Re: Texas internet connectivity declining due to blackouts

2021-02-22 Thread Stephen Satchell
When I lived in Oklahoma, the mantra of the locals was "if you don't like the weather, wait five minutes." As a member of a Boy Scout troop in the northern part of the Sooner State, we were told, repeatedly, to expect anything from broiling to deep freeze on our campouts. One such outing was

BGP38 egress filter on Ubuntu Server

2021-06-01 Thread Stephen Satchell
Before I re-invent the wheel, has anyone come up with blackhole route specifications for netplan in Ubuntu servers? Such a capability would perform the egress blocking for an edge server. The table of blackhole routes I would set up: IPv4 Address block Scope Description 0.0.0.0

BCP38 on public-facing Ubuntu servers

2021-06-01 Thread Stephen Satchell
Not every uplink service implements BCP38. When putting up servers connected more-or-less directly to the Internet through these uplinks, it would be nice if the servers themselves were able to implement ingress and egress filtering according to BCP38. (Sorry about the typo in the subject lin

Re: BCP38 on public-facing Ubuntu servers

2021-06-08 Thread Stephen Satchell
On 6/8/21 2:38 PM, Fran via NANOG wrote: Hey, to my knowledge there is no IPv6 equivalent for net.ipv4.conf.all.rp_filter. Therefore I use netfilter to do the RP filtering for both address families. ip(6)tables -t raw -I PREROUTING -m rpfilter --invert -j DROP Using the raw tables less reso

A crazy idea

2021-07-19 Thread Stephen Satchell
First, I know this isn't the right place to propose this; need a pointer to where to propose an outlandish idea. PROBLEM: IPv6 support is still in its birthing pangs. I see a problem that limits deployment of IPv6 fully: reverse PTR records in the ".in6.arpa." zones. (Now that I think abo

Re: A crazy idea

2021-07-19 Thread Stephen Satchell
On 7/19/21 5:41 AM, Feldman, Mark wrote: What you propose is not outlandish; some ISPs have been dual stack and providing some combination of these services for years. They already provide IPv6 ip6.arpa delegations should their business customers want them. Some even provide at least a /56 so c

Re: ATT Microcell in Austin, TX

2020-02-18 Thread Stephen Satchell
There is power backup and then there is power backup. The former is a small power pack (batteries, supercapacitors, whatever) that will allow the microcell to weather a short blackout or brownout. We are talking seconds, to bridge switching transits. To be useful in a deployment, such a holdo

Re: Chairman Pai Proposes Mandating STIR/SHAKEN To Combat Robocalls

2020-03-08 Thread Stephen Satchell
On 3/8/20 9:59 AM, Damian Menscher via NANOG wrote: In the robocall case, there*is* something the end user can do to fight the abuse: answer every call, and keep them on the line as long as possible. They are paying for connected calls, for the connection duration, and for the humans to scam peo

Re: Chairman Pai Proposes Mandating STIR/SHAKEN To Combat Robocalls

2020-03-08 Thread Stephen Satchell
On 3/8/20 4:00 PM, b...@theworld.com wrote: As I've said before what would likely work is if every time one of us (in the US anyhow) got a junk call we immediately called our congressional and/or senate office(s) and simply said "just got another junk call! (optionally add description.)" Doesn'

Re: Abuse Desks

2020-04-29 Thread Stephen Satchell
On 4/29/20 8:41 AM, Mel Beckman wrote: Is there any reason to have a root-enabled (or any) ssh server exposed to the bare Internet? Any at all? Can you name one? I can’t. That’s basically pilot error. Remember HeartBleed? That didn't require a rout-enabled SSH server. It didn't require SSH s

Re: Abuse Desks

2020-04-29 Thread Stephen Satchell
On 4/29/20 9:24 AM, Mukund Sivaraman wrote: If there's a lock on my door, and someone tries to pick it, you can call me at fault for having a lock on my door facing outside all you want. But the thief picking it has no business doing so, and will be guilty of a crime if caught. This is a good s

Re: Abuse Desks

2020-04-29 Thread Stephen Satchell
On 4/29/20 9:57 AM, Mike Hammett wrote: My routers have ACLs, but my servers for the most part do not. I'm not trying to argue, but...what servers do you have that don't have sysadmin-definable firewalls and tun-able knobs? My edge routers are Linux boxes (CentOS 8 for the one I'm now buildi

