RE: News of ISC Developing BIND Patch

2003-09-19 Thread Adam Atkinson
I would say _supposed_ to be unique. Surely some cheapo manufacturer has recycled addresses from their old ISA card days. I've seen at least one manufacturer ship multiple cards with the same MAC address. One shop in Tottenham Court Road, London sold several people on the same LAN cards with

Re: News of ISC Developing BIND Patch

2003-09-18 Thread bdragon
On Wed, 17 Sep 2003 [EMAIL PROTECTED] wrote: MAC addresses are not without authority delegation. The IEEE is the ultimate authority in said case. Any solution which requires uniqueness also requires a singular ultimate authority. Even MACs aren't entirely unique. Some places used

Re: News of ISC Developing BIND Patch

2003-09-18 Thread bdragon
On Wed, 17 Sep 2003 [EMAIL PROTECTED] wrote: If the goal were unique identification, MAC addresses would do just fine. No need for DNS. MAC addresses are not without authority delegation. The IEEE is the ultimate authority in said case. Yep... But have you seen any controversy

Re: News of ISC Developing BIND Patch

2003-09-18 Thread Mr. James W. Laferriere
Hello Whoever , On Thu, 18 Sep 2003 [EMAIL PROTECTED] wrote: On Wed, 17 Sep 2003 [EMAIL PROTECTED] wrote: MAC addresses are not without authority delegation. The IEEE is the ultimate authority in said case. Any solution which requires uniqueness also requires a singular

Re: News of ISC Developing BIND Patch

2003-09-18 Thread John Kristoff
On Thu, 18 Sep 2003 15:10:57 -0400 (EDT) [EMAIL PROTECTED] wrote: manufacturer assigned macs are guaranteed to be globally unique. Theoretically. I didn't experience it personally, but I believe there was at least one fairly well known event a few years back where a manufacturer shipped cards

Re: News of ISC Developing BIND Patch

2003-09-18 Thread Scott Granados
There was another manufacturer one of the really low budget cards, I forget the brand but they were shipped in a box which looked like a dunkin's munchkins box. If you bought several boxes of these, I think six in a box and the entire package was $30 you were likely to find more than 2 or 3

Re: News of ISC Developing BIND Patch

2003-09-18 Thread Dominic J. Eidson
On Thu, 18 Sep 2003, John Kristoff wrote: Fortunately, this practice rarely occurs these days (token ring / SNA shops often did this) although I'd be curious if anyone still does it. box:~ # /sbin/lspci | grep 'Happy' 01:03.1 Ethernet controller: Sun Microsystems Computer Corp. Happy Meal

Re: News of ISC Developing BIND Patch

2003-09-18 Thread Richard Irving
Mr. James W. Laferriere wrote: Hello Whoever , On Thu, 18 Sep 2003 [EMAIL PROTECTED] wrote: On Wed, 17 Sep 2003 [EMAIL PROTECTED] wrote: manufacturer assigned macs are guaranteed to be globally unique. A specific enterprise reconfiguring the mac is akin to an enterprise using RFC1918

Re: News of ISC Developing BIND Patch

2003-09-18 Thread Richard Irving
* sigh * s/there/their/ s/mps/mbs/ s/:)/:}/ 8-) Richard Irving wrote: Mr. James W. Laferriere wrote: Hello Whoever , On Thu, 18 Sep 2003 [EMAIL PROTECTED] wrote: On Wed, 17 Sep 2003 [EMAIL PROTECTED] wrote: manufacturer assigned macs are guaranteed to be globally unique. A specific

Re: News of ISC Developing BIND Patch

2003-09-18 Thread Crist Clark
Dominic J. Eidson wrote: On Thu, 18 Sep 2003, John Kristoff wrote: Fortunately, this practice rarely occurs these days (token ring / SNA shops often did this) although I'd be curious if anyone still does it. box:~ # /sbin/lspci | grep 'Happy' 01:03.1 Ethernet controller: Sun

Re: News of ISC Developing BIND Patch

2003-09-18 Thread Chris Boyd
On Thursday, September 18, 2003, at 02:10 PM, [EMAIL PROTECTED] wrote: manufacturer assigned macs are guaranteed to be globally unique. A specific enterprise reconfiguring the mac is akin to an enterprise using RFC1918 space. I would say _supposed_ to be unique. Surely some cheapo

