Re: couple of questions regarding 'lifeline' and large scale nat...

2012-02-11 Thread Masataka Ohta
Leo Bicknell wrote: The applications can simply be debugged to use socket option of REUSEPORT. Simple is subjective. To the problems of some applications that make thousands of TCP connections in a short order eating up ports makes it a nightmare to manage and debug, I gave you an

Re: Iran blocking essentially all encyrpted protocols

2012-02-11 Thread Shahab Vahabzadeh
It is not accessible to with XMPP, yahoo google none of them is not accessible from Iran. I have not try obfsproxy but as a ordinary connection we do not have https :) -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Neil Harris
On 11/02/12 01:16, Masataka Ohta wrote: Randy Bush wrote: My $0.02 on this issue is if the message is rich text I hover over the link and see where it actually sends me. idn has made this unsafe I pointed it out at IETF Munich in 1997 that with an example of: MICROSOFT.COM where

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Randy Bush
My $0.02 on this issue is if the message is rich text I hover over the link and see where it actually sends me. idn has made this unsafe Techniques to deal with this sort of spoofing already exist: see http://www.mozilla.org/projects/security/tld-idn-policy-list.html for one quite effective

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread chris
The internet was way cooler before that chris On Feb 11, 2012 12:09 PM, Randy Bush ra...@psg.com wrote: My $0.02 on this issue is if the message is rich text I hover over the link and see where it actually sends me. idn has made this unsafe Techniques to deal with this sort of spoofing

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Javier Henderson
On Feb 11, 2012, at 12:13 PM, chris wrote: The internet was way cooler before that Yes, and a lot of us could run open relays on our SMTP servers to help each other out, and a full usenet feed fit on a plain ol' 9600 baud link. But no way I could have at home the kind of bandwidth I can get

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Valdis . Kletnieks
On Sat, 11 Feb 2012 09:09:25 PST, Randy Bush said: My $0.02 on this issue is if the message is rich text I hover over the link and see where it actually sends me. idn has made this unsafe Techniques to deal with this sort of spoofing already exist: see

RE: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Keith Medcalf
Unfortunately that's not under control of those businesses. This plain text email you sent comes across with clickable mailto and http links in your signature in most modern email clients despite you having sent it in plain text. Helpful email program defaults won't force people to copy and

Re: Iran blocking essentially all encyrpted protocols

2012-02-11 Thread Richard Barnes
FWIW: A colleague in Iran was able to connect to a server in the US using HTTPS on a non-standard port (). It appears that the Iranian government is not blocking TLS/HTTPS per se, but just port 443. So in principle, if there were just some HTTPS proxies using non-standard ports, then people

Re: Iran blocking essentially all encyrpted protocols

2012-02-11 Thread Alan Clegg
On 2/11/2012 4:50 PM, Richard Barnes wrote: FWIW: A colleague in Iran was able to connect to a server in the US using HTTPS on a non-standard port (). It appears that the Iranian government is not blocking TLS/HTTPS per se, but just port 443. So in principle, if there were just some

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Masataka Ohta
Neil Harris wrote: Techniques to deal with this sort of spoofing already exist: see http://www.mozilla.org/projects/security/tld-idn-policy-list.html It does not make sense that .COM allows Cyrillic characters: http://www.iana.org/domains/idn-tables/tables/com_cyrl_1.0.html i script of a

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Jimmy Hess
On Fri, Feb 10, 2012 at 10:56 AM, Steven Bellovin s...@cs.columbia.edu wrote: You know, clickable objects in automated business communications are a standard practice, the larger the organization sending the message, the more complicated and annoying their standard e-mail template full of HTML

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Masataka Ohta
valdis.kletni...@vt.edu wrote: (The actual policy for the .UA registrar is more subtle. They *do* in fact allow U+0441 Cyrillic Small Letter ES which is visually a C to us Latin-glyph users. However, they require at least one character that's visually unique to Cyrillic in the domain name.

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread John Levine
Nice. Basically, unless the TLD registrar has a public policy that basically says We don't allow names with cyrillic C to collide with MICROSOFT, their hostnames all get displayed as xn--gobbledygook. More or less. ICANN has been wrestling with the lookalike character issue in domain names

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Neil Harris
On 12/02/12 00:09, Masataka Ohta wrote: Neil Harris wrote: Techniques to deal with this sort of spoofing already exist: see http://www.mozilla.org/projects/security/tld-idn-policy-list.html It does not make sense that .COM allows Cyrillic characters:

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Sven Olaf Kamphuis
yes, domain names that cannot be typed in with any keyboard/charset on any computer out there, excellent idea, devide and conquerer, i wonder who came up with that idiotic plan again, probably the ITU or one of their infiltrants in icann. how about, we simply don't code any software or adjust

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Sven Olaf Kamphuis
as if it wasn't annoying enough already that some n00bs are using URI's with characters you can't type in (and in most cases don't even display correctly), icann has a better idea! hostnames you can't type in! all those struggeling regimes that want to keep local control over our internets

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Valdis . Kletnieks
On Sun, 12 Feb 2012 03:47:24 GMT, Sven Olaf Kamphuis said: (and that despite the fact that it's perfectly well possible to write -any language out there- in the first 7 bits of ascii) And it's *equally* possible to write any language out there using a 7-bit encoding of the Cyrillic character

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Masataka Ohta
Neil Harris wrote: I'm not a flag-waver for IDN, so much as a proponent of ways to make IDN safer, given that it already exists. It's like trying to make DES safer. Lots of people have thought about this quite carefully. Not at all. They (including some Japanese) just wished IDN work

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Valdis . Kletnieks
On Sun, 12 Feb 2012 10:25:53 +0900, Masataka Ohta said: valdis.kletni...@vt.edu wrote: (The actual policy for the .UA registrar is more subtle. They *do* in fact allow U+0441 Cyrillic Small Letter ES which is visually a C to us Latin-glyph users. However, they require at least one

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Masataka Ohta
valdis.kletni...@vt.edu wrote: (and that despite the fact that it's perfectly well possible to write -any language out there- in the first 7 bits of ascii) Yes, any language including FORTRAN. And it's *equally* possible to write any language out there using a 7-bit encoding of the Cyrillic

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Jimmy Hess
On Sat, Feb 11, 2012 at 11:13 PM, valdis.kletni...@vt.edu wrote: On Sun, 12 Feb 2012 10:25:53 +0900, Masataka Ohta said: valdis.kletni...@vt.edu wrote: It's interesting how some people are insisting that the IDN code has to be *perfect* and make it *totally* impossible to create a phishable

Re: Dear RIPE: Please don't encourage phishing

2012-02-11 Thread Joel jaeggli
On 2/11/12 19:34 , Sven Olaf Kamphuis wrote: yes, domain names that cannot be typed in with any keyboard/charset on any computer out there, excellent idea, devide and conquerer, i wonder who came up with that idiotic plan again, probably the ITU or one of their infiltrants in icann. If it's