CircleID

Comments

DNS Resolution, Browsers & Hope For The Future

• Comment posted Apr 17, 2012 4:35 am PDT — by Carl Byington
  man res_search Yes, it may block, but a pool of helper processes can fix that, where you do the dns resolution in the helper process.

Anonymous Plans to Go After DNS Root Servers. What Will Be the US's Response?

• Comment posted Feb 16, 2012 12:11 am PST — by Carl Byington
  I agree that the US response may be severe, and much larger than Anonymous seems to believe. However, the TTL on the com, net, org and probably most (all?) of the other tld NS records is 48 hours, so almost…

The Invisible Hand vs. the Public Interest in IPv4 Address Distribution

• Comment posted Sep 21, 2011 5:29 pm PDT — by Carl Byington
  Of course it is prohibition - you want to prohibit the sale of ip addresses, just as many governments want to prohibit the sale of some drugs. As soon as you (generic you meaning a government) prohibit the sale of…

• Comment posted Sep 15, 2011 7:48 pm PDT — by Carl Byington
  Most of the cases I pointed to above are where the address space was simply stolen, not sold.  There are large blocks of address space where the former user cannot be located. Spammers at one point were re-registering the original…

• Comment posted Sep 13, 2011 6:06 pm PDT — by Carl Byington
  http://www.five-ten-sg.com/mapper/spam-history#rout has some more recent ones, but at least some of those have been resolved. Others are still a problem - for example see http://www.spamhaus.org/SBL/sbl.lasso?query=SBL51908

Kaspersky Calls for an Internet Internpol... Cybercrime Now Second Largest Criminal Activity

• Comment posted May 31, 2011 8:29 pm PDT — by Carl Byington
  "US banks could very easily eliminate card present fraud by deploying the Chip and PIN protocol deployed in Europe. Chip and PIN has practically eliminated card present fraud in Europe. The residual fraud is almost entirely due to the need…

Digging Through the Problem of IPv6 and Email - Part 3

• Comment posted Mar 24, 2011 7:29 pm PDT — by Carl Byington
  There are two different issues here. One is the size of the dnsbl zone file. That can be reasonably controlled by blocking larger chunks. If the spammer has an ipv6 /32 we put in a wildcard entry to block all…

• Comment posted Mar 24, 2011 3:13 pm PDT — by Carl Byington
  Ok, suppose we make all dnsbl lookups in ipv6 space only consider the upper 64 bits, and ignore the lower 64 bits. That still does not solve the problem of the cache size in the dns recursive resolvers. Currently, spammers…

Moving DNSSEC Forward: Help for Registries, Registrars, ISPs/Hosting, Enterprises, and Name Owners

• Comment posted Jul 21, 2010 7:39 pm PDT — by Carl Byington
  > Key hygiene is important, but that does not mean that a third party cannot do a better or a more secure job than your in house net-admin. You could hire a third party to generate and keep control of…

• Comment posted Jul 21, 2010 2:43 pm PDT — by Carl Byington
  > If an owner has a DS record and the TLD is not yet signed, nothing changes.  The chain-of-trust associated with DNSSEC can only been established when the registry is able to accept the DS record. See dlv.isc.org. Our DS…

DNSSEC Happy Talk Enters a New Era

• Comment posted Jul 20, 2010 11:58 pm PDT — by Carl Byington
  pir.org claims that GoDaddy, DynDNS and NamesBeyond are ready to push dnssec keys into the .org zone, with another 24 registrars in the "comming" weeks. Of course that wording is intentionally sufficiently imprecise so that it can never be disproven.…

Moving DNSSEC Forward: Help for Registries, Registrars, ISPs/Hosting, Enterprises, and Name Owners

• Comment posted Jul 20, 2010 11:33 pm PDT — by Carl Byington
  > ...individual domain name owners can submit their domain name or zone(s) and have a signed zone or name returned complete with their key and the respective DS… Why do you think it is a good idea to encourage naive…

DNSSEC is But One Link in the Security Chain

• Comment posted Jul 19, 2010 4:22 am PDT — by Carl Byington
  > the question of what criteria are applied to ensure that the keys are inserted by the legitimate registrant for the domain and who is going to stand behind the project by accepting liability. The same criteria that are currently…

DNSSEC Happy Talk Enters a New Era

• Comment posted Jul 19, 2010 1:48 am PDT — by Carl Byington
  > How do the domain name owner's keys get into the TLD? The same way the domain name owner's NS records get into the TLD. By action of the registrar, paid for by the domain name owner. > ... technical…

Resources for Cleaning Your Network

• Comment posted May 03, 2010 6:48 pm PDT — by Carl Byington
  Take your reverse dns zones, and periodically extract all the names and look them up on Surbl. Be sure to load limit that to avoid hammering the Surbl dns servers, and also use the proper number of name components. Periodically…

