pay.gov and IPv6

2016-11-16 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Following up on a two year old thread, one of my clients just hit this problem. The failure is not that www.pay.gov is not reachable over ipv6 (2605:3100:fffd:100::15). They accept (TCP handshake) the port 443 connection, but the connection then hang

pay.gov and IPv6

2016-11-16 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Following up on a two year old thread, one of my clients just hit this problem. The failure is not that www.pay.gov is not reachable over ipv6 (2605:3100:fffd:100::15). They accept (TCP handshake) the port 443 connection, but the connection then hang

Re: pay.gov and IPv6

2016-11-16 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2016-11-16 at 20:59 +, Matthew Kaufman wrote: > I fixed it (and Netflix) by turning off IPv6 for all my users... but > any chance this is a path MTU issue causing the apparent hang? I fixed it by using the rpz feature of bind to disable

Re: pay.gov and IPv6

2016-11-17 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2016-11-17 at 15:32 -0500, Lee wrote: > That's fine, but until someone is willing to work with them don't > expect it to get fixed. I am working with pay.gov.c...@clev.frb.org, trying to explain the problem. They seem to think I should provi

Re: pay.gov and IPv6

2016-11-18 Thread Carl Byington
> > I am working with pay.gov.c...@clev.frb.org, trying to explain the > problem. The intersection of government bureaucracy and technical issues is frustrating to say the least. I just sent the message below, but have no expectation that it will change anything. == On Fri, 2016-11

Re: pay.gov and IPv6

2016-11-20 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sun, 2016-11-20 at 10:51 +0100, JORDI PALET MARTINEZ wrote: > For example, you will not get this working if you have a lower MTU > than 1.500, which is quite normal, not just for tunnels, but also > because the PPP/others encapsulation in many acc

Re: pay.gov and IPv6

2016-11-20 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2016-11-21 at 11:26 +1100, Mark Andrews wrote: > And the advertised MSS was what? On my box I'm seeing 1220 for > IPv6 compared with 1460 for IPv4. 1220 shouldn't see PMTU problems. --> 2001:8d8:100f:f000::2d5 syn w/ mss 1440 <-- 2

Re: DOT FRA website broken on ipv6

2017-02-04 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2017-02-02 at 10:22 -0800, Ca By wrote: > Anyone have a contact at DOT or FRA that can solve this? It would be > really nice if they remove the DNS record on www.fra.dot.gov > until it works correctly, customers are complaining Their S

Re: IoT security

2017-02-08 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2017-02-08 at 08:30 -0800, Damian Menscher wrote: > So here's a modest proposal: log in as root and brick the > device. I strongly suspect that when the problem gets bad *enough*, someone will do exactly that. Yes, it is illegal in many plac

Re: Microsoft O365 labels nanog potential fraud?

2017-03-29 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2017-03-29 at 11:32 -0400, William Herrin wrote: > The gold standard, Spamassassin, does not. Indeed, the message to > which I reply was scored by spam assassin as "SPF_PASS" even though > you do not include NANOG's servers in the SPF record

Re: Microsoft O365 labels nanog potential fraud?

2017-03-29 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2017-03-29 at 09:24 -0700, Alan Hodgson wrote: > So for DMARC+SPF to pass not only must the message come from a source > authorized by the envelope sender domain, but that domain must be the > same domain (or parent domain or subdomain) of t

Re: Microsoft O365 labels nanog potential fraud?

2017-03-29 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Thu, 2017-03-30 at 15:21 +1100, Mark Andrews wrote: > Well you should be checking the correct TXT record for SPF. > dig marketo-email.box.com txt +short > "v=spf1 ip4:192.28.147.168 ip4:192.28.147.169 -all" Hm, a closer reading of rfc7489 sheds

Re: Please run windows update now

2017-05-16 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, 2017-05-16 at 10:33 -0500, Brad Knowles wrote: > > In the American approach, if there are a significant number of road > fatalities, then it's the drivers own fault and they should have taken > more care. They are automatically to blame for

Re: A Deep Dive on the Recent Widespread DNS Hijacking

2019-02-26 Thread Carl Byington via NANOG
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, 2019-02-25 at 17:04 +1100, Mark Andrews wrote: > I would also note that a organisation can deploy RFC 5011 for their > own zones and have their own equipment use DNSKEYs managed using RFC > 5011 for their own zones. This isolates the organis