>I haven't read enough, but what's to stop speculators >paying the $186,000 then ... Rather than asking random strangers, you can read the applicant guidebook and find out what the actual rules are: http://newgtlds.icann.org/en/applicants/agb

Re: .nyc - here we go...

2013-07-02 Thread John Levine
>Rather than asking random strangers, you can read the applicant >guidebook and find out what the actual rules are: > >http://newgtlds.icann.org/en/applicants/agb > >Ok, you're correct. I need to add that to my list of reading. >I am just thinking about the digital divide getting larger >(not sma

Re: .nyc - here we go...

2013-07-04 Thread John Levine
>> "As of July 2, 2013, .nyc has been approved by ICANN as a >> city-level top-level domain (TLD) for New York City" > >Do they have DNSSEC from inception? It would seem a sensible thing to do >for a virgin TLD. Yes. See the AGB, to which I sent a link a few messages back.

Re: .nyc - here we go...

2013-07-04 Thread John Levine
>Anyone care to advance evidence that either zone has been, not "will >someday be", significantly improved by the adoption of DS records? >Evidence, not rhetoric, please. I dunno. Can you point to parts of your house that have been significantly improved by fire insurance?

Re: .nyc - here we go...

2013-07-04 Thread John Levine
>I'll bite. What's the *actual* additional cost for dnssec and ipv6 >support for a greenfield rollout? It's greenfield, so there's no >"our older gear/software/admins need upgrading" issues. I've read the IPv6 and DNSSEC parts of a lot of the applications, including the ones that aren't backed b

Re: .nyc - here we go...

2013-07-04 Thread John Levine
>Why are the people who don't follow the shitty process so full of >confidence they have all the clue necessary? Probably because they don't think that new TLDs are particularly useful or valuable. R's, John

Re: Helix Solutions

2013-07-05 Thread John Levine
>No seems US company. >http://www.helixsolutions.net/ They're registered at internet.bs with a private registration in Panama. What more do you need, a big flashing skull and crossbones?

Re: whois.internic.net / whois.crsnic.net IPv6 timeouts

2013-07-10 Thread John Levine
> Don't know if it'll help or if this is simply old news to most, but > the whois systems (whois.internic.net/whois.crsnic.net) have > records and happily answer TCP/43 requests w/ the usual blurb, but all > the servers I've hit then fail to actually provide data and instead > the whois c

Re: hotel networks, was One of our own in the Guardian.

2013-07-14 Thread John Levine
>I suspect the problem is the (offsite) hotel that Mark and I are at was not >really prepared for a full house of folks interested in viewing streams, >downloading documents, etc. (despite attempts to inform the hotel of the >impending tsunami). I imagine folks involved in setting up NANOG-related

Is the FBI's DNSSEC broken?

2013-08-30 Thread John Levine
I don't claim to be a big DNSSEC expert, but this looks just plain wrong to me, and unbound agrees, turning it into a SERVFAIL. Here's a lookup that succeeds, an A record for mail.ic.fbi.gov: $ dig @ns1.fbi.gov mail.ic.fbi.gov a +dnssec ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7222 ;;

Re: Is the FBI's DNSSEC broken?

2013-09-03 Thread John Levine
>> On Fri, Aug 30, 2013 at 10:27:36PM +, John Levine wrote: >> > I don't claim to be a big DNSSEC expert, but this looks just plain >> > wrong to me, and unbound agrees, turning it into a SERVFAIL. I heard back, seems like I found someone at the FBI who was a

Re: Yahoo is now recycling handles

2013-09-04 Thread John Levine
In article you write: >> To their (partial) credit they are also supporting a new email header : >> Require-Recipient-Valid-Since: > >with no X- before it? Well, yes: draft-wmills-rrvs-header-field-01.txt R's, John

Re: Is the FBI's DNSSEC broken?

2013-09-04 Thread John Levine
In article <52265aa4.6000...@free.fr> you write: >Le 03/09/2013 23:28, John Levine a écrit : >>>> On Fri, Aug 30, 2013 at 10:27:36PM +, John Levine wrote: >>>>> I don't claim to be a big DNSSEC expert, but this looks just plain >>>>> wro

Re: Is the FBI's DNSSEC no longer broken?

2013-09-09 Thread John Levine
>I heard back, seems like I found someone at the FBI who was able to >explain the problem to Neustar (DNS software provider) who say they >will fix it. Seems to be fixed now. Here's the formerly broken query, via unbound: ; <<>> DiG 9.8.3-P4 <<>> mail.ic.fbi.gov +dnssec ;; global options:

Re: The block message is 521 DNSRBL: Blocked for abuse

2013-09-18 Thread John Levine
>This is pathetic. ARIN is supposed to be working as a steward of this >IP space. When you have policies that make it more difficult to use the >IP space this isn't even remotely close to stewardship. It's pathetic, Unfortunately, a surprising number of "new" IP space owners turn out to be th

semi-ot: network monitoring tools

2013-10-01 Thread John Levine
I was talking to a bunch of people who run ISPs and other networks in LDCs (yes, including Nigeria) and someone asked about monitoring tools to watch traffic on his network so he can get advance warning of dodgy customers and prevent complaints and blacklisting. These people are plenty smart, but