Re: Mystery CDN

2020-06-17 Thread Stephen Satchell
On 6/17/20 8:29 AM, Clinton Work wrote: I'm struggling to determine which CDN owns the servers in CenturyLink prefix 8.240.0.0/12. During the Call of Duty Season 4 update on June 11th from 06:00 UTC until 08:30 UTC, we had 240 Gbps of traffic steaming into our network from CenturyLink prefix

Re: The great Netflix vpn debacle! (geofeeds)

2021-09-03 Thread Stephen Satchell
On 9/3/21 6:54 AM, Mark Tinka wrote: Everyone that I know who spends most of their time writing code can't get enough screens :-). Size matters, too. For example, I have a 54" screen. My record is twelve open (tiled) code windows. Usually, I have three or four code windows and a LibreWrite

Re: Never push the Big Red Button

2021-09-15 Thread Stephen Satchell
In the data centers I've worked in over the decades, those Big Red Buttons would activate a normally-closed contactor in a breaker panel. When pushed, the contactor would open, and turn off all the circults in said breaker panel. Not affected are lights, convenience outlets, door locks, and ot

Re: IPv6 woes - RFC

2021-09-18 Thread Stephen Satchell
ord created for Host name you would > like that IP address pointed to > Thanks Michael AT&T Prov-DNS -Original Message- From: Stephen Satchell Sent: Friday, July 16, 2021 5:42 PM To: DNSUpdates cB Subject: Need IPv6 PTR record for my IPv6 mail server Here is the record

Re: IPv6 woes - RFC

2021-09-18 Thread Stephen Satchell
On 9/18/21 8:58 PM, Owen DeLong wrote: I haven’t tried the PTR thing yet, but I do have a small business client that has AT&T business internet and they were able to get a static /56 (For some reason, AT&T refused to do a /48, but we did push them on it.) When I checked, there were NO options

Re: IPv6 woes - RFC

2021-09-19 Thread Stephen Satchell
On 9/18/21 11:20 PM, Masataka Ohta wrote: Mark Andrews wrote: > There is nothing at the protocol level stopping AT&T offering a > similar level of service. Setting up reverse DNS lookup for 16B address is annoying, which may stop AT&T offering it. How many mail servers are on the Internet t

Re: Contacts wanted: OVH, DigitalOcean, and Microsoft (Deutschland)

2019-03-18 Thread Stephen Satchell
On 3/18/19 11:17 PM, Ronald F. Guilmette wrote: > I am not sure that there is any other way that a lone outsider can or > could engage either OVH or DigitalOcean in a way that would actually > cause either company to take action on the issues I've reported on. > Complaints from ordinary Internet en

Re: GPS WNRO April 6th at GPS Midnight

2019-04-04 Thread Stephen Satchell
On 4/3/19 3:32 PM, brutal8z via NANOG wrote: > I've not seen any mention of this here, so it might be off-topic, if so, > sorry in advance. If you use GPS for time synchronization, this might be > important.The Juniper ACX500 series and the Cisco 819 both have an > embedded GPS receivers, for examp

Re: Comcast storing WiFi passwords in cleartext?

2019-04-24 Thread Stephen Satchell
On 4/24/19 7:24 AM, Tom Beecher wrote: > This is why, in my opinion, people should avoid modem/router combo units > whenever possible. Any information/configuration entered into such a device > could be accessible to the MSO (intentionally or otherwise) , as is > happening here. I'm sure they would

Re: Comcast storing WiFi passwords in cleartext?

2019-04-25 Thread Stephen Satchell
On 4/24/19 9:32 PM, Mike Bolitho wrote: >> >> "than the relatively low risk of a database compromise leading to a >> miscreant getting ahold of their wireless password and using their access >> point as free wifi." >> > > And this is the thing, not only does someone have to 'hack' the database, >

Re: NTP question

2019-05-01 Thread Stephen Satchell
One word of caution when using a low-priced NTP appliance: your network activity could overwhelm the TCP/IP stack of the poor thing, especially if you want to sync your entire shop to it. In the case of the networks I set up, I set up a VLAN specific to the NTP appliance and to the two servers tha

Re: Charter and Cox contacts

2019-05-13 Thread Stephen Satchell
On 5/13/19 12:11 PM, dan...@pyranah.com wrote: > Does anyone have contacts at Charter (Spectrum) and Cox? For some reason, > our IP has been blocked by them and our customers are unable to send email > via their charter/cox accounts. Thanks Would you be talking about port 25/tcp outbound? Lots o

Re: CloudFlare issues?

