- NA-Discuss - lists.icann.org

Re: [NA-Discuss] [ga] Vixies vixens make big boo boo on successful Russian DNS hack
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

Dr. Joe and all, Well your very welcome indeed! >:) After all what is a meal, if not with the proper spice to enhance properly the savory taste eh? Unless of course that meal is best served cold... Food for thought prhaps? You be the judge. Joe Baptista wrote: > > > On Sun, Aug 10, 2008 at 3:12 AM, Jeffrey A. > Williams <jwkckid1(a)ix.netcom.com> wrote: > > > Dr. Joe and all, > > Thanks for also saving/archiving the original story. > History if > saved in this manner can never be truthfully revised. BTW, > I > and 200 odd other or our members also archived this story > including all metadata for forensics purposes as well if > needed > in the future for legal purposes. I hope SANS will also be > covering it as well as did NetworkWorld. > > > Your a gem Jeff, if not a joy to add flavour to our gatherings. > > cheers > joe baptista > > > > > FWIW, it may be time to keep a closer watch on Circleid, > which I have also written for on occasion. Yellow > journalism > is not a good thing... > > Joe Baptista wrote: > > > > > The news story below was first published on CircleID. It > has since > > been yanked and is no where to be found on CircleID. > Maybe we are > > witnessing a bit of history revision. This makes me sad > because > > CircleID was a publication I once wrote for. In fact I > was one of the > > first paid writer for the organization. Probably the only > one at the > > time. And it is sad to see revision at an organization I > was once > > associated with. > > > > However it is understandable considering Vixie, the sacred > cow of DNS, > > made such a stupid and silly statement in the article. > > > > Basically an internet researcher in Russia was able to > break the Vixie > > patch and poison a servers cache after some 10 hours, > billions of > > connections over a gigabit connection. Vixies response > was "before > > somebody gets all excited about it let's be clear that it > takes two > > billion packets on average to defeat UDP port > randomization, which in > > this case was a fully utilized gigabit Internet connection > for a > > period of ten hours." and proceeded to draw parallels > that the level > > of risk was reasonably low because of this > rationalization. > > > > I think sometime Vixie lives in the dark ages of the net, > when > > everything was low bandwidth and script kiddies were a > novelty. > > Indeed Polyakov, the Russian researcher, should be > congratulated for > > his success in this attack considering the poor russian > was using such > > limited resources. > > > > Unlike script kiddies or real internet criminals Polyakov > did not have > > the resources required, being hundreds of thousands of > computers > > connected through a maze of IRC botnets on hundreds of > thousands of > > both DSL and gigabit connections to conduct a proper > attack. Poor man > > had to do it with one computer and one high speed internet > link. If > > he had better resources - like the kiddies - he could > probably do it > > in much less time - 10 - 20 minutes? > > > > Under these circumstances I'm not surprised the story was > yanked. The > > quote makes Vixie look like an idiot. > > > > In any case - here is the original story no longer > published at > > CircleID. > > > > > > Latest news postings on CircleID > > URL: http://www.circleid.com/news/ > > Updated: 10 hours 46 min ago > > > > Emergency DNS Patch Still Vulnerable, Proves Russian > Physicist > > > > 10 hours 19 min ago > > A Russian physicist has been able to successfully poison > the latest > > BIND patch with fully randomized ports. In other words, > the emergency > > fix put in place to patch the Domain Name System (DNS) > vulnerability > > for BIND, Internet's most popular DNS software, has been > demonstrated > > to be vulnerableand still exploitable by criminals. > > > > Evgeniy Polyakov from Moscow, Russia in a blog post today, > has shown > > how using two fairly powerful computers and a fast > broadband > > connection, one could successfully attack the patched DNS > server in > > less than 10 hours. With a fast connection, "any trojaned > machine can > > poison your DNS during one night" says Polyakov in his > blog post. > > > > As demonstrated by security expert, Dan Kaminsky on > Wednesday at the > > Black Hat security conference, the vulnerability, if > exploited by > > criminal, could be detrimental to the Web as well as > services such as > > email. > > > > Paul Vixie, president of the Internet Systems Consortium > (ISC), the > > organization in charge of maintaining the BIND software > has verified > > that Polyakov's exploit looks real. However "before > somebody gets all > > excited about it," Vixie says, "let's be clear that it > takes two > > billion packets on average to defeat UDP port > randomization, which in > > this case was a fully utilized gigabit Internet connection > for a > > period of ten hours." In other words, the probability of a > successful > > attack is fairly minimal. On the other hand, in the case > of an > > unpatched server, an attack was "narrowed down to six > seconds," Vixie > > noted. > > > > In the long term, Vixie says "we'll go on improving our > forgery > > resilience, as will every recursive DNS implementor, while > we continue > > pushing DNSSEC as the ultimate long term solution to the > entire > > forgery problem including this off-path-attacker problem." > > > > > More under: DNS, DNSSEC, Security > > Categories: Net coverage > > > > -- > > Joe Baptista > > www.publicroot.org > > PublicRoot Consortium > > > ---------------------------------------------------------------- > > > The future of the Internet is Open, Transparent, > Inclusive, > > Representative & Accountable to the Internet community > @large. > > > ---------------------------------------------------------------- > > > Office: +1 (360) 526-6077 (extension 052) > > Fax: +1 (509) 479-0084 > > > > > Regards, > > Spokesman for INEGroup LLA. - (Over 281k > members/stakeholders strong!) > "Obedience of the law is the greatest freedom" - > Abraham Lincoln > > "Credit should go with the performance of duty and not with > what is > very often the accident of glory" - Theodore Roosevelt > > "If the probability be called P; the injury, L; and the > burden, B; > liability depends upon whether B is less than L multiplied > by > P: i.e., whether B is less than PL." > United States v. Carroll Towing (159 F.2d 169 [2d Cir. > 1947] > ===== > ========================================================= > Updated 1/26/04 > CSO/DIR. Internet Network Eng. SR. Eng. Network data > security IDNS. > div. of Information Network Eng. INEG. INC. > ABA member in good standing member ID 01257402 E-Mail > jwkckid1(a)ix.netcom.com > My Phone: 214-244-4827 > > > > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, > > Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) > > "Obedience of the law is the greatest freedom" - > Abraham Lincoln > > "Credit should go with the performance of duty and not with what is > very often the accident of glory" - Theodore Roