Re: [dns-operations] Trustworthiness of PTR record targets

2014-03-04 Thread Jo Rhett
except for all those filter rules that add points if your reverse DNS looks like a dynamic IP? ;-) -- Jo Rhett +1 (415) 999-1798 Skype: jorhett Net Consonance : net philanthropy to improve open source and internet projects. Author of - Learning MCollective: http://shop.oreilly.com/product/06

Re: [dns-operations] summary of recent vulnerabilities in DNS security.

2013-10-22 Thread Jo Rhett
ernon Schryverv...@rhyolite.com > _______ > dns-operations mailing list > dns-operations@lists.dns-oarc.net > https://lists.dns-oarc.net/mailman/listinfo/dns-operations > dns-jobs mailing list > https://lists.dns-oarc.net/mailman/l

Re: [dns-operations] Can MX be working with CNAME?

2013-10-21 Thread Jo Rhett
cated behavior for more than 20 years now. And yes, if you use a canonical name pointer at the far side of an @ sign, it should be rewritten to the domain it is pointing at. That is exactly that DNS and straightforward English indicates. -- Jo Rhett Net Consonance : net philanthropy to impr

Re: [dns-operations] Should medium-sized companies run their own recursive resolver?

2013-10-18 Thread Jo Rhett
ave bought their own pain. -- Jo Rhett Net Consonance : net philanthropy to improve open source and internet projects. Author of Instant Puppet 3 Starter: http://www.netconsonance.com/instant-puppet-3-starter-book/ ___ dns-operations mailing list

Re: [dns-operations] Can MX be working with CNAME?

2013-10-18 Thread Jo Rhett
resolver, you should lose your tech cred and go work at a grocery store if you can't. We need to make stupidity hurt them, not make it easier for them to do, and easier for their stupidity to hurt us. -- Jo Rhett Net Consonance : net philanthropy to improve open source and internet proje

Re: [dns-operations] Looking for folks to flush cache on regions.com (particularly AT&T, Charter & Bright House)

2013-04-16 Thread Jo Rhett
se > E-mail: rod.rasmus...@internetidentity.com > Office: +1.253.590.4088 > ___ > dns-operations mailing list > dns-operations@lists.dns-oarc.net > https://lists.dns-oarc.net/mailman/listinfo/dns-operations > dns-jobs mailing

Re: [dns-operations] Recently closed open resolver and reflection attacks

2013-03-06 Thread Jo Rhett
uh? Glad we don't do any business with you. > I don't see these recursive requests as much different than spam In the case of DNS requests I agree that dropping requests that are improper makes sense. There's no human sitting there wondering why they didn't ge

Re: [dns-operations] Defending against DNS reflection amplification attacks

2013-02-24 Thread Jo Rhett
and let him explain why this isn't whack-a-mole. Discuss precedence and the conservative nature of judges and most juries. Why a few good judgements soil the pan for everyone. This isn't my legal theory. This is what I've observed used very successfully in the courtroom, and hav

Re: [dns-operations] Defending against DNS reflection amplification attacks

2013-02-24 Thread Jo Rhett
> On 23/02/2013, at 2:53 AM, Jo Rhett wrote: >> No. I've had this conversation many times and employees of big companies >> feel that it's impossible, and don't even raise the issue with their >> management. In two different occasions I arranged a meeting wi

Re: [dns-operations] Defending against DNS reflection amplification attacks

2013-02-22 Thread Jo Rhett
On Feb 22, 2013, at 7:38 PM, Randy Bush wrote: > i do not disagree with bcp38. i just don't think repeating that anyone > who does not deploy it is an anti-internet asshole is going to get any > more significent deployment. that approach has been failing for many > years. I think that their nat

Re: [dns-operations] Defending against DNS reflection amplification attacks

2013-02-22 Thread Jo Rhett
On Feb 22, 2013, at 2:09 PM, Randy Bush wrote: Civil lawsuits by victims of DNS reflection and other attacks that depend on failures to deploy BCP38 might help convince boards of directors. >> Having been a witness in two of these lawsuits, > > cites, please That's a great request

Re: [dns-operations] Defending against DNS reflection amplification attacks

2013-02-22 Thread Jo Rhett
On Feb 22, 2013, at 12:04 PM, Randy Bush wrote: >> Civil lawsuits by victims of DNS reflection and other attacks that >> depend on failures to deploy BCP38 might help convince boards of >> directors. > > as will black helicopters. can we stick to reality as we actually experience > it? Having

Re: [dns-operations] Defending against DNS reflection amplification attacks

2013-02-22 Thread Jo Rhett
On Feb 22, 2013, at 10:22 AM, Joe Abley wrote: > - big companies with staff who care about BCP38 have likely already deployed > it; No. I've had this conversation many times and employees of big companies feel that it's impossible, and don't even raise the issue with their management. In two d

Re: [dns-operations] universal deployment of BCP38 and won't/can't semantics

2013-02-22 Thread Jo Rhett
On Feb 22, 2013, at 10:19 AM, Jim Reid wrote: > There's no point arguing the semantics of "don't" and "can't". As Paul > mentioned earlier, let's remain realistic. Universal deployment of BCP38 > simply isn't going to happen, no matter how much you or I *really want* that. > [And I do.] Get ove

Re: [dns-operations] Defending against DNS reflection amplification attacks

2013-02-22 Thread Jo Rhett
On Feb 22, 2013, at 4:04 AM, Paul Vixie wrote: > at which point it's easier to fix source address validation and make THAT > universal. which we already know can't be done. Don't confuse "won't" with "can't". It absolutely can be done. It won't be done because the carriers see profit in lazines