2019-06-25 Thread Stephen Satchell
On 6/25/19 2:25 AM, Katie Holly wrote: > Disclaimer: As much as I dislike Cloudflare (I used to complain about > them a lot on Twitter), this is something I am absolutely agreeing with > them. Verizon failed to do the most basic of network security, and it > will happen again, and again, and again.

Re: FCC workshop: Security vulnerabilities within our communications networks

2019-06-26 Thread Stephen Satchell
On 6/26/19 2:17 PM, Scott Weeks wrote: > > --- s...@donelan.com wrote: > From: Sean Donelan > > If they come up with a better idea, that's great. I'll > take good ideas from anywere. In my experience, "design by committee" is most successful when one or two people take the bull by the horns

Intermittent "bad gateway"

2019-07-02 Thread Stephen Satchell
Are we having another BGP problem this morning?

Re: 44/8

2019-07-22 Thread Stephen Satchell
On 7/22/19 12:15 PM, Naslund, Steve wrote: > 1. A lot of existing code base does not know how to handle those > addresses and may refuse to route them or will otherwise mishandle > them. Not to mention all the legacy devices that barely do IPv4 at all, and know nothing about IPv6. Legacy dev

Re: Feasibility of using Class E space for public unicast (was re: 44/8)

2019-07-27 Thread Stephen Satchell
On 7/27/19 2:18 PM, Randy Bush wrote: > something is broken on the nanog list. usually we have this discussion > twice a year. this time it may have been a couple of years gap. what > broke? 44/8. Sucked up all the oxygen.

Re: really amazon?

2019-07-31 Thread Stephen Satchell
On 7/31/19 12:04 PM, Valdis Klētnieks wrote: > On Wed, 31 Jul 2019 16:36:08 -, Richard Williams via NANOG said: > >> To contact AWS SES about spam or abuse the correct email address is >> ab...@amazonaws.com > > You know that, and I know that, but why doesn't the person at AWS whose job it

Re: really amazon?

2019-07-31 Thread Stephen Satchell
On 7/31/19 1:28 PM, Brian J. Murrell wrote: > On Wed, 2019-07-31 at 23:13 +0300, Scott Christopher wrote: >> >> Because it will get spammed if publicly listed in WHOIS. > > I will take that at *least* as ironic as you meant it. I don't know about your network, but I have five role mail accounts,

Re: User Unknown (WAS: really amazon?)

2019-08-04 Thread Stephen Satchell
On 8/3/19 9:15 PM, John Curran wrote: > As I have noted previously, I have zero doubt in the enforceability > of the ARIN registration services agreements in this regard – so > please carefully consider proposed policy both from the overall > community benefit being sought, and from the implication

Re: User Unknown (WAS: really amazon?)

2019-08-09 Thread Stephen Satchell
On 8/9/19 4:03 PM, Matthew Petach wrote: > ...apparently Amazon has become a public utility > now? > > I look forward with bemusement to the PUC > tariff filings for AWS pricing. ^_^;; Don't scoff too hard. How do you think that telephone service became a utility? Utilities didn't grow on tree

Re: User Unknown (WAS: really amazon?)

2019-08-13 Thread Stephen Satchell
On 8/13/19 3:10 PM, Matthew Petach wrote: > With a global company, there's no such thing > as a local natural monopoly in play; how would > you assign oversight to a global entity? Which > "public" would be the ones being protected? > The city of Seattle, WA, where Amazon is > headquartered? The

DNS cache hold of SERVFAIL responses

2019-08-25 Thread Stephen Satchell
This is for any Google admin on this list: When you receive a SERVFAIL from a name server listed as authoritative for a given domain, how long is that negative look-up cached? When you receive a SERVFAIL from the root servers, how long is that negative lookup cached? Does Google follow RFC 2308?

Re: Weekly Routing Table Report

2019-09-02 Thread Stephen Satchell
On 9/2/19 4:40 PM, Seth Mattinen wrote: > May the world come to an end if someone dares to have an independent > thought or shares original information that can't be backed up by at > least 50 crosschecked references. Actually, independent thought or original information is welcome to anyone with

Re: Elad Cohen, show us!

2019-09-19 Thread Stephen Satchell
On 9/19/19 2:47 AM, Elad Cohen wrote: > It is not related to nefarious activity as you wrote, FDCServers > policy is to stop routing any ranges which is in Spamhaus SBL (no > matter what), due to the phear from Spamhaus to list all of > FDCServers ranges in SBL, which was told to us in a documented

Elad Cohen, show us!

