Re: Shim6, was: Re: filtering /48 is going to be necessary

2012-03-15 Thread Valdis . Kletnieks
On Fri, 16 Mar 2012 08:31:07 +0900, Masataka Ohta said: > Here is an exercise for you insisting on DNS, an intermediate > system. > > What if DNS servers, including root ones, are mobile? So, is this question more like: What if computers worked in trinary? or What if people show criminal

Re: Shim6, was: Re: filtering /48 is going to be necessary

2012-03-15 Thread Valdis . Kletnieks
On Fri, 16 Mar 2012 09:29:44 +0900, Masataka Ohta said: > valdis.kletni...@vt.edu wrote: > > > You're asking a "what if" for a usage case that nobody sane has suggested. > > If you are saying it's insane to use DNS to manage frequently > changing locations of mobile hosts instead of relying on > im

Clueful security contact at humana.com?

2012-03-15 Thread Valdis . Kletnieks
Anybody know somebody with actual clue at humana.com? The security address I have bounces with "no such user", and their website is sufficiently screwed up that "supported browsers" is hidden under "Legal information". I've identified multiple issues that their infosec team probably wants to deal

Re: shared address space... a reality!

2012-03-16 Thread Valdis . Kletnieks
On Fri, 16 Mar 2012 14:17:38 PDT, Owen DeLong said: > It may be easy to sell, but it's also fictitious. > > NAT is antithetical to security, not beneficial to it. Anybody want to hazard a guess what % of Vint Cerf's famous 140M compromised boxes were behind a NAT and still got pwned by a drive-by

Re: Verizon, FiOS, and CLEC/UNE orders (was AT&T diversity)

2012-03-21 Thread Valdis . Kletnieks
On Wed, 21 Mar 2012 16:00:32 -0400, Jay Ashworth said: > Someone tells me off list that indeed, if the plant isn't *there*, VZN > isn't required to build it. > > Now, if that's the case, then they can't adminstratively block *someone > else* from building it, either... Yes, but it's assymetric.

Re: last mile, regulatory incentives, etc (was: att fiber, et al)

2012-03-22 Thread Valdis . Kletnieks
On Thu, 22 Mar 2012 13:40:27 -0700, Owen DeLong said: > Yes, I find it quite "amusing" that I am paying additional fees on all > of my telecommunications services to subsidize high speed PON networks > in rural bumf*ck while I can't get anything like it in San Jose, California. That's OK, you're a

Re: how to report spam to Yahoo!

2012-03-23 Thread Valdis . Kletnieks
On Fri, 23 Mar 2012 15:21:28 +1300, Mark Foster said: > If anyone knows what Yahoo's intentions are in this space, i'd love to > hear about it. There's good reason to think that even Yahoo doesn't know what its intentions are. http://pandodaily.com/2012/03/16/yahoo-decides-to-fire-its-brightest

Re: $1.5 billion: The cost of cutting London-Tokyo latency by 60ms

2012-03-23 Thread Valdis . Kletnieks
On Fri, 23 Mar 2012 12:53:45 +0100, Eugen Leitl said: > http://www.extremetech.com/extreme/122989-1-5-billion-the-cost-of-cutting-london-toyko-latency-by-60ms Lower latency is good... > The massive drop in latency is expected to supercharge algorithmic stock > market trading, where a difference o

Re: $1.5 billion: The cost of cutting London-Tokyo latency by 60ms

2012-03-23 Thread Valdis . Kletnieks
On Fri, 23 Mar 2012 15:56:46 -, Brandon Butterworth said: > > I'd be quite interested in seeing the MTTR for a sub-ice cable break which > > happened in late october. > > More fun too when we get global warming under control and there's no > longer any way to reach it Submarines. It's alleged

Re: $1.5 billion: The cost of cutting London-Tokyo latency by 60ms

2012-03-23 Thread Valdis . Kletnieks
On Fri, 23 Mar 2012 13:16:59 -0700, George Herbert said: > The physics is not conducive to improving the situation a lot. > > There's probably $1.5 billion in the ground already in neutrino > detectors; the total combined detector bit rate is pretty poor. One > experiment looking at neutrinos comi

Re: last mile, regulatory incentives, etc (was: att fiber, et al)

2012-03-23 Thread Valdis . Kletnieks
On Fri, 23 Mar 2012 14:18:26 -1000, Michael Painter said: > "The indication of above average or below average is based on a comparison of > the actual test result to the current NTIA > definition of broadband which is 768 kbps download and 200 kbps upload. Any > test result above the NTIA defini

Re: last mile, regulatory incentives, etc (was: att fiber, et al)

2012-03-23 Thread Valdis . Kletnieks
On Sat, 24 Mar 2012 00:08:11 -0400, Marcel Plug said: > This article from arstechnica is right on topic. Its about how the > city of Amsterdam built an open-access fibre network. It seems to me > this is the right way to do it, or at least very close to the right > way.. Cue somebody denouncing

Re: Muni Fiber (was: Re: last mile, regulatory incentives, etc)

2012-03-25 Thread Valdis . Kletnieks
On Sun, 25 Mar 2012 12:37:24 -0700, JC Dill said: > *feasible* lifetime of 20-50 years? Maybe in 5-10 years all consumer > data will be transferred via wireless And that would be using what spectrum and what technology? Consider what the release of one Apple product did to the associated carrie

Re: $1.5 billion: The cost of cutting London-Tokyo latency by 60ms

2012-03-26 Thread Valdis . Kletnieks
On Mon, 26 Mar 2012 12:16:53 +0200, Tei said: > I imagine a easier solution. Use a random number generator in both > sides, with the same seed. Then use a slower way to send "packets > re-sync" that will contain the delta from the generated number, to the > real actual number. Congrats. You've

Re: $1.5 billion: The cost of cutting London-Tokyo latency by 60ms

2012-03-26 Thread Valdis . Kletnieks
On Mon, 26 Mar 2012 08:59:34 -0400, Rodrick Brown said: > HIgh frequency trading does provide a service to the financial markets as a > whole despite what the media and government politicians will have you think. OK, I'll bite. What benefit does the market *as a whole* get from the ability to do t

Re: BCP38 Deployment

2012-03-28 Thread Valdis . Kletnieks
On Wed, 28 Mar 2012 13:36:49 -0700, Leo Bicknell said: > I think some engineers need to ask some interesting questions, like > how, in a box doing NAT to an outside IP, does it ever emit a packet > not from that outside IP? The fact that you can spoof packets > through some of the NAT implementat

Re: Attack on the DNS ?

2012-03-31 Thread Valdis . Kletnieks
On Sat, 31 Mar 2012 05:05:46 -0400, Marshall Eubanks said: > Anyone seen signs of this attack actually occurring ? > > http://www.nytimes.com/2012/03/31/technology/with-advance-warning-bracing-for-attack-on-internet-by-anonymous.html?_r=1 "Those preparations turned into a fast-track, multimillio

Re: Outdoor Wireless Access Point

2012-03-31 Thread Valdis . Kletnieks
On Sat, 31 Mar 2012 15:48:37 -0700, Network IP Dog said: > I'm utterly amazed how many people give away free consultant work. A lot of us are quite busy with $DAYJOB and not in a position to take on a consulting engagement - and there's no good micropayment infrastructure to deal with 20-minute co

Re: ipv6 classful addressing with mesh?

2012-03-31 Thread Valdis . Kletnieks
On Sat, 31 Mar 2012 19:35:05 -0500, Charles N Wyble said: > How much geographical accuracy does this imply? Just enough to indicate > where the "heart" of a network is, or was traditionally. A chunk can > represent any number from 0-65534, because it can represent up to 65535 > unique numbers and

Re: Outdoor Wireless Access Point

2012-04-01 Thread Valdis . Kletnieks
On Sun, 01 Apr 2012 11:28:34 +0430, Shahab Vahabzadeh said: > Thanks for your time and your answer, Of course I know how to search in > google or internet. > But the problem is as you told to have a good network and launch the best > solution. Unfortunately, I can't make any real recommendation

Re: SORBS?!

2012-04-06 Thread Valdis . Kletnieks
On Fri, 06 Apr 2012 07:31:47 -0400, Drew Weaver said: > That's just not true, we would much rather be notified of something that a > reputation list finds objectionable and take it down ourselves than have > Senderbase set a poor reputation on dozens of IaaS customers. If it was industry-wide stan

Re: SORBS?!

2012-04-06 Thread Valdis . Kletnieks
On Fri, 06 Apr 2012 09:55:35 -0400, Drew Weaver said: > That is again, not true. > > Senderbase's listings don't correlate to any public information so it's pretty > much impossible to pro-actively protect ourselves from having our IPs set to > poor. You missed the point - if it was industry stan

Re: The day SORBS goes away ...

2012-04-06 Thread Valdis . Kletnieks
On Sat, 07 Apr 2012 07:00:52 +0530, Suresh Ramasubramanian said: > err, i dont know but yahoo hasnt yet acquired this random webhost whose > abuse you're trying to mail > > - The following addresses had permanent fatal errors - > > > > (reason: 554 rejected due to spam content) Right

Re: SORBS?!

2012-04-06 Thread Valdis . Kletnieks
On Fri, 06 Apr 2012 20:48:44 -0500, Jimmy Hess said: > That's kind of vague to say it's "unlikely to see 1 abuser". What is > the probability that > more IPs in the same /24 are likely to harbor abusers, given that you have > received abuse from one IP? It's similar to pirhanas or cockroaches

Re: Level3 IPv6 peering with HE only in London?