OpenDNS Adopts Proposed DNS Security Solution: DNSCurve

• Comment posted Feb 26, 2010 6:14 pm PST — by Carl Byington
  Rather than being a straw man argument, this is fundamental to the concept of what it means "to secure" dns. I take that to mean that the end-client user can use the dns answers to prove that the answer he…

• Comment posted Feb 25, 2010 1:31 am PST — by Carl Byington
  See the "OpenDNS today announced it has adopted DNSCurve..." thread on comp.protocols.dns.bind for more details on this. I will summarize some of it here for those of you that don't read that group. "It (dnssec) also fundamentally hampers services like…

What Makes a Good ESP?

• Comment posted Dec 23, 2009 12:01 am PST — by Carl Byington
  There are many attributes or behaviors of spammers that are *almost* unique to spammers, and if you happen to share some of those attributes, you will be treated like a spammer. Some spammers use a large variety of domain names,…

An Unwelcome Afterlife for a Long-Dead Blacklist

• Comment posted Oct 14, 2009 8:00 pm PDT — by Carl Byington
  "If you're annoyed at them deliberately screwing up your your mail, you should block the *replies* from network.us, not the packets leaving your network. That way they still have to process it." It seems that in my example above, that…

• Comment posted Oct 14, 2009 4:26 am PDT — by Carl Byington
  It is unclear just which party you think should ignore packets. Machine A sends mail to machine B which is configured to use some $sublist.blackholes.us dnsbl. A dns server near B sends a query towards the ip addresses specified by…

• Comment posted Oct 13, 2009 6:38 pm PDT — by Carl Byington
  "Five years passed, and suddenly Matthew and his lists disappeared!" It seems that blackholes.us is *still* owned by Matthew Domain Name:  BLACKHOLES.US Registrant Name:  Matthew Evans Registrant Email:  matthew@blackholes.us "The IP addresses of the blackholes.us nameservers were assigned to somebody…

ICANN to Drop Yugoslav's .YU Domain

• Comment posted Oct 02, 2009 9:23 pm PDT — by Carl Byington
  It might eventually happen, but as of 2009-10-02 yu. still has NS records in the root servers.

Oh, Spammer, Where Art Thou?

• Comment posted Aug 26, 2009 11:57 pm PDT — by Carl Byington
  Checking those names one week later I find: unchanged chabad.org unchanged scsend.com unchanged mountainstas.com unchanged 100freemb.com unchanged ammersmicht.net unchanged yourschoolssite.info unchanged mp010.net unchanged snurl.com unchanged aafter.us unchanged reduce-now.com unchanged plumbwatches.cn ineunknown.com was 72.46.154.186, does not resolve now hxukasln.cn was 159.226.7.162,…

Comcast Unleashes Trial DNS Redirection in Select States

• Comment posted Jul 16, 2009 1:17 am PDT — by Carl Byington
  Page 26 of that does some hand-waving regarding dnssec, but that issue cannot be avoided. In the future we should have validating stub resolvers in many client machines, which will simply refuse these answers. The entire point of dnssec is…

Turn the Table on Content Filtering

• Comment posted Jul 04, 2009 4:45 pm PDT — by Carl Byington
  "The AUTH extension is for authentication by prior arrangement." My point, poorly expressed, was that it will be *far* easier to gain widespread acceptance of an ESMTP/EHLO extension than it will be to gain widespread acceptance of another SMTP verb.…

• Comment posted Jul 03, 2009 10:27 pm PDT — by Carl Byington
  You will need some other property of that MTA (other than the fact that it issued VHLO rather than EHLO) to trigger the acceptance of mail from it. Otherwise, spammers will just use VHLO. Whatever property you need in addition…

Why Not an Interim Step Until DNSSEC is Ready?

• Comment posted Jun 25, 2009 2:32 am PDT — by Carl Byington
  "BIND currently only supports one DLV provider" Is that really an issue? Is there any other provider of a dlv tree that is competitive with isc.org? This is intended as an interm step until the root is signed. Once that…

• Comment posted Jun 21, 2009 6:33 pm PDT — by Carl Byington
  "according to wikipedia:" not exactly an authoritative source. "DNS servers must be updated with software that supports DNSSEC" Both BIND and the dns server in Windows Server 2008 R2 support dnssec. Others have given statistics on the percentage of queries…

• Comment posted Jun 21, 2009 6:13 pm PDT — by Carl Byington
  "DNSSEC will never work because it believes that answers should be globally consistent, a perspective that has no place on the Internet we use today." I don't think so. Using BIND views, I should be able to give hand out…

New TLDs For Dummies (Sort of)

• Comment posted Jun 14, 2009 12:58 am PDT — by Carl Byington
  bl # Saint Barthelemy eh # Western Sahara mf # Saint Martin (French part) um # United States Minor Outlying Islands

• Comment posted Jun 12, 2009 3:21 pm PDT — by Carl Byington
  I see 252 country codes at http://www.iana.org/domains/root/db/

Proposed Law Seeks to Expose Internet Addressing for Child Safety

• Comment posted Feb 24, 2009 11:31 pm PST — by Carl Byington
  Of course these politicians have never heard of stateless ipv6 configuration. A simple google picks up rfc2462 and rfc3736. Or perhaps they intend to outlaw those protocols.