2019-09-19 Thread Stephen Satchell
On 9/19/19 2:47 AM, Elad Cohen wrote: > It is not related to nefarious activity as you wrote, FDCServers > policy is to stop routing any ranges which is in Spamhaus SBL (no > matter what), due to the phear from Spamhaus to list all of > FDCServers ranges in SBL, which was told to us in a documented

Re: IPv6 Thought Experiment

2019-10-02 Thread Stephen Satchell
On 10/2/19 9:33 AM, Antonios Chariton wrote: > Dear list, > First of all, let me apologize if this post is not allowed by the > list. To my best interpretation of the guidelines [1] it is allowed, but > may be in a gray area due to rule #7. > > I would like to propose the following thought experim

Update to BCP-38?

2019-10-02 Thread Stephen Satchell
Is anyone working on an update to include IPv6?

Re: Update to BCP-38?

2019-10-03 Thread Stephen Satchell
On 10/2/19 9:51 PM, Mark Andrews wrote: > What part of BCP-38 do you think needs to be updated to support IPv6? > > Changing the examples to use IPv6 documentation prefixes instead of IPv4 > documentation prefixes? For a start, *add* IPv6 examples in parallel with the IPv4 examples. As RFCs are

Re: Update to BCP-38?

2019-10-03 Thread Stephen Satchell
On 10/3/19 8:42 AM, Fred Baker wrote: > > >> On Oct 3, 2019, at 9:51 AM, Stephen Satchell wrote: >> >> Someone else mentioned that "IPv6 has been around for 25 years, and why >> is it taking so long for everyone to adopt it?" I present as evi

Re: Update to BCP-38?

2019-10-03 Thread Stephen Satchell
On 10/3/19 8:22 AM, Fred Baker wrote: > Speaking as v6ops chair and the editor of record for 1812. > draft-ietf-v6ops-ipv6rtr-reqs kind of fell apart; it was intended to be > an 1812-like document and adopted as such, but many of the > "requirements" that came out of it were specific to the author'

Re: Update to BCP-38?

2019-10-03 Thread Stephen Satchell
On 10/3/19 2:07 PM, Mark Andrews wrote: > Now IPv6 examples are nice but getting several 1000’s people to read draft > that > just add addresses in the range 2001:DB8::/32 instead of 11.0.0.0/8, > 12.0.0.0/8 > and 204.69.207.0/24, then to get the RFC editor to publish it is quite frankly > is a w

Re: Update to BCP-38?

2019-10-04 Thread Stephen Satchell
On 10/3/19 10:13 PM, Fred Baker wrote: > There is one thing in 1122/1123 and 1812 that is not in those kinds > of documents that I miss; that is essentially "why". Going through > 1122/1123 and 1812, you'll ind several sections that say "we require > X", and follow that with a "discussion" section

Re: IPv6 Pain Experiment

2019-10-07 Thread Stephen Satchell
On 10/7/19 4:37 AM, Valdis Klētnieks wrote: > On Mon, 07 Oct 2019 03:03:45 -0400, Rob McEwen said: >> Likewise for spam filtering - spam filtering would be knocked back to >> the stone ages if IPv4 disappeared overnight. IPv6 is a spam sender's >> dream come true, since IPv6 DNSBLs are practically

Re: dns cache beyond ttl - viasat / exede

2019-10-07 Thread Stephen Satchell
On 10/7/19 9:08 AM, Mike wrote: >    I am wondering if perhaps this is due to some kind of (known?) > bug in the embedded dns cache/client in the client satellite modem, or > if there is another plausible explanation I am not seeing. It compounds > my problem slightly since I have to continue r

Re: California public safety power shutdowns

2019-10-11 Thread Stephen Satchell
On 10/10/19 8:46 PM, Javier J wrote: > I have an alternative view. the more generators are running, the more > trucks semt to refuel the tanks, the more moving parts, the more likely an > accident is prone to happen somewhere. It's thr same reason you turn your > vehicles engine off when you fill u

Re: California public safety power shutdowns

2019-10-11 Thread Stephen Satchell
On 10/11/19 8:01 AM, Ethan O'Toole wrote: >> request went all the way to the Court.  The reason for access?  They ran >> the electronics on bottled propane (NOT mains power AC) and they needed >> to swap full tanks for the empties.  This was several months into my >> stint on that site. >> Not all

