Re: [dns-operations] summary of recent vulnerabilities in DNS security.

2013-10-20 Thread David Miller
C; >> it is as dear to me as it is to you :-) > > I'm sorry, but I think the mention of DNSSEC in your paper exists only > because others forced it. I'm forced to that belief by various things > including your refusal admit the obvious about relative priorities and > by stat

Re: [dns-operations] Introducing CNAME Flattening: RFC-Compliant CNAMEs at a Domain's Root

2014-04-04 Thread David Miller
On 04/04/2014 06:23 AM, Anthony Eden wrote: > While CloudFlare did not give any credit to previous work done (which > sort of pisses me off, but whatever), they are essentially implementing > the same thing that Amazon did with their ALIAS implementation, the same > thing that we did with the DNSim

Re: [dns-operations] Introducing CNAME Flattening: RFC-Compliant CNAMEs at a Domain's Root

2014-04-04 Thread David Miller
On 04/04/2014 06:54 AM, Mark Andrews wrote: > > Or one can add SRV or some other record that does the name > to server mapping and not have to do all this behind the > scenes stuff. One would need to add several SRV records, if the host provided several services. One would also

Re: [dns-operations] specifics of UDP response with truncate bit; odd google fail on AAAA responses w/ truncation

2012-05-24 Thread David Miller
On 5/24/2012 11:08 PM, paul vixie wrote: > On 5/25/2012 1:38 AM, Ryan Rawdon wrote: >> ... So here are the questions I am left with right now: >> - Should a packet with the truncate bit set contain answers, or is this >> optional? I'm guessing optional, but could see arguments for the UDP >> re

Re: [dns-operations] "bad infosec economics " Re:

2012-06-12 Thread David Miller
On 6/12/2012 12:34 PM, Edward Lewis wrote: > At 14:18 + 6/10/12, Paul Vixie wrote: > >> thinking about or acting against ANY is bad infosec economics. > > This I agree with. Here are some of my knee-jerk, anti-filtering > thoughts: > > 1 - DNS providers are paid to answer questions, not drop t

Re: [dns-operations] Help with DNSSEC config

2012-08-03 Thread David Miller
On 8/3/2012 3:19 AM, Mohamed Lrhazi wrote: > On Fri, Aug 3, 2012 at 3:01 AM, Mark Andrews wrote: > >> The DNSKEY/DS disagree on the DNSSEC algorithm in use. >> >> 5 != 7 >> > > Thanks a lot Mark. > > My Registar's GUI, when entering my DS record, has these options for the

Re: [dns-operations] Effectivity of filter lists against DNS amplification attacks

2012-08-17 Thread David Miller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 8/17/2012 6:22 AM, Daniel Stirnimann wrote: > Hi Klaus > > On one of our name server which is secondary for a little over one > thousand second level domains has been abused for DNS > Amplification Attacks since November 2011. > > There has not b

Re: [dns-operations] Go Daddy is down

2012-09-11 Thread David Miller
That youtube video is from December 2011, probably not related. -DMM On 9/11/2012 1:55 PM, Simon Munton wrote: > http://www.youtube.com/watch?v=SW_0s3kYT24 > > Counter statement - take your pick > > > If they have an anycast DNS network with nodes all over the world, each > peering into differ

Re: [dns-operations] Weird query name "case" queries?

2012-09-18 Thread David Miller
On 9/18/2012 8:06 PM, Mohamed Lrhazi wrote: > I've noticed quite a bit of queries to our DNS servers, that look > pretty normal except for the fact that the character case is weird.. > seems to be switching case randomly! > > like: > > nAme1.dOMain.Com > naMe2.DOMain.coM > ... > > and so on..

Re: [dns-operations] How to get the anycast networks?

2012-10-13 Thread David Miller
On 10/13/2012 5:41 AM, dnsops_x730df7...@spamfaenger.f-streibelt.de wrote: > Am Sa, 13.10.12 um 16:31:22 Uhr > schrieb pangj : > >> Hello, >> >> My question is, if we want to deploy a global DNS service, how to get >> the anycast networks? >> We are a small company in Asia, don't have our own ASN

Re: [dns-operations] First experiments with DNS dampening to fight amplification attacks

2012-10-25 Thread David Miller
On 10/25/2012 1:48 PM, paul vixie wrote: > On 10/25/2012 5:08 PM, Michael Hoskins (michoski) wrote: >> ... >> >> Seems to show clever hacks can be useful (looks good for roots), but don't >> generally work against real hackers who typically read lists (and source >> code). :-) > > until cisco m

Re: [dns-operations] DNS TCP performance testing

2013-03-11 Thread David Miller
list dns-operations@lists.dns-oarc.net https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs -- -__ David Miller dmil...@tiggee.com ___ dns-operatio