Re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?

2008-07-25 Thread Nathan Ward
On 25/07/2008, at 6:45 AM, Scott Berkman wrote: Is it just me or is the test page below down now? Or maybe some poisoned the NS record for dns-oarc.net and sent it to nowhere to stop testing! (J/K since I can get to the rest of the page fine). Hmm, cute. So uh, is this patch available for

Re: Multiple DNS implementations vulnerable to cache poisoning

2008-07-25 Thread Brian Keefer
On Jul 11, 2008, at 7:58 AM, Tuc at T-B-O-H.NET wrote: Reading through the JavaScript that drives http://www.doxpara.com/, it appears to be pretty easy to write a non-AJAX client to query Dan's service. I threw one together in perl, named noclicky, that allows you to use Dan's service

BGP Update Report

2008-07-25 Thread cidr-report
BGP Update Report Interval: 23-Jun-08 -to- 24-Jul-08 (32 days) Observation Point: BGP Peering with AS2.0 TOP 20 Unstable Origin AS Rank ASNUpds % Upds/PfxAS-Name 1 - AS4538 209277 2.9% 41.8 -- ERX-CERNET-BKB China Education and Research Network Center 2

Re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?

2008-07-25 Thread Jorge Amodio
So is this patch a true fix or just a temporary fix until further work can be done on the problem? I guess you need to read some of the related papers/presentations/advisories/etc related to a subject that has been under discussion for more 20+ years. Answering your questions, as said

Re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?

2008-07-25 Thread Jared Mauch
On Thu, Jul 24, 2008 at 08:37:55PM -0400, [EMAIL PROTECTED] wrote: On Thu, 24 Jul 2008 17:31:01 EDT, Jay R. Ashworth said: But it seems to me that Paul, you are here espousing the opinion that there's no business value in people being able to trust that the domain name they heard on a TV ad

Re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?

2008-07-25 Thread Jay R. Ashworth
On Fri, Jul 25, 2008 at 07:31:30PM +1200, Nathan Ward wrote: So uh, is this patch available for download over HTTPS with a key that was generated by the vendor and signed by well trusted root CAs on a boxes with OpenSSL versions not released by Debian? PATCH NOW PATCH NOW seems like a

Re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?

2008-07-25 Thread Jorge Amodio
Regarding Bubba, he won't likely move until there is a real problem, this makes it on CNN, and even then, he may not understand what is going on. That win2k server in the corner never got updated. But when he realizes his business is at risk due to the buggy software, our pal Bubba

Re: Exploit for DNS Cache Poisoning - RELEASED

2008-07-25 Thread David Conrad
Valdis, On Jul 24, 2008, at 6:05 PM, [EMAIL PROTECTED] wrote: On Thu, 24 Jul 2008 17:43:10 PDT, David Conrad said: On Jul 24, 2008, at 4:24 PM, Tomas L. Byrnes wrote: The problem is, once the ICANNt root is self-signed, the hope of ever revoking that dysfunctional mess as authority is gone.

Re: Software router state of the art

2008-07-25 Thread Justin Sharp
Yes. We put in some Vyatta routers to extend our corporate network into another building as a temporary solution (the building had a very short lease, so our boss didn't want to spend any money on Juniper which is our usual net gear vendor). Consequently, we are still there.. go figure. When

Re: Federal Government Interest in your patch progress

2008-07-25 Thread Jorge Amodio
So, you say that(sarcasm). I just got off a 45 minute call where the US Federal government is interested in how to effectively communicate to the infrastructure operators the importance and risks of not upgrading the resolvers. Just tell them to call the head of DoC and explain why

Re: Federal Government Interest in your patch progress

2008-07-25 Thread Jared Mauch
On Fri, Jul 25, 2008 at 11:04:59AM -0500, Jorge Amodio wrote: So, you say that(sarcasm). I just got off a 45 minute call where the US Federal government is interested in how to effectively communicate to the infrastructure operators the importance and risks of not upgrading the

Re: Federal Government Interest in your patch progress

2008-07-25 Thread Steven M. Bellovin
On Fri, 25 Jul 2008 12:07:40 -0400 Jared Mauch [EMAIL PROTECTED] wrote: On Fri, Jul 25, 2008 at 11:04:59AM -0500, Jorge Amodio wrote: So, you say that(sarcasm). I just got off a 45 minute call where the US Federal government is interested in how to effectively communicate

Re: Software router state of the art

2008-07-25 Thread Joe Greco
Last thing to say is, I haven't tried upgrading since Vyatta abandoned the XORP platform and moved to the Quagga platform, but I'm guessing (based on experience w/ Quagga) that they have a lot fewer of these quirks that I've described. Quagga is pretty decent, but it is not uncommon for

Re: Federal Government Interest in your patch progress

2008-07-25 Thread Sean Donelan
On Fri, 25 Jul 2008, Jared Mauch wrote: They wanted someone to apporach those NANOG guys to see if they'll get off their butts and upgrade. Personally, I share some of their frustration in getting the reasonable people to upgrade their software, knowing that the unreasonable folks

Re: Software router state of the art

2008-07-25 Thread Joe Greco
Would you rather deploy a $3000 cisco edge box which is a unexpandable, 100 mbit piece of crap, or throw two $2000 Dell boxes and have a 1 GigE platform? You don't need two $2000 Dell boxes to get a 1G platform, but this isn't the list for that. You also don't need a ton of money to do open

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-25 Thread Matthew Petach
On 7/24/08, Hank Nussbacher [EMAIL PROTECTED] wrote: On Thu, 24 Jul 2008, Jeffrey Ollie wrote: Interestingly enough, Google just added a feature to GMail to force secure connections: http://googlesystem.blogspot.com/2008/07/force-gmail-to-use-secure-connection.html Jeff I wish

Re: Exploit for DNS Cache Poisoning - RELEASED

2008-07-25 Thread Pete Carah
Paul Vixie wrote: in http://permalink.gmane.org/gmane.linux.redhat.fedora.general/306278 we see this text: The DNS attacks are starting!!! Below is a snippet of a logwatch from last night. Be sure all DNS servers are updated if at all possible. The spooks are out in

Re: Exploit for DNS Cache Poisoning - RELEASED

2008-07-25 Thread Graeme Fowler
On Fri, 2008-07-25 at 18:14 -0400, Pete Carah wrote: I saw much more than this *from the same address* starting two days ago, and from several other blocks belonging to the same university starting last week, to my home router and another server. So far my better connected servers haven't