Request comment: list of IPs to block outbound

2019-10-13 Thread Stephen Satchell
The following list is what I'm thinking of using for blocking traffic between an edge router acting as a firewall and an ISP/upstream. This table is limited to address blocks only; TCP/UDP port filtering, and IP protocol filtering, is a separate discussion. This is for an implementation of BCP-38

Re: Request comment: list of IPs to block outbound

2019-10-13 Thread Stephen Satchell
On 10/13/19 9:08 AM, Florian Brandstetter wrote: > Hi, > > sorry - but why would you want to block Teredo? I know nothing about Terendo tunneling. > In computer networking, Teredo is a transition technology that gives > full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 > Interne

Request comment: list of IPs to block outbound

2019-10-19 Thread Stephen Satchell
After reviewing the comments from people on NANOG and some other locations, I have updated my list of routes to blackhole. The information at the end of this contribution is taken from the RHEL/CentOS NetworkManager dispatcher.d source file, which I use to install and remove the blackhole routes w

Re: Request comment: list of IPs to block outbound

2019-10-22 Thread Stephen Satchell
On 10/22/19 10:11 PM, Grant Taylor via NANOG wrote: > The explicit nature of RFC 6598 is on purpose so that there is no chance > that it will conflict with RFC 1918.  This is important because it means > that RFC 6598 can /safely/ be used for Carrier Grade NAT by ISPs without > any fear of conflict

Re: Request comment: list of IPs to block outbound

2019-10-23 Thread Stephen Satchell
On 10/23/19 8:18 AM, Grant Taylor via NANOG wrote: > I suspect things like NetworkManager are somewhat at a disadvantage in > that they are inherently machine local and don't have visibility beyond > the directly attached network segments.  As such, they can't /safely/ > filter something that may b

Anyone from NTT America here?

2019-10-23 Thread Stephen Satchell
Routing loop > 11.|-- 129.250.24.196 0.0% 1 28.9 28.9 28.9 28.9 0.0 > 12.|-- 129.250.130.2540.0% 1 29.0 29.0 29.0 29.0 0.0 > 13.|-- 129.250.130.2530.0% 1 29.4 29.4 29.4 29.4 0.0 > 14.|-- 129.250.130.2540.0% 1

Re: Disney+ Streaming

2019-11-13 Thread Stephen Satchell
CAVAET: I don't have a dog in this hunt. On 11/13/19 6:46 AM, Mel Beckman wrote: This is silly off-topic. You don’t have to go home, but you can’t stay here, according to NANOG guidelines. https://www.nanog.org/resources/usage-guidelines/ > https://www.nanog.org/bylaws/ "The NANOG mailing

Re: Elephant in the room - Akamai

2019-12-05 Thread Stephen Satchell
On 12/5/19 6:02 PM, Valdis Klētnieks wrote: (I also admit having no idea what percentage of the intermediate routers in the ISP's networks have gotten de-bloating code. For SP-grade routers, there isn't "code" that needs to be added to combat buffer bloat. All an admin has to do is cut back o

Expect (was: Software Defined Networks)

2019-12-12 Thread Stephen Satchell
I (and another programmer, now at Amazon) migrated our automation from TCL/Expect to Python/pexpect. I've had to write code for those portions of Expect that didn't carry over into pexpect. I also had to build a framework that allowed me to do rule-based programming in the same flavor as Expe

Re: power to the internet

2019-12-25 Thread Stephen Satchell
On 12/25/19 6:29 PM, Michael Thomas wrote: Yes, this is exactly right. My point here isn't to assign blame, but to ask what the hell we're going to do about it. Trying to score political points is disgusting. Do you live in California? Do you have your business in California? Take a look at

Re: power to the internet

2019-12-26 Thread Stephen Satchell
On 12/26/19 10:55 AM, Michael Thomas wrote: Here in California, you're going to need a lot more than 8 hours. We had one that lasted 3 days, followed by about 8 hours of power, followed by 2 days of no power. If this is the new normal, and I'm afraid that it is, that's probably going to require

Re: Cloudflare, dirty networks and politricks

2016-07-28 Thread Stephen Satchell
On 07/28/2016 10:17 AM, J. Oquendo wrote: While many are chanting: #NetworkLivesMatter, I have yet to see, read, or hear about any network provider being the first to set precedence by either de-peering, or blocking traffic from Cloudflare. There is a lot of keyboard posturing: "I am mad and I am

Re: Handling of Abuse Complaints

2016-08-29 Thread Stephen Satchell
On 08/29/2016 08:55 AM, Jason Lee wrote: NANOG Community, I was curious how various players in this industry handle abuse complaints. I'm drafting a policy for the service provider I'm working for about handing of complaints registered against customer IP space. In this example I have a customer

Status of IPv6 on Charter Communications

2016-09-10 Thread Stephen Satchell
Would someone at Charter Communications who is on this list indicate the roll-out schedule for IPv6 to business customers using cable modems as opposed to fiber links?

