<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
	<channel>
		<title>Paul Vixie &#45; CircleID</title>
		<link>http://www.circleid.com/</link>
		<description>Postings from Paul Vixie on CircleID</description>
		<dc:language>en</dc:language>
		<dc:rights>Copyright 2013, unless where otherwise noted.</dc:rights>
		<dc:date>2013-01-03T21:21:00-08:00</dc:date>
		

		
		<item>
			<title> DNS Firewalls In Action - RPZ vs. Spam (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120103_dns_firewalls_in_action_rpz_vs_spam</guid>
			<link>http://www.circleid.com/posts/20120103_dns_firewalls_in_action_rpz_vs_spam</link>
			<description><![CDATA[In general, a network firewall is just a traffic filter... Filtering rules can be anything from "allow my web server to hear and answer web requests but not other kinds of requests" to "let my users Ping the outside world but do not let outsiders Ping anything on my network." The Internet industry has used firewalls since the mid-1980's and there are now many kinds, from packet layer firewalls to web firewalls to e-mail firewalls. Recently the DNS industry has explored the firewall idea and the results have been quite compelling. In this article I'm going to demonstrate a DNS firewall built using RPZ (Response Policy Zones) and show its potential impact on e-mail "spam". <a href="http://www.circleid.com/posts/20120103_dns_firewalls_in_action_rpz_vs_spam">More...</a>]]></description>
			<dc:date>2013-01-03T21:21:00-08:00</dc:date>
		</item>
		
		<item>
			<title> DNS Changer (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120327_dns_changer</guid>
			<link>http://www.circleid.com/posts/20120327_dns_changer</link>
			<description><![CDATA[One fine night in November 2011 I got an opportunity to get my hands dirty, working on a project for the United States Federal Bureau of Investigation (FBI). They were planning to seize a bunch of computing assets in New York City that were being used as part of a criminal empire that we called "DNS Changer" since that was the name of the software this gang used to infect a half million or so computers. <a href="http://www.circleid.com/posts/20120327_dns_changer">More...</a>]]></description>
			<dc:date>2012-03-27T18:09:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Refusing REFUSED (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120111_refusing_refused_for_sopa_pipa</guid>
			<link>http://www.circleid.com/posts/20120111_refusing_refused_for_sopa_pipa</link>
			<description><![CDATA[The U.S. Congress' road to Stopping Online Piracy (SOPA) and PROTECT IP (PIPA) has had some twists and turns due to technical constraints imposed by the basic design of the Internet's Domain Name System (DNS). PIPA's (and SOPA's) provisions regarding advertising and payment networks appear to be well grounded in the law enforcement tradition called <em>following the money</em>, but other provisions having to do with regulating American Internet Service Providers (ISPs) so as to block DNS resolution for pirate or infringing web sites have been shown to be ineffectual, impractical, and sometimes unintelligible. <a href="http://www.circleid.com/posts/20120111_refusing_refused_for_sopa_pipa">More...</a>]]></description>
			<dc:date>2012-01-11T18:41:00-08:00</dc:date>
		</item>
		