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Daniel Karrenberg
On 17.09 00:50, Sean Donelan wrote: On Tue, 16 Sep 2003, John Brown wrote: not all the *root-servers* carry .arpa or in-addr.arpa J (one of verisigns) does not carry this zone, based on their own internal decision. Actually, I thought that was one of Jon Postel's decisions when

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Vadim Antonov
If we take a step back, we could say that the whole Verisign incident demonstrated pretty clearly that the fundamental DNS premise of having no more than one root in the namespace is seriously wrong. This is the fallacy of universal classification so convincingly trashed by J.L.Borges in The

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Simon Waters
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 From: [EMAIL PROTECTED] To pull a stunt like that at the root, they'd have to get the OTHER 9 or 10 organizations to buy in, or they'd find themselves outvotes 13 servers to 2, or whatever the exact numbers are - From a purely technical

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Iljitsch van Beijnum
On Wed, 17 Sep 2003, Simon Waters wrote: As such any root server operator can potentially hijack a significant amount (majority?) of Internet traffic, at least if no one notices something odd, and figures out what is going on too quickly. This is DNS security 101... A single rogue root

Re: News of ISC Developing BIND Patch

2003-09-17 Thread David Lesher
Speaking on Deep Background, the Press Secretary whispered: Yes, I understand that. But based on their recent actions I dont feel anyone should trust Verisign to act towards any of the Internet community's best interests let alone 1/13th of its core functionality. I think there is a

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Mathias Körber
--On Wednesday, September 17, 2003 02:50:51 AM -0700 Vadim Antonov [EMAIL PROTECTED] wrote: If we take a step back, we could say that the whole Verisign incident demonstrated pretty clearly that the fundamental DNS premise of having no more than one root in the namespace is seriously wrong.

Re: News of ISC Developing BIND Patch

2003-09-17 Thread David G. Andersen
On Wed, Sep 17, 2003 at 02:50:51AM -0700, Vadim Antonov quacked: In fact, we do have an enormously useful and popular way of doing exactly that - this is called search engines and bookmarks. What is needed is an infrastructure for allocation of unique semantic-free end point identifiers

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Vadim Antonov
On Wed, 17 Sep 2003, [ISO-8859-1] Mathias Krber wrote: If we take a step back, we could say that the whole Verisign incident demonstrated pretty clearly that the fundamental DNS premise of having no more than one root in the namespace is seriously wrong. This is the fallacy of

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Vadim Antonov
I see what it says is pretty much similar to what I was writing on the matter of DNS some years ago :) Should be on record somewhere in NANOG archives. I do not claim that I'm the author of this idea, though. Unfortunately, I cannot remember how I acquired it :( Thank you for the pointer!

Re: News of ISC Developing BIND Patch

2003-09-17 Thread bdragon
On Wed, 17 Sep 2003, [ISO-8859-1] Mathias Körber wrote: If we take a step back, we could say that the whole Verisign incident demonstrated pretty clearly that the fundamental DNS premise of having no more than one root in the namespace is seriously wrong. This is the fallacy of

Re: News of ISC Developing BIND Patch

2003-09-17 Thread E.B. Dreger
Date: Wed, 17 Sep 2003 18:39:27 -0400 (EDT) From: [EMAIL PROTECTED] Any solution which requires uniqueness also requires a singular ultimate authority. Or cooperation between multiple authorities. Of course, how realistic is that? Eddy -- Brotsman Dreger, Inc. - EverQuick Internet

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Vadim Antonov
On Wed, 17 Sep 2003 [EMAIL PROTECTED] wrote: If the goal were unique identification, MAC addresses would do just fine. No need for DNS. MAC addresses are not without authority delegation. The IEEE is the ultimate authority in said case. Yep... But have you seen any controversy about

RE: News of ISC Developing BIND Patch

2003-09-17 Thread David Schwartz
Any solution which requires uniqueness also requires a singular ultimate authority. Not really. You can just take random numbers. If you have enough bits (and a good RNG) the probability of collision would be less than probability of an asteroid wiping the life on Earth in the next