2012-04-12 Thread Valdis . Kletnieks
On Thu, 12 Apr 2012 08:35:13 -0700, Dave Sotnick said: > You should see this repaired at this time, looks like the peering > between L3 and HE crashed in > stateside when the ipv6 max prefix limits exceeded the router configurations. Unless it was some bozo deaggregating, this is actually a good

Re: Network Storage

2012-04-12 Thread Valdis . Kletnieks
On Thu, 12 Apr 2012 14:18:30 -0700, "John T. Yocum" said: > In that case, just keep adding disks to you capture system, or use a NAS > to do it. On Thu, 12 Apr 2012 13:43:49 -0700, Joel jaeggli said: > 1TB is 2.276 hours at 1Gb/s If he's got a gigabit of traffic, he's going to be adding another s

Re: The day SORBS goes away ...

2012-04-13 Thread Valdis . Kletnieks
On 13 Apr 2012 22:01:14 -, "John Levine" said: > > dnslists = dialups.mail-abuse.org \ > > : rbl-plus.mail-abuse.org \ > > Are you paying Trend for access to these? If not, you're not getting > any answers from them and they're not blocking anything. Do

Re: Most energy efficient (home) setup

2012-04-15 Thread Valdis . Kletnieks
On Sun, 15 Apr 2012 01:46:29 -0500, Joe Greco said: > Since we don't hear about Mac mini server users screaming about how > their servers are constantly crashing, the severity and frequency of Googling for 'mac mini server crash' gets about 11.6M hits. I gave up after 10 pages of results, but up

Re: Automatic IPv6 due to broadcast

2012-04-16 Thread Valdis . Kletnieks
On Mon, 16 Apr 2012 23:39:46 +0530, Anurag Bhatia said: More a host config issue than a NANOG issue, but what the heck... > I wonder if anyone else also had similar issues? Also, if my guesses are > correct then how can we disable Red Hat distro oriented servers from taking > such automated confi

Re: Automatic IPv6 due to broadcast

2012-04-16 Thread Valdis . Kletnieks
On Mon, 16 Apr 2012 17:38:07 -0400, Brandon Penglase said: > flat out broke. Sadly this event left a really sour taste for IPv6 with > Networking department (whom I was occasionally bugging about v6). Talking point: "If you guys had deployed a proper IPv6 infrastructure, those tunnels wouldn't ha

Re: Automatic IPv6 due to broadcast

2012-04-23 Thread Valdis . Kletnieks
On Mon, 23 Apr 2012 11:23:14 -0400, Chuck Anderson said: > > On Mon, Apr 23, 2012 at 06:38:09AM -0700, Owen DeLong wrote: >> In a lot of cases, enforcing that all address assignments are via DHCP can >> still be >> counter-productive. Especially in IPv6. > If a specific managed environment provide

Re: Squeezing IPs out of ARIN

2012-04-25 Thread Valdis . Kletnieks
On Wed, 25 Apr 2012 10:54:39 -0500, -Hammer- said: > I can say that I recently completed the purchase of a large IPv6 block. "purchase"??!? pgpMtR5JcMTNK.pgp Description: PGP signature

Re: Operation Ghost Click

2012-04-27 Thread Valdis . Kletnieks
On Fri, 27 Apr 2012 19:35:51 -0500, Ameen Pishdadi said: > If the user is stupid enough to be infected for that long And they'd know they were infected, how, exactly? (Think carefully before answering that, and keep in mind that although *you* may be the world's greatest IT specialist, the average

Re: Need spamcop/ironport security contact

2012-04-27 Thread Valdis . Kletnieks
On Fri, 27 Apr 2012 19:29:48 -0700, Mike said: > I have a security incident to report and need to make contact with a > senior level contact responsible for spamcop/ironport immediately. And you need a *senior* level contact, why? pgpu7h5Yq79f2.pgp Description: PGP signature

Re: Juniper MX960 with SCB-E vs Cisco ASR9k with RSP400

2012-04-29 Thread Valdis . Kletnieks
On Sun, 29 Apr 2012 10:30:37 -0400, Abdelkader Chikh Daho said: > I wan to ask for your feedback about these two devices : Juniper MX960 > with SCB-E and Cisco AS9k with RSP400. They both work well in some situation, and totally fail in others. It would help if you gave more detail what problem

Re: Operation Ghost Click

2012-05-01 Thread Valdis . Kletnieks
On Tue, 01 May 2012 10:40:57 -0400, Rich Kulawiec said: > Why haven't you cut these obviously-infected systems off entirely? There's quite likely multiple systems behind a NAT-ish router, and Comcast doesn't have any real option but to nuke *all* the systems behind the router. This can be a tad

Re: CDNs should pay eyeball networks, too.

2012-05-01 Thread Valdis . Kletnieks
On Tue, 01 May 2012 14:13:01 -0700, Mike Hale said: > > "But you *may not* tie your > > price to the hours used to produce it for the first." The above was William Herrin's comment (quoting level fixed by me). Mike - please get mail software that does correct quoting. It's 2012, and proper quoti

Re: CDNs should pay eyeball networks, too.