Re: comcast ipv6 PTR

2013-10-09 Thread John Levine
>If people really want to use generic reverse names and have realised >that the v6 address space is much too big for $GENERATE, one approach is >to delegate the appropriate zones to a custom nameserver that can >auto-generate PTRs on demand. There are scaling problems here, but >probably nothing th

Re: comcast ipv6 PTR

2013-10-14 Thread John Levine
>Is there any reason other than email where clients might demand RDNS? There's a few other protocols that want rDNS on the servers. IRC maybe. Doing rDNS on random hosts in IPv6 would be very hard. Servers are configured with static addresses which you can put in the DNS and rDNS, but normal us

Re: comcast ipv6 PTR

2013-10-14 Thread John Levine
>it's a lot of work for example.com to return something like: > > 2001-0db8-85a3-0042-1000-8a2e-0370-7334.example.com Add some NSEC3 records and, yeah, it's a lot of work. And for what?

Re: Reverse DNS RFCs and Recommendations

2013-10-31 Thread John Levine
>Mail admins wanting matching forward/reverse DNS and hostnames that >don't "look dynamically generated" is probably more of a human than an >RFC thing: Right. Spam filtering depends on heuristics. Mail from hosts without matching forward/reverse DNS is overwhelmingly bot spam, so checking for

Re: Reverse DNS RFCs and Recommendations

2013-10-31 Thread John Levine
>In the last few hours it has picked off multiple messages from each of these: >caro...@8447.com >jef...@3550.com >ronal...@0785.com >kevi...@2691.com >debora...@3585.com >kimberl...@5864.com >sara...@0858.com >zav...@131.com >qgmklyy...@163.com >pjp...@163.com >fahu...@163.com >danie...@4704.com >

Re: How anti-NSA backlash could fracture the Internet along national borders - The Washington Post

2013-11-02 Thread John Levine
In article you write: >The balkanizing of the Net? > >http://www.washingtonpost.com/blogs/worldviews/wp/2013/11/01/how-anti-nsa-backlash-could-fracture-the-internet-along-national-borders/ I expect we'll hear lots of pontification, quietly fading away when someone explains to the pontificators ju

Re: Email Server and DNS

2013-11-03 Thread John Levine
>MX, PTR, and SPF are really all you need. So far so good, noting that a host name that doesn't look generic is better than one that does. > I would recommend you go a >step further and use DKIM, ADSP, and DMARC. Using DKIM is a good idea. Do *not* use ADSP. It is a failed experiment which wil

What's going on with NTP?

2013-12-25 Thread John Levine
nt, or are there screwed up NTP servers? Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. http://jl.ly

Re: gmail.com - 550 error for ipv6/PTR ?

2014-01-14 Thread John Levine
In article you write: >Just saw this in a message tonight. No idea if this is a transient error >or not. I saw the same thing, on an IP that has forward and reverse DNS and mail that passes SPF. Burp, I guess.

Re: gmail.com - 550 error for ipv6/PTR ?

2014-01-15 Thread John Levine
>It occurs to me, you may have sent a bounce, where the envelope from is empty, >therefore SPF would work on the domain in the helo/ehlo. People often >forget to put a SPF record there... So there may be no SPF in fact... Nope. In this case, Google was just messed up. R's, John

Re: Experiences with Spamhaus BGP DROP, EDROP and BGPCC BGP feeds

2014-01-16 Thread John Levine
In article <030101cf0e0e$71088af0$5319a0d0$@truenet.com> you write: >Looks like a bug, if you stick a 1 in total email users: >Per Year: $504.00 No, that's right. If you're a tiny little network, you can use the public DNS servers for the BL lookups, and you can FTP the text version of DROP

Where does "Downstream server error" come from?

2014-01-19 Thread John Levine
I had some problems with incoming mail that I tracked down to a configuration bug, two hosts on the same LAN configured to respond to the IP address of the MX. It's fixed now. While it was broken, attempts to send mail on some other systems got "421 Downstream server error." That is not a messag

Re: NetSol opts domain customers into $1800 Security program?

2014-01-22 Thread John Levine
>> No, and they haven't been for many years. You're thinking of >> Verisign. It owned NetSol at one time, but sold the registrar end >> (which is what's still called Network Solutions) in 2003. > >Well, it's sort of metaphysical to ask which company is which, but... NetSol and Verisign have been

Re: NetSol opts domain customers into $1800 Security program?

2014-01-22 Thread John Levine
>I suppose they COULD move their domain to a registrar that does >registrar-lock for 'free', but that's a cost too, right? man power, >configuration mistakes, other billing things to setup... 1800 might be >'ok' for someone who's making a bunch of money/day. right? That is the only plausible reaso

Re: Best practices for abuse@ mailbox and network abuse complaint handling?