First gTLD Signed: Dot Gov

• Comment posted Feb 06, 2009 1:11 am PST — by Carl Byington
  Well, I might be curious about the status of DNSSEC in .gov, but not at the cost of going past the following text:  Warning! Use of this site is restricted! This computer system is for the use of the United…

• Comment posted Feb 05, 2009 5:14 am PST — by Carl Byington
  The dns operational challenge of getting a LOT of dns servers to trust your key has been partially solved by the ISC dlv registry. You can just add dnssec-lookaside . trust-anchor dlv.isc.org.; to your named.conf configuration, together with the appropriate…

The Problem With HTTPS SSL Runs Deeper Than MD5

• Comment posted Jan 05, 2009 4:40 pm PST — by Carl Byington
  In the specific case of http://www.wachovia.com/, they used http to deliver the original form to the browser. However, that content includes form method="post" action="https://onlineservices.wachovia.com/auth/AuthService" which should send the user credentials to wachovia wrapped in ssl. It would be nice if…

Spam Volumes Dropped by Two-Thirds After Major Spam Hub Shut Down

• Comment posted Nov 14, 2008 11:48 pm PST — by Carl Byington
  host canadianpharmacycorp2.com canadianpharmacycorp2.com has address 208.72.168.23 curl http://canadianpharmacycorp2.com/welcome.php 2>/dev/null | grep TITLE License Pharmacy Online

• Comment posted Nov 14, 2008 1:30 am PST — by Carl Byington
  > Not sure where you came up with that From a bgp speaking router. > BGP routing table entry for 208.66.192.0/22 > 3277 3216 3549 26780 Your own test via routeviews shows them connected via as3549 gblx.net. Or am I…

• Comment posted Nov 13, 2008 5:29 pm PST — by Carl Byington
  From looking at the bgp logs, it seems that mccolo never lost connectivity. They brought up a new connection via Los Nettos before dropping (or being dropped by) HE. show ip bgp 208.66.194.0 7397 226 26780

Study Assesses Potential Impact of DNSSEC on Broadband Consumers, Results Not Good

• Comment posted Sep 17, 2008 12:52 am PDT — by Carl Byington
  Yes, the customer will be talking to their provider's dns server, but eventually those questions will be asking for dnssec answers, and it is those dnssec answers that may or may not make it back thru the residential gateway proxy…

Not a Guessing Game

• Comment posted Jul 16, 2008 2:56 am PDT — by Carl Byington
  note, if you can do a "dig porttest.dns-oarc.net in txt" from a client of that router or any other DNS server, you can learn a lot about how random its UDP ports are. That port test seems to claim it…

New Generic Top-Level Domains and Internet Standards

• Comment posted Jul 08, 2008 9:51 pm PDT — by Carl Byington
  The following ccTLDs have MX records: ai # Anguilla as # American Samoa bj # Benin cf # Central African Republic dj # Djibouti dm # Dominica gp # Guadeloupe gt # Guatemala hr # Croatia/Hrvatska io # British Indian…

Microsoft's Offer to Buy Yahoo: An Anti-Spam Point of View

• Comment posted Feb 05, 2008 6:33 am PST — by Carl Byington
  Just a waste of time and effort. Hotmail currently publishes ~all form hotmail.com. 3600 IN TXT "v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all" So if we ask "should ip address a.b.c.d be sending email from the hotmail.com domain", hotmail explicitly answers…

Domain Names Registered Globally Now Over 138 Million

• Comment posted Aug 30, 2007 10:53 pm PDT — by Carl Byington
  Whenever I see such headlines of "total domain names hit new high", I read that as "spammers continue to register millions of junk names".

Nation of Cameroon Typo-Squats the Entire .com Space

• Comment posted Aug 09, 2006 1:52 am PDT — by Carl Byington
  I think that the BIND root-delegation-only option was added specifically to deal with the Verisign .com issue, but it nicely handles this one as well. http://www.isc.org/products/BIND/delegation-only.html contains a suggested list of exceptions, and .cm is not on that list. Anyone…