2012-05-01 Thread Valdis . Kletnieks
On Tue, 01 May 2012 17:16:38 -0400, "Patrick W. Gilmore" said: > P.S. Bill, it is clear you have a point, but you are really stretching > it. And it is not relevant to the discussion at hand. Oh, I dunno. Double billing 2 customers for development and double billing 2 customers for transporting

Re: CDNs should pay eyeball networks, too.

2012-05-01 Thread Valdis . Kletnieks
On Tue, 01 May 2012 14:27:50 -0700, Mike Hale said: > > Mike - please get mail software that does correct quoting. It's 2012, and > > proper quoting has been understood since the mid 80s. There's *really* no > > excuse for using software that can't get quoting and citing right. > *eye roll* > Real

Re: CDNs should pay eyeball networks, too.

2012-05-01 Thread Valdis . Kletnieks
On Tue, 01 May 2012 18:03:06 -0400, David Miller said: > From an accounting perspective, every R&D effort that I have seen or > been a part of was not billed to any customer. R&D has always, in my > experience, been an internal charge against a company's own profits. RIght - and when pricing the

Re: CDNs should pay eyeball networks, too.

2012-05-01 Thread Valdis . Kletnieks
On Tue, 01 May 2012 18:46:56 -0400, Alex Rubenstein said: > If you are the only game in town, and you have a great product, you sell it > for the most you can. Pay attention. What I said: > going to have to charge at least $3,160 a copy to make a profit on the > project. *at least*. You can c

Re: Operation Ghost Click

2012-05-02 Thread Valdis . Kletnieks
On Wed, 02 May 2012 12:13:56 -0700, Jeroen van Aart said: > Livingood, Jason wrote: > > you may just have nuked their 911 capability. Actually, I said that, not Jason. Jason just used mail software that *can't get quoting right* to reply to my message, so your quote of his message got the attribu

Re: Operation Ghost Click

2012-05-02 Thread Valdis . Kletnieks
On Wed, 02 May 2012 13:10:28 -0700, Jeroen van Aart said: > Technical specs aside I believe you are mistaken with regards to the > actual every day reality. My experience (and anyone else I talked to) > calling to and from mobile phones has been 100% a bad one with regards > to audio quality. I l

Re: Cellphones and Audio (was Ghost Click, though I got no idea why)

2012-05-03 Thread Valdis . Kletnieks
On Thu, 03 May 2012 11:01:01 -0400, Jay Ashworth said: > In general, though, intelligibility comes from the higher frequencies, > and 3.4kHz is *usually* high enough. What might be the case is that you'd > have more trouble *distinguishing* amongst women, or between women and > children, because

Re: mulcast assignments

2012-05-03 Thread Valdis . Kletnieks
On Thu, 03 May 2012 13:38:14 -0700, Greg Shepherd said: > > Make sense? > > Sure, for v6. :) Does it make sense to be planning new deployments for anythign else? ;) (Hint - if your reaction is "but we're not v6-capable", who's fault is that?) pgpI1LRac8WuO.pgp Description: PGP signature

Re: Protocols for Testing Intrusion Detection?

2012-05-15 Thread valdis . kletnieks
On Mon, 14 May 2012 16:52:36 -0700, Bill Stewart said: > - Is there any application that can actually set the RFC3514 Evil Bit? Here ya go. hping3 patch. Swiss army knives always need one more blade... --- hping3-20051105/globals.h.3514 2007-04-27 16:14:42.0 -0400 +++ hping3-20051105/globa

Re: Vixie warns: DNS Changer ‘blackouts’ inevitable

2012-05-23 Thread valdis . kletnieks
On Wed, 23 May 2012 13:09:09 -0700, Leo Bicknell said: > "In 1988, while employed by DEC, he started working on the popular >internet domain name server BIND, of which he was the primary author and >architect, until release 8." > > ISC has spent some effort on properly documenting the hi

Re: ISPs and full packet inspection

2012-05-24 Thread valdis . kletnieks
On Thu, 24 May 2012 09:13:16 -0400, not common said: > Thanks guys, I am looking for stuff to bring to my legal team (which is one > guy, that can't spell IP) and VPs. You probably want to fix that legal team. If you're an ISP and your legal eagle doesn't understand networking, you're opening you

Re: Current IPv6 state of US Mobile Phone Carriers

2012-05-25 Thread valdis . kletnieks
On Fri, 25 May 2012 15:25:35 +0900, Masataka Ohta said: > The proper way to have a static IP address is not to pay mobile > operators but to run mobile IP or something like that on your > terminal. > > You can run your home agent at your home or office. And the 80% of the world's population that

Re: Current IPv6 state of US Mobile Phone Carriers

2012-05-25 Thread valdis . kletnieks
On Sat, 26 May 2012 06:44:58 +0900, Masataka Ohta said: > An IPv4 home address may be shared by many mobile > terminals distinguished by port numbers, which is > why IPv6 is not necessary. An IPv4 address can also be shared by many mobile terminals distinguished by AOL userids. How did that work