		<item>
			<title> DNS Policy is Hop by Hop; DNS Security is End to End (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20121012_dns_policy_is_hop_by_hop_dns_security_is_end_to_end</guid>
			<link>http://www.circleid.com/posts/20121012_dns_policy_is_hop_by_hop_dns_security_is_end_to_end</link>
			<description><![CDATA[The debate continues as to whether ISP's can effectively filter DNS results in order to protect brand and copyright holders from online infringement. It's noteworthy that there is no argument as to whether these rights holders and their properties deserve protection - nobody is saying "content wants to be free" and there is general agreement that it is harder to protect rights in the Internet era where perfect copies of can be made and distributed instantaneously. What we're debating now is just whether controlling DNS at the ISP level would work at all and whether the attempt to insert such controls would damage Secure DNS (sometimes called DNSSEC). <a href="http://www.circleid.com/posts/20121012_dns_policy_is_hop_by_hop_dns_security_is_end_to_end">More...</a>]]></description>
			<dc:date>2012-01-02T14:12:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Myth of the Unintended Infringer in SOPA and PIPA (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20111219_myth_of_the_unintended_infringer_in_sopa_and_pipa</guid>
			<link>http://www.circleid.com/posts/20111219_myth_of_the_unintended_infringer_in_sopa_and_pipa</link>
			<description><![CDATA[In a recent op-ed piece in TheHill.COM, some friends and I described the futility of mandated DNS blocking as contemplated by the SOPA (H.R. 3261) and PIPA (S. 968) bills now working their way through the U.S. Congress: No Internet user is required to use the Domain Name servers provided by their ISP. And if millions of American citizens who for whatever reason want to engage in online piracy can no longer do so because Congress has passed this law and their ISP is now filtering the citizen's DNS lookups... <a href="http://www.circleid.com/posts/20111219_myth_of_the_unintended_infringer_in_sopa_and_pipa">More...</a>]]></description>
			<dc:date>2011-12-19T17:57:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Technical Comments on Mandated DNS Filtering Requirements of H. R. 3261 ("SOPA") (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20111211_technical_comments_on_mandated_dns_filtering_requirements_sopa</guid>
			<link>http://www.circleid.com/posts/20111211_technical_comments_on_mandated_dns_filtering_requirements_sopa</link>
			<description><![CDATA[About two months ago, I got together with some fellow DNS engineers and sent a letter to the U. S. Senate explaining once again why the mandated DNS filtering requirements of S. 968 ("PIPA") were technically unworkable. This letter was an updated reminder of the issues we had previously covered... In the time since then, the U. S. House of Representatives has issued their companion bill, H. R. 3261 ("SOPA") and all indications are that they will begin "markup" on this bill some time next week. <a href="http://www.circleid.com/posts/20111211_technical_comments_on_mandated_dns_filtering_requirements_sopa">More...</a>]]></description>
			<dc:date>2011-12-11T16:39:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Protecting Intellectual Property is Good; Mandatory DNS Filtering is Bad (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20111012_protecting_intellectual_property_good_mandatory_dns_filtering_bad</guid>
			<link>http://www.circleid.com/posts/20111012_protecting_intellectual_property_good_mandatory_dns_filtering_bad</link>
			<description><![CDATA[It has been about six months since I got together with four of my friends from the DNS world and we co-authored a white paper which explains the technical problems with mandated DNS filtering. The legislation we were responding to was S. 968, also called the PROTECT-IP act, which was introduced this year in the U. S. Senate. By all accounts we can expect a similar U. S. House of Representatives bill soon, so we've written a letter to both the House and Senate, renewing and updating our concerns. <a href="http://www.circleid.com/posts/20111012_protecting_intellectual_property_good_mandatory_dns_filtering_bad">More...</a>]]></description>
			<dc:date>2011-10-12T21:38:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Defense in Depth for DNSSEC Applications (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/defense_in_depth_for_dnssec_applications</guid>
			<link>http://www.circleid.com/posts/defense_in_depth_for_dnssec_applications</link>
			<description><![CDATA[At the time of this writing DNSSEC mostly does not work. This is not a bad thing - in fact it's expected... There is a significant last-mover advantage DNSSEC deployment (or IPv6 deployment) and that can't be helped. It's all in a good cause though - everybody knows we need this stuff and some farsighted contributors put a lot of money and other resources into DNSSEC years or decades ago to ensure that when the time comes the world will have a migration path. Sadly, this leaves current investors and application designers and developers wondering whether there's a market yet. <a href="http://www.circleid.com/posts/defense_in_depth_for_dnssec_applications">More...</a>]]></description>
			<dc:date>2011-08-13T13:58:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Alignment of Interests in DNS Blocking (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20110723_alignment_of_interests_in_dns_blocking</guid>
			<link>http://www.circleid.com/posts/20110723_alignment_of_interests_in_dns_blocking</link>
			<description><![CDATA[I've written recently about a general purpose method called DNS Response Policy Zones (DNS RPZ) for publishing and consuming DNS reputation data to enable a market between security companies who can do the research necessary to find out where the Internet's bad stuff is and network operators who don't want their users to be victims of that bad stuff... During an extensive walking tour of the US Capitol last week to discuss a technical whitepaper with members of both parties and both houses of the legislature, I was asked several times why the DNS RPZ technology would not work for implementing something like PROTECT-IP. <a href="http://www.circleid.com/posts/20110723_alignment_of_interests_in_dns_blocking">More...</a>]]></description>
			<dc:date>2011-07-23T19:33:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Domain Names Without Dots (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20110620_domain_names_without_dots</guid>
			<link>http://www.circleid.com/posts/20110620_domain_names_without_dots</link>
			<description><![CDATA[Now that ICANN has approved a potentially vast expansion in the number of generic Top-Level Domains, there's considerable interest in and confusion about how these names can be used. For example if someone registers "dot BRAND", can they advertise http://brand/ and have it work? <a href="http://www.circleid.com/posts/20110620_domain_names_without_dots">More...</a>]]></description>
			<dc:date>2011-06-20T15:08:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Using Domain Filtering To Effect IP Address Filtering (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/using_domain_filtering_to_effect_ip_address_filtering</guid>
			<link>http://www.circleid.com/posts/using_domain_filtering_to_effect_ip_address_filtering</link>
			<description><![CDATA[In Taking Back The DNS I described new technology in ISC BIND as of Version 9.8.0 that allows a recursive server operator to import DNS filtering rules in what ISC hopes will become the standard interchange format for DNS policy information.  Later I had to decry the possible use of this technology for mandated content blocking such as might soon be the law of the land in my country.  I'm a guest at MAAWG this week in San Francisco and one of the most useful hallway discussions I've been in so far was about the Spamhaus DROP list. <a href="http://www.circleid.com/posts/using_domain_filtering_to_effect_ip_address_filtering">More...</a>]]></description>
			<dc:date>2011-06-08T18:51:01-08:00</dc:date>
		</item>
		