2007-05-11 Thread John Levine
e desks. You still have to run your own abuse desk, but it does a lot of the grunt work for you. Regards, John Levine, [EMAIL PROTECTED], Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor "More Wiener

Re: Best practices for abuse@ mailbox and network abuse complaint handling?

2007-05-12 Thread John Levine
>> At least to file the obvious crap into a different folder that can be >> looked at and blown away > >Difficult, as spam complaints generally include the original spam and >thus trigger SpamAssassin (almost) just as hard. A complaint with copy of the original spam has headers in the body of t

Re: Best practices for abuse@ mailbox and network abuse complaint handling?

2007-05-13 Thread John Levine
>> I was hoping that there would be someplace like abuse.net where we >> could register our IPs and ASN, so non-NANOGers could know to >> contact network-abuse@ when they think our network is attacking them? That would be nice, wouldn't it? There's two reasons I don't do that. One is that un

Re: Interesting new dns failures

2007-05-24 Thread John Levine
line crime, spam, etc., I can report that pretty much all of the countries that matter realize there's a problem, and a lot of them have passed or will pass laws whether we like it or not. So it behooves us to engage them and help them pass better rather than worse laws. Regards, John Lev

Re: Interesting new dns failures

2007-05-25 Thread John Levine
>> who is asleep at the wheel or worse. For instance, there appears to be a >> '*.cm' wildcard in place, and several "flag of convenience" TLDs with a high > >cameroon outsourced their dns infrastructure management to someone In this case, the someone is in Vancouver B.C., and Canada is most de

Re: UK ISPs v. US ISPs (was RE: Network Level Content Blocking)

2007-06-11 Thread John Levine
is just plain wrong. Also, ISPs in the United States are not common carriers. Even the ISPs that are owned by phone companies (which are common carriers for their phone service) are not common carriers. Regards, John Levine, [EMAIL PROTECTED], Primary Perpetrator of "The Internet for Du

Re: UK ISPs v. US ISPs (was RE: Network Level Content Blocking)

2007-06-11 Thread John Levine
>So, although it should be noted that by and large ISPs have resisted >being classified telecommunications common carriers as specifically >defined in CA1934 they seem to be treated by the law, in practice, as >common carriers in the common law sense ... You're right, but the legal setup is flipp

Re: FBI tells the public to call their ISP for help

2007-06-13 Thread John Levine
>The fine people at the FBI are recommending people call their ISP for >home computer technical support, even though most ISPs don't sell >home computers, operating system software or application software. No, the ISPs merely sell the channel through which the home computers get infected with w

Re: FBI tells the public to call their ISP for help

2007-06-14 Thread John Levine
>Its not a technical problem (although engineers seem to like to think >everything is), its a legal issue with Microsoft's lawyer and licenses. I realize it's not a technical problem, although I suspect there are some technical twiddles that could help, e.g., persuading Microsoft to put the upda

Re: FBI tells the public to call their ISP for help

2007-06-14 Thread John Levine
>In general, creating a sandbox where a computer can only reach >$UPDATE_SERVER is very, very difficult. I believe it. Perhaps we could help Microsoft make it easier. The sandbox doesn't have to include all their servers, just enough of them to service the sandboxed users. > And, as much as

Re: Senderbase is offbase, need some help

2010-04-17 Thread John Levine
>I've tried to get the attention of senderbase, which is claiming >activity from my address space which is in fact either un-routed or >within dynamic subscriber blocks that have outbound smtp filtering in >effect. Unfortunately, senderbase refuses to acknowledge the problem in >their data

Re: Rate of growth on IPv6 not fast enough?

2010-04-19 Thread John Levine
>> Having made this bold claim, have you ever actually tried to run a natted >> eyeball network? The last two natted eyeball networks I worked with could >> never figure out which aspect of NAT hurt more: the technical side or the >> business side. My small telco-owned ISP NATs all of its DSL use

Re: Rate of growth on IPv6 not fast enough?

2010-04-20 Thread John Levine
>But regardless of what it is called people usually know what they >signed up for and when what has worked for the 5-6 years suddenly >breaks ... If a consumer ISP moved its customers from separate IPs to NAT, what do you think would break? I'm the guy who was behind a double NAT for several mont

Re: Rate of growth on IPv6 not fast enough?

2010-04-21 Thread John Levine
>And when ISPs start using NAT for their customers, there will be more >problems leading to more support calls. You say this as though they don't do it now. R's, John

Re: Starting up a WiMAX ISP

2010-04-27 Thread John Levine
>I live in central / western New York state (think villages and farms). You might want to start by talking to Lightlink in Ithaca, which has been doing fixed wireless for years. R's, John

Re: Starting up a WiMAX ISP

2010-04-27 Thread John Levine
>+ I have those numbers I can beat the pavement and find out what people >will pay for my service and then I will know based on my table if there >is a snowball's chance in hell of this working. Don't forget that you're competing against rural ILECs that drink deeply from the well of USF funding.

<    1   2   3   4   5   6   7   8   >