Re: Bogon list update for prefix for 5.1.0.0/19

2012-05-29 Thread valdis . kletnieks
On Tue, 29 May 2012 20:45:51 +0100, Paul Cupis said: > On 28/05/12 22:19, Seth Mattinen wrote: > > On 5/28/12 6:31 AM, Evgeniy Aikashev wrote: > >> We are AS21219 - PJSC Datagroup and owner of 5.1.0.0/19 block. Our > >> customers have no access to some part of Internet if they use these IPs. > >>

Re: isc - a good business

2012-05-30 Thread valdis . kletnieks
On Wed, 30 May 2012 22:30:15 -0400, Andrew D Kirch said: > I just wanted to point out that you're a horrible person for employing > people at a sustainable level, for giving away the product of your > company for free, and for having the temerity to assist the FBI, on > break-even basis ensuring th

Re: Re: Vixie warns: DNS Changer ‘blackouts’ inevitable

2012-05-31 Thread valdis . kletnieks
On Thu, 31 May 2012 08:14:40 -0500, "cncr04s/Randy" said: > Exactly how much can it cost to serve up those requests... I mean for > 9$ a month I have a cpu that handles 2000 *Recursive* Queries a > second. 900 bux could net me *200,000* a second if not more. > The government overspends on a lot of

Re: Wacky Weekend: The '.secure' gTLD

2012-05-31 Thread valdis . kletnieks
On Thu, 31 May 2012 20:11:22 -0400, Jay Ashworth said: > routinely conduct security scans of registered sites. This can only play out one of 2 ways: 1) They launch an nmap scan on the 13th of every month from a known fixed address which everybody just drops traffic, and it's pointless. 2) The w

Re: IPv6 day and tunnels

2012-06-06 Thread valdis . kletnieks
On Tue, 05 Jun 2012 21:44:59 -0700, Owen DeLong said: > Second, you are correct. All L2 bridges for a given media type > should support the largest configurable MTU for that media > type, so, it is arguably a design flaw in the bridges. However, > in an environment where you have broken L2 devices

Re: ipv6 book recommendations?

2012-06-06 Thread valdis . kletnieks
On Wed, 06 Jun 2012 14:53:02 +0100, Anton Smith said: > Potentially silly question but, as Bill points out a LAN always occupies a > /64. > > Does this imply that we would have large L2 segments with a large > number of hosts on them? What about the age old discussion about > keeping broadcast se

Re: LinkedIn password database compromised

2012-06-07 Thread valdis . kletnieks
On Thu, 07 Jun 2012 13:33:59 -0400, Marshall Eubanks said: > Maybe so, but anonymous entries on linkedin seems like a zen koan, > beyond the powers of my simple mind. There's a distinction between anonymous and pseudonymous. I'm certainly not the former, but to all but maybe a dozen or two NANOG

Re: Configuration Systems

2012-06-07 Thread valdis . kletnieks
On Thu, 07 Jun 2012 11:51:51 -0700, Owen DeLong said: > This is a hard problem to solve. Not the least of the difficulties is the > fact that > if you ask 50 engineers to define "Cloud", you will get at least 100 > definitions > many of which are incompatible to the point of mutually exclusive.

Re: Configuration Systems

2012-06-07 Thread valdis . kletnieks
On Thu, 07 Jun 2012 12:12:09 -1000, Paul Graydon said: > what cloud is you've also got to go into the realms of private clouds > (using, for example, openstack), on your own infrastructure in your own > datacenter. Same definition. The user I've provisioned still has no idea where I provisioned

Re: Configuration Systems

2012-06-07 Thread valdis . kletnieks
On Thu, 07 Jun 2012 13:30:53 -1000, Paul Graydon said: > Your original definition: "cloud" == "you rented a colo, but have no > clue where". I know exactly where my colo is. I know exactly where my > physical servers are. If I run a private cloud on those servers and > provision stuff there, I'

Re: Dear Linkedin,

2012-06-08 Thread valdis . kletnieks
On Fri, 08 Jun 2012 16:07:56 -0400, Simon Perreault said: > And how about "Do not store your passwords using unsalted sha1?" Heck. I'd let them use pepper or mustard or teriyaki sauce if they wanted. Figuring out which one was used adds to the entropy. ;) pgppD53VERlTa.pgp Description: PGP sign

Re: Dear Linkedin,

2012-06-08 Thread valdis . kletnieks
On Fri, 08 Jun 2012 15:33:29 -0700, Hal Murray said: > > Yes; of course if most of those accounts are moribund and unused then you > > don't need to change them so often, but the passwords you use frequently > > should be changed at regular intervals. > > > It's pretty commonsensical once the thre

Re: Dear Linkedin,

2012-06-10 Thread valdis . kletnieks
On Sun, 10 Jun 2012 08:24:41 -0700, Joel jaeggli said: > > I don't disagree, except regarding dictionary attacks. If the attack > > isn't random then math based on random events doesn't apply. In the > > case of a purely dictionary attack if you choose a non-dictionary > > word and you are 100.00

Re: Dear Linkedin,

2012-06-10 Thread valdis . kletnieks
On Sun, 10 Jun 2012 12:29:46 -0700, Owen DeLong said: > It is far preferable for the merchant to request ID and verify that the > signature matches the ID _AND_ the picture in the ID matches the customer. Maybe from the anti-fraud standpoint, but not necessarily from the merchant's viewpoint. It

Re: IPv6 /64 links (was Re: ipv6 book recommendations?)