Re: One more thing to watch out for at data centers - fire drills

2016-09-18 Thread Stephen Satchell
On 09/17/2016 02:43 PM, Larry Sheldon wrote: My experiences were back in the days of washing-machine class disc drives and they were a 4-hour fire-wall away, but I don't remember them being impacted. (I can't believe that I was allowed to conduct a test with them running, but I don't remember shu

Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey

2016-09-25 Thread Stephen Satchell
On 09/25/2016 07:32 AM, Jay R. Ashworth wrote: From: "Jay Farrell via NANOG" > And of course Brian Krebs has a thing or two to say, not the least is which > to push for BCP38 (good luck with that, right?). > > https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ Well, given ho

Request for comment -- BCP38

2016-09-26 Thread Stephen Satchell
Is this an accurate thumbnail summary of BCP38 (ignoring for the moment the issues of multi-home), or is there something I missed? The basic philosophy of BCP38 boils down to two axioms: Don't let the "bad stuff" into your router Don't let the "bad stuff" leave your router

Re: Request for comment -- BCP38

2016-09-26 Thread Stephen Satchell
On 09/26/2016 07:11 AM, Paul Ferguson wrote: No -- BCP38 only prescribes filtering outbound to ensure that no packets leave your network with IP source addresses which are not from within your legitimate allocation. So, to beat that horse to a fare-thee-well, to be BCP38 compliant I need, on e

is someone with BCP38.info update privs summarizing this discussion?

2016-09-26 Thread Stephen Satchell
I think some pretty good information has surfaced, that would be WONDERFUL to have on that site.

Re: Request for comment -- BCP38

2016-09-27 Thread Stephen Satchell
I'm trying to come up with a simple picture that embraces all the comments I've seen thus far on the definition of BCP38. The example scenario I'm about to paint may be over-simplified -- but I like to start simple. Given a single local inside network with: * multiple uplink providers (typi

BCP38 adoption "incentives"?

2016-09-27 Thread Stephen Satchell
Does anyone know if any upstream and tiered internet providers include in their connection contracts a mandatory requirement that all directly-connected routers be in compliance with BCP38? Does anyone know if large ISPs like Comcast, Charter, or AT&T have put in place internal policies requir

BCP38 -- disabusing misinformation in this discussion

2016-09-27 Thread Stephen Satchell
"BCP38 applies only to egress filtering" INCORRECT. The title of the update to BCP38/RFC2827, BCP84/RFC2074, exposes the balderdash on its face. That title? "Ingress Filtering for Multihomed Networks." Oops. This is a short snipping from the Introduction: RFC 2827 recommends that ISPs p

Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey

2016-09-28 Thread Stephen Satchell
On 09/28/2016 12:33 AM, Eliot Lear wrote: It's not just consumers that need to understand this. Manufacturers of Things are right now on a steep learning curve. Consider that thermostat, for just a moment. In The Gold Old Days, before it had a network interface, the manufacturer cared about a

Re: Request for comment -- BCP38

2016-10-02 Thread Stephen Satchell
On 10/01/2016 06:39 PM, Jay R. Ashworth wrote: You *can* do BCP38 egress filtering on your network, but that filter would *be in control of the Bad Guys* whom we're trying to kill off. I don't see how you arrive at this conclusion. For an aggregating router, the Bad Guys(tm) don't get anywher

Legislative proposal sent to my Congressman

2016-10-03 Thread Stephen Satchell
In thinking over the last DDos involving IoT devices, I think we don't have a good technical solution to the problem. Cutting off people with defective devices they they don't understand, and have little control over, is an action that makes sense, but hurts the innocent. "Hey, Grandma, did y

Re: Legislative proposal sent to my Congressman

2016-10-05 Thread Stephen Satchell
On 10/05/2016 09:46 AM, jim deleskie wrote: > Can we please not get the government ( who's gov ) involved. I fully agree > that it will not only not help, but will make some things worse. This is > why we can't have nice things. I would be in favor of your pleas if you would accompany it with you