		<item>
			<title> Two Stage Filtering for IPv6 Electronic Mail (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20110607_two_stage_filtering_for_ipv6_electronic_mail</guid>
			<link>http://www.circleid.com/posts/20110607_two_stage_filtering_for_ipv6_electronic_mail</link>
			<description><![CDATA[I'm a guest at the MAAWG conference in San Francisco this week and several people have now mentioned to me the problem and the opportunity of anti-spam e-mail filtering for IPv6. Tomorrow is World IPv6 Day but since a bunch of the pieces have clicked together in my head I'll post this a day early. <a href="http://www.circleid.com/posts/20110607_two_stage_filtering_for_ipv6_electronic_mail">More...</a>]]></description>
			<dc:date>2011-06-07T23:31:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Anycast, Unicast, or Both? (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20110531_anycast_unicast_or_both</guid>
			<link>http://www.circleid.com/posts/20110531_anycast_unicast_or_both</link>
			<description><![CDATA[A long time ago in an Internet far away, nobody paid for DNS services. Not directly at least. We either ran our own servers, or got DNS service as part of our IP transit contract, or traded services with others. In ~1990 I was the operator of one of the largest name servers in existence (UUCP-GW-1.PA.DEC.COM) and I exchanged free DNS secondary service with UUNET. Two thousand zones seemed like a lot of zones back then -- little did we dream that there would some day be a billion or so DNS zones world wide. <a href="http://www.circleid.com/posts/20110531_anycast_unicast_or_both">More...</a>]]></description>
			<dc:date>2011-05-30T23:56:00-08:00</dc:date>
		</item>
		
		<item>
			<title> On Mandated Content Blocking in the Domain Name System (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20110318_on_mandated_content_blocking_in_the_domain_name_system</guid>
			<link>http://www.circleid.com/posts/20110318_on_mandated_content_blocking_in_the_domain_name_system</link>
			<description><![CDATA[COICA (Combating Online Infringement and Counterfeits Act) is a legislative bill introduced in the United States Senate during 2010 that has been the topic of considerable debate. After my name was mentioned during some testimony before a Senate committee last year I dug into the details and I am alarmed. I wrote recently about interactions between DNS blocking and Secure DNS and in this article I will expand on the reasons why COICA as proposed last year should not be pursued further in any similar form. <a href="http://www.circleid.com/posts/20110318_on_mandated_content_blocking_in_the_domain_name_system">More...</a>]]></description>
			<dc:date>2011-03-18T13:14:00-08:00</dc:date>
		</item>
		
		<item>
			<title> COICA and Secure DNS (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/coica_and_secure_dns</guid>
			<link>http://www.circleid.com/posts/coica_and_secure_dns</link>
			<description><![CDATA[As a strong proponent of the private right of action for all Internet endpoints and users, I've long been aware of the costs in complexity and chaos of any kind of "blocking" that deliberately keeps something from working. I saw this as a founder at MAPS back in 1997 or so when we created the first RBL to put some distributed controls in place to prevent the transmission of unwanted e-mail from low reputation Internet addresses. What we saw was that in addition to the expected costs (to spammers) and benefits (to victims) of this new technology there were unintended costs to system and network operators whose diagnostic and repair work for problems related to e-mail delivery was made more complex because of the new consideration for every trouble ticket: "was this e-mail message blocked or on purpose?" <a href="http://www.circleid.com/posts/coica_and_secure_dns">More...</a>]]></description>
			<dc:date>2011-03-17T14:28:00-08:00</dc:date>
		</item>
		
	</channel>
</rss>