2012-06-13 Thread valdis . kletnieks
On Wed, 13 Jun 2012 14:47:35 +0900, Masataka Ohta said: > Dave Hart wrote: > > is inadequate for carrier NAT due to its model assuming the NAT trusts > > its clients. > > UPnP gateway configured with purely static port mapping needs > no security. > > Assuming shared global address of 131.112.32.1

Re: EBAY and AMAZON

2012-06-13 Thread valdis . kletnieks
On Wed, 13 Jun 2012 11:08:25 -0700, JC Dill said: > If both flavors were equally easy to exploit, according to your theory > above we would see more exploits on the *nix servers. Yet server-side > exploits are seen on Windows servers far more often than *nix servers, > despite the fact that more

Re: IPv6 Lo. for 6PE/6VPE

2012-06-15 Thread valdis . kletnieks
On Fri, 15 Jun 2012 10:52:17 -, "Nagendra Kumar (naikumar)" said: > Per my understanding, it is not required to have ipv6 address in loopback > intf on all P routers inorder to have 6PE work. If I remember it correctly, P > router will use :::: while originating ICMPv6 error message. How

Re: ZOMG: IPv6 a plot to stymie FBI !!!11!ONE!

2012-06-15 Thread valdis . kletnieks
On Fri, 15 Jun 2012 11:59:26 -0400, Jay Ashworth said: > http://news.cnet.com/8301-1009_3-57453738-83/fbi-dea-warn-ipv6-could-shield-criminals-from-police/ So everybody who's ever not bothered SWIP'ing an IPv4 allocation is helping the terrorists? pgpuDNGlAjKnS.pgp Description: PGP signature

Re: Simple Peering Agreement

2012-06-15 Thread valdis . kletnieks
On Fri, 15 Jun 2012 14:10:14 -0400, Justin Wilson said: > I need paperwork to justify several things the bean counters want to see > on paper. It's hard to present why you need 5 additional 10Gig ports when > you have nothing on paper of why those ports are being used. If you can't already

Re: ZOMG: IPv6 a plot to stymie FBI !!!11!ONE!

2012-06-16 Thread valdis . kletnieks
On Fri, 15 Jun 2012 15:53:48 -0700, goe...@anime.net said: > if arin would clamp down and revoke allocations that had provably > wrong/fraudulent whois data, we would probably get 50% IPv4 space back. 50%? I'd have estimated 10-15% tops. pgpgePrNUQjrP.pgp Description: PGP signature

Re: ZOMG: IPv6 a plot to stymie FBI !!!11!ONE!

2012-06-17 Thread valdis . kletnieks
On Sun, 17 Jun 2012 13:10:59 -0400, Arturo Servin said: > Wouldn't BCP38 help? The mail I'm replying to has as the first Received: line: Received: from ?IPv6:2800:af:ba30:e8cf:d06f:4881:973a:c68? ([2800:af:ba30:e8cf:d06f:4881:973a:c68]) by mx.google.com with ESMTPS id b8sm25918444anm.4.

Re: ZOMG: IPv6 a plot to stymie FBI !!!11!ONE!

2012-06-17 Thread valdis . kletnieks
On Sun, 17 Jun 2012 10:53:52 -0700, Joel jaeggli said: > On 6/17/12 10:24 , valdis.kletni...@vt.edu wrote: > > So - who owns 2800:af:ba30:e8cf:4881:973a:c68? And how does an LEO > > find that info quickly if they need to figure out who to hand a warrant to? > > so first of you introduced a typo

Re: IPv6 /64 links (was Re: ipv6 book recommendations?)

2012-06-19 Thread valdis . kletnieks
On Tue, 19 Jun 2012 22:21:11 +0900, Masataka Ohta said: >Or, a NAT gateway may receive packets to certain ports and behave as >an application gateway to end hosts, if request messages to the >server contains information, such as domain names, which is the case >with DNS, SMTP and H

Re: LinkedIn password database compromised

2012-06-20 Thread valdis . kletnieks
On Wed, 20 Jun 2012 14:39:14 -0700, Leo Bicknell said: > In a message written on Wed, Jun 20, 2012 at 02:19:15PM -0700, Leo Vegoda > wrote: > > Key management: doing it right is hard and probably beyond most end users. > > I could not be in more violent disagreement. I have to agree with Leo on t

Re: How to fix authentication (was LinkedIn)

2012-06-20 Thread valdis . kletnieks
On Wed, 20 Jun 2012 19:31:40 -0400, Kyle Creyts said: > Guess we all need implants deep in less-than-easily-operable areas to > bind us to a digitally-accessible identity. This would make for an > interesting set of user-based trust-anchoring paradigms, at least. Credential revocation would sudden

Re: IPv6 /64 links (was Re: ipv6 book recommendations?)