Re: IoT security, was Krebs on Security booted off Akamai network

2016-10-09 Thread Stephen Satchell
On 10/09/2016 07:31 AM, Mel Beckman wrote: > remote RF temperature sensor hub for home, the GW-1000U. > ... > The device accepts TCP connections on 22, 80, and 443. Theoretically > I can't see why it ever needs ongoing inbound connections, so this > seems to be a security concession made by the ma

Re: Death of the Internet, Film at 11

2016-10-22 Thread Stephen Satchell
On 10/22/2016 05:34 AM, Mike Hammett wrote: > "taken all necessary steps to insure that none of the numerous specific types > of CCVT thingies that Krebs and others identified" > > Serious question... how? > Network operators can only do so much. By the time traffic enters into an ISP's traf

Re: Death of the Internet, Film at 11

2016-10-22 Thread Stephen Satchell
That's what VPNs are for. On 10/22/2016 10:04 AM, jim deleskie wrote: > It is also likely the desired use case. In my office I like to be able to > login when needed when on the road, when the alarm company calls me at 2am > for a false alarm so I don't have to get someone else out of bed to have

Re: Death of the Internet, Film at 11

2016-10-23 Thread Stephen Satchell
On 10/23/2016 04:19 PM, Ronald F. Guilmette wrote: > I guess that's just an example of what somebody else already noted here, > i.e. that providers don't care to spend the time and/or effort and/or > money necessary to actually -do- anything about compromised boxes, and > anyway, they don't want to

Re: Death of the Internet, Film at 11

2016-10-23 Thread Stephen Satchell
On 10/23/2016 07:02 PM, David Conrad wrote: > On October 23, 2016 at 6:52:05 PM, Stephen Satchell (l...@satchell.net) wrote: > So, bottom line, nothing is going to happen until the cost to those > negligent provides rises so high as to affect profits. Period. > Yep. Or government

Should abuse mailboxes have quotas?

2016-10-27 Thread Stephen Satchell
For the last couple of weeks, every single abuse mail I've tried to send to networks in a very short list of countries has bounced back with "mailbox exceeds quota". I take this to mean that there isn't someone actively reading, acting on, and deleting e-mail from abuse@. So my new rule is this:

Re: Should abuse mailboxes have quotas?

2016-10-27 Thread Stephen Satchell
On 10/27/2016 01:30 PM, J wrote: > I'm in the camp of not replying to every report. I was in that camp, too, when I was mail admin for a web host company. I wanted to spend my time fixing the flood, without having to take the time to reply. I figure the best reply is when the spamming stops. I h

Re: Spitballing IoT Security -- Dancing around a solution

2016-10-27 Thread Stephen Satchell
I've been following the discussion with quite a bit of interest. What had become crystal clear to me is that nobody here has been looking at the problem from the perspective of the manufacturer, particularly how they actually get product to marked. A la "Dilbert". The engineer's credo: "Why bui

Re: Should abuse mailboxes have quotas?

2016-10-27 Thread Stephen Satchell
On 10/27/2016 05:36 PM, Jimmy Hess wrote: > If you get a SMTP reject, then call the the Abuse POC of the organization you > need to report abuse from. Not when the mailbox-full bounce is from a network in China, or India, or Pakistan, or Russia. Or a couple of other countries that seem to be

Re: Another day, another illicit SQUAT - WebNX (AS18450) 103.11.67.0/24

2016-10-28 Thread Stephen Satchell
On 10/28/2016 04:32 PM, Mark Andrews wrote: > It's not the RIR's job. They already provide the framework for > ISP's to do the job of policing route announcements themselves. > ISP's just need to use that framework. Link to documentation on how to use that framework?

Re: Spitballing IoT Security

2016-10-28 Thread Stephen Satchell
On 10/28/2016 10:14 PM, b...@theworld.com wrote: > Thus far the goal just seems to be mayhem. Thus far, the goal on the part of the botnet opearators is to make money. The goal of the CUSTOMERS of the botnet operators? Who knows?