RE: News of ISC Developing BIND Patch

2003-09-17 Thread Vadim Antonov
On Wed, 17 Sep 2003, David Schwartz wrote: In fact, you could just use an RSA public key as the identifier directly. This is likely not the best algorithm, but it's certainly an existence proof that such algorithms can be devised without difficulty. In fact, I'm going to call

Re: News of ISC Developing BIND Patch

2003-09-17 Thread Aaron Dewell
On Wed, 17 Sep 2003, Justin Shore wrote: Even MACs aren't entirely unique. Some places used to assign MAC addresses like they assigned IP addresses and the NIC had to be reconfigured for the assigned MAC. An admin was freely able to assign a MAC to Joe Blow using a 3Com or Cisco OUI

RE: News of ISC Developing BIND Patch

2003-09-17 Thread Mike Leber
On Wed, 17 Sep 2003, David Schwartz wrote: That doesn't help in this case. You need a way to verify ownership of an identifier. I don't want anyone else to be able to claim my identifier. Perhaps we can devise a scheme where I generate a random number and morph it into a

Re: News of ISC Developing BIND Patch

2003-09-16 Thread Ray Wong
On Tue, Sep 16, 2003 at 04:07:21PM -0600, John Neiberger wrote: http://apnews.excite.com/article/20030916/D7TJOF3G0.html -- my favorite: VeriSign spokesman Brian O'Shaughnessy said Tuesday that individual service providers were free to configure their systems so customers would

Re: News of ISC Developing BIND Patch

2003-09-16 Thread William Allen Simpson
The next version of the root-servers.net hints file should not have any netSOL owned root servers in it. That will make the transition easier. -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

Re: News of ISC Developing BIND Patch

2003-09-16 Thread Paul Vixie
The next version of the root-servers.net hints file should not have any netSOL owned root servers in it. That will make the transition easier. excuse me for the harsh language, but that's just silly. verisign's root name servers (a-root and j-root) are professionally run by some of the best

Re: News of ISC Developing BIND Patch

2003-09-16 Thread Mike Tancsa
At 12:20 AM 17/09/2003, Paul Vixie wrote: The next version of the root-servers.net hints file should not have any netSOL owned root servers in it. That will make the transition easier. excuse me for the harsh language, but that's just silly. verisign's root name servers (a-root and j-root)

Re: News of ISC Developing BIND Patch

2003-09-16 Thread John Brown
On Wed, Sep 17, 2003 at 04:20:29AM +, Paul Vixie wrote: dns techs in the industry. nothing that's happening with dot-com or dot-net agreed. should be considered relevant to verisign's *root* servers in any way. the *root* servers do not carry dot-com or dot-net, they just carry .

Re: News of ISC Developing BIND Patch

2003-09-16 Thread Valdis . Kletnieks
On Wed, 17 Sep 2003 00:38:14 EDT, Mike Tancsa [EMAIL PROTECTED] said: I trust your assessment of the DNS techs. But what about the DNS tech's bosses? They ordered some pretty lumpy things be done with .com and .net. Given that track record, whats to stop them from ordering the GTLD techs

Re: News of ISC Developing BIND Patch

2003-09-16 Thread Mike Tancsa
At 12:46 AM 17/09/2003, [EMAIL PROTECTED] wrote: On Wed, 17 Sep 2003 00:38:14 EDT, Mike Tancsa [EMAIL PROTECTED] said: I trust your assessment of the DNS techs. But what about the DNS tech's bosses? They ordered some pretty lumpy things be done with .com and .net. Given that track record,

Re: News of ISC Developing BIND Patch

2003-09-16 Thread Sean Donelan
On Tue, 16 Sep 2003, John Brown wrote: not all the *root-servers* carry .arpa or in-addr.arpa J (one of verisigns) does not carry this zone, based on their own internal decision. Actually, I thought that was one of Jon Postel's decisions when they were experimenting with creating

Re: News of ISC Developing BIND Patch

2003-09-16 Thread Paul Vixie
I trust your assessment of the DNS techs. But what about [their] bosses? the ones i've met in recent years seemed like reasonable people. They ordered some pretty lumpy things be done with .com and .net. Given that track record, whats to stop them from ordering [the techs] from doing