2012-06-21 Thread valdis . kletnieks
On Fri, 22 Jun 2012 08:40:02 +0900, Masataka Ohta said: > Owen DeLong wrote: > > What if my ISP just routes my /48? Seems to work quite well, > > actually. > > Unlike IPv4 with natural boundary of /24, routing table > explosion of IPv6 is a serious scalability problem. Do you have any *realistic*

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread valdis . kletnieks
On Tue, 03 Jul 2012 12:31:03 +0300, Saku Ytti said: > Yes. TAI time natively and presentation uses leap lookup tables to convert > to UTC. On the other hand, how many subtle bugs will we introduce when we break code that currently assumes the system clock is UTC, not TAI? pgpY3qNIz37lt.pgp Desc

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread valdis . kletnieks
On Tue, 03 Jul 2012 07:02:33 -0700, Joel jaeggli said: > Apps are buggy sounds like a really poor excuse for doing so. When the published API has been "the system clock is in UTC" for some 3 decades, I hardly think it's acceptable to call apps "buggy" for assuming that the system clock is in fact

Re: Fwd: Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread valdis . kletnieks
On Tue, 03 Jul 2012 11:35:00 -0400, shawn wilson said: > and makes it really unreliable - GPS time is *not* earth time and we rely > on that skew for everything. To that point, I hate to think how many > missile tests it took them to figure that one out :) Actually, GPS time is pretty ugly mathem

Re: F-ckin Leap Seconds, how do they work?

2012-07-03 Thread valdis . kletnieks
On Tue, 03 Jul 2012 21:49:40, Peter Lothberg said: > Leapseconds can be both positive and negative, but up to now, the > earth has only slowed down, so we have added seconds. That's what many people believe, but it's not exactly right. Leap seconds are added for the exact same reason leap days a

Re: F-ckin Leap Seconds, how do they work?

2012-07-04 Thread valdis . kletnieks
On Wed, 04 Jul 2012 12:44:40 -0500, Brett Frankenberger said: > Leap Seconds and Leap Years are completely unrelated and solve two > completely different problems. > > Leap Seconds exist to adjust time to match the Earth's actual rotation. > They exist because the solar day is not exactly 24 hours

Re: F-ckin Leap Seconds, how do they work?

2012-07-04 Thread valdis . kletnieks
On Wed, 04 Jul 2012 21:01:50 -0500, Brett Frankenberger said: > No. Leap Years arise because the solar year is not an integral > multiple of the solar day. And leap seconds arise because the astronomical day is not an integral multiple of the hour, minute, or second. Same problem. > still hold.

Re: job screening question

2012-07-05 Thread valdis . kletnieks
On Thu, 05 Jul 2012 15:05:01 -0600, Derek Andrew said: > Isn't MTU discovery on IP and not TCP? AIX actually supported PMTUD for UDP. Not sure if it still does. Yes, it was bizarro even for AIX. No, I'm not aware of any actual UDP applications that were able to do anything useful with this info

Re: job screening question

2012-07-05 Thread valdis . kletnieks
On Thu, 05 Jul 2012 18:36:34 -0700, Leo Bicknell said: > If any employer thought that was useful knowledge for a job today I > would probably run away, as fast as possible! Only way I'd take that job is with both budget and authority to clean up the mess. However, those kind of things are usually

Re: job screening question

2012-07-06 Thread valdis . kletnieks
On Fri, 06 Jul 2012 17:42:42 +1000, Matthew Palmer said: > Ugh, I know someone (thankfully no longer a current colleague) who ardently > *defends* his use of questions like "what does the -M option to ps do?" on Is that an African ps or a European ps? ;) pgprEsHT9Ps02.pgp Description: PGP signa

Re: DNS Changer items

2012-07-06 Thread valdis . kletnieks
On Fri, 06 Jul 2012 13:20:55 -0400, Andrew Fried said: > The dns-ok.us site is getting crushed from all the sudden media > interest. One wonders why it's so hard to get the media interested when it would be *helpful*. DNS Changer gets traction like 3 days before the drop dead date, IPv6 gets on t

Re: DNS Changer items

2012-07-06 Thread valdis . kletnieks
On Fri, 06 Jul 2012 10:52:56 -0700, Cameron Byrne said: > So insteading of turning the servers off, would it not have been helpful to > have the servers return a "captive portal" type of reponse Not all DNS lookups are for HTTP. pgpBaEoKfFXQ1.pgp Description: PGP signature

Re: job screening question

2012-07-06 Thread valdis . kletnieks
On Fri, 06 Jul 2012 15:07:51 -0700, goe...@anime.net said: > This is what baffles me. People keep putting stuff on their resume that > they simply don't know anything about. TCP/IP expert, yet they don't know > SYN/SYNACK/ACK or subnetting. HTTP expert but they don't know what a 200 > response is.