Port 2323/tcp

2016-11-16 Thread Stephen Satchell
I've been seeing a lot of rejections in my logs for 2323/tcp. According to the Storm Center, this is what the Mirai botnet scanner uses to look for other target devices. Is it worthwhile to report sightings to the appropriate abuse addresses? (That assumes there *is* an abuse address associated

BCP38 and Red Hat

2016-12-15 Thread Stephen Satchell
https://bugzilla.redhat.com/show_bug.cgi?id=1370963 Just a reminder that I have a feature request outstanding with Red Hat to add support for BCP38, as well as measures for certain protocol-based amplification reflection attacks. My intent for making the suggestion is to stiffen firewalld(8) in R

Re: South Carolina attempts to repeal Rule 34

2016-12-20 Thread Stephen Satchell
On 12/19/2016 11:39 PM, Jay Hennigan wrote: > Break out the popcorn. > > http://www.charlotteobserver.com/news/local/article121673402.html > "A bill pre-filed this month by state Rep. Bill Chumley would require sellers to install digital blocking capabilities on computers and other devices that

Re: Is WHOIS going to go away?

2018-04-25 Thread Stephen Satchell
On 04/25/2018 07:10 AM, ke...@contoocook.net wrote: Well, personally for me, I use secret registration because I was tired of all the spam I got. Spammers scrape whois data for email addresses. I not trying to hide my identity on the web, I just don't like spam. I'm not some dark evil force. C

Re: Remote power cycle recommendations

2018-04-30 Thread Stephen Satchell
I've worked with APC, Synaccess, and a couple other brands of power controllers. One constant: the IP stack implementations tend to be a bit fragile. This is not restricted to power controllers; I have a GPS NTP appliance that is affected by the same sorts of things. I'll stick with APC and

Re: Remote power cycle recommendations

2018-04-30 Thread Stephen Satchell
On 04/30/2018 10:05 AM, William Herrin wrote: On Mon, Apr 30, 2018 at 12:19 PM, Brielle Bruns wrote: In particular, if at all possible, do not use the AP9606 era cards with the APCs. They are 10BaseT and take fragile to a whole new level. I usually have to manually force the port to 10 on the

Re: DSL Operators Mailing List?

2018-05-08 Thread Stephen Satchell
On 05/08/2018 07:12 AM, Mike Hammett wrote: I made a Facebook group for xLEC-related things. (Not useful for those of us not on Facebook.)

Re: DSL Operators Mailing List?

2018-05-08 Thread Stephen Satchell
In other words, status quo ante? On 05/08/2018 10:16 AM, Mike Hammett wrote: Then don't participate and move on? - Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com - Original Message - From: "Stephen Satchell&q

Re: Email security: PGP/GPG & S/MIME vulnerability drop imminent

2018-05-15 Thread Stephen Satchell
On 05/15/2018 02:34 AM, Rich Kulawiec wrote: On Mon, May 14, 2018 at 01:47:50PM +0530, Suresh Ramasubramanian wrote: TL;DR = Don't use HTML email [snip] That's enough right there. HTML markup in email is used exclusively by three kinds of people: (1) ignorant newbies who don't know any better

Re: Whois vs GDPR, latest news

2018-05-17 Thread Stephen Satchell
In a related note, I received a note from my registrar this morning telling me that, per current ICANN rules, I need to verify all the personal identifying information for the domains I control. 1. I checked WHOIS for all my domains, and they point to the proxy service that my registrar offer

Re: Curiosity about AS3356 L3/CenturyLink network resiliency (in general)

2018-05-18 Thread Stephen Satchell
On 05/18/2018 04:20 AM, Tom Hill wrote: On 17/05/18 14:24, Mike Hammett wrote: There's some industry hard-on with having a few ginormous routers instead of many smaller ones. "Industry hard-on", ITYM "Greedy vendors". I think this view (both versions) are a little over the top. "Never att

Re: Whois vs GDPR, latest news

2018-05-23 Thread Stephen Satchell
On 05/23/2018 09:09 AM, Anne P. Mitchell Esq. wrote: Also, don't forget the private right of action. Anyone can file anything in the U.S. courts... you may get it dismissed (although then again you may not) but either way, it's going to be time and money out of your pocket fighting it. MUCH be

Re: Whois vs GDPR, latest news

2018-05-27 Thread Stephen Satchell
On 05/27/2018 12:54 PM, niels=na...@bakker.net wrote: > You have this the wrong way around.  You'll need permission to store > their IP address in logs that you keep and to inform third parties about > their visits to your site.  And that is because that information belongs > to the visitor, not to

Re: Whois vs GDPR, latest news

2018-05-27 Thread Stephen Satchell
This is really off-topic for NANOG. Is there a better place where this discussion can be found?

  1   2   3   >