Re: job screening question

2012-07-06 Thread valdis . kletnieks
On Sat, 07 Jul 2012 00:07:57 +0100, Nick Hilliard said: > 4) you get caught out in the interview as being puffed up, but the company > hires you anyway despite strongly worded objections from the interviewer, > causing the interviewer's eyes to spin in their sockets at the inanity of > the decisio

Re: job screening question

2012-07-06 Thread valdis . kletnieks
On Fri, 06 Jul 2012 17:04:16 -0700, George Herbert said: > If people don't bother to clean up the resume, either they don't > understand what's relevant now, or they don't care, or they're trying > to hide something. OK. I admit it. My resume still lists that I spent a few years hacking assembler

Re: job screening question

2012-07-07 Thread valdis . kletnieks
On Sat, 07 Jul 2012 18:03:43 -0700, Randy said: > > "What's the problem with using 255.255.255.247 as a subnet mask if you > > want to make a LAN subnet with 12 hosts?" > > (5 word answer) I'm not sure if that's a typo or excessive evil on the part of the questioner. ;) > My response would be: D

Re: FYI Netflix is down

2012-07-09 Thread valdis . kletnieks
On Mon, 09 Jul 2012 08:07:14 -0400, Alain Hebert said: > Their wide use of ASIC eliminate a lot of the headache of pure > software implementation. And gets you, in return, the headaches of buggy hardware, where bug-fixing is just a bit harder than "load the new release". ;) pgpSvdXo7xMkN.p

Re: U.S. spy agencies ... email for cybersecurity

2012-07-10 Thread valdis . kletnieks
On Mon, 09 Jul 2012 21:46:51 -0400, William Allen Simpson said: > But to help protect the private sector, he said it was important that the > intelligence agency be able to inform them about the type of malicious > software and other cyber intrusions it is seeing and hear from companies > about wh

Re: U.S. spy agencies ... email for cybersecurity

2012-07-10 Thread valdis . kletnieks
On Tue, 10 Jul 2012 21:19:07 +0530, Suresh Ramasubramanian said: > On Tue, Jul 10, 2012 at 8:55 PM, Harry Hoffman > wrote: > > The government is already doing this via the ISACs. > > > > http://www.ren-isac.net/docs/charter.html > > I have a lot of respect for what REN-ISAC does but it doesn't nea

Re: Admin? Bueller?

2012-07-10 Thread valdis . kletnieks
On Tue, 10 Jul 2012 11:41:23 -0500, Matt Griswold said: > We were letting people practice their procmail :) They've both been > filtered. "both"? I only noticed one source account? pgpRL8Nw3xaNd.pgp Description: PGP signature

Re: Netsol AAAA glue

2012-07-14 Thread valdis . kletnieks
On Sat, 14 Jul 2012 10:14:08 -0400, Andrew Sullivan said: > On Sat, Jul 14, 2012 at 01:06:59AM -0500, Doug McIntyre wrote: > > Not sure why you'd be worried about a 10-year renewal, any registrar > > transfer just add on time to existing expiration, you don't lose anything. > > This isn't true in I

Re: using "reserved" IPv6 space

2012-07-14 Thread valdis . kletnieks
On Sat, 14 Jul 2012 15:14:45 -0500, -Hammer- said: > The whole purpose of this is that they do NOT need to be global. > Security thru obscurity. It actually has a place in some worlds. Does that > make sense? Or are such V4-centric approaches a bad thing in v6? The fact that your prefix is a

Re: using "reserved" IPv6 space

2012-07-15 Thread valdis . kletnieks
On Sat, 14 Jul 2012 17:37:37 -0500, Jimmy Hess said: > The good news is one 'ifconfig' just tells them what network > address you're in. > Unless the attacker can gain access to your host's NDP table or ARP > table, they can't see what IPs are in use. All it takes is one USB stick left out

Re: Re: using "reserved" IPv6 space

2012-07-15 Thread valdis . kletnieks
On Sun, 15 Jul 2012 17:55:44 -0600, "Keith Medcalf" said: > Are you saying that there are other operating systems brain-dead enough to > just run any old arbitrary code from untrusted media? As Vint Cerf pointed out, 140 million pwned boxes. How you think they got that way, and what are the chance

Re: using "reserved" IPv6 space

2012-07-16 Thread valdis . kletnieks
On Mon, 16 Jul 2012 11:09:28 -0500, -Hammer- said: > ---That is clearly a matter of opinion. NAT64 and NAT66 wouldn't be there > if there weren't enough customers asking for it. Are all the customers naive? > I doubt it. They have their reasons. I agree with your "purist" definition and > did n

<    3   4   5   6   7   8   9   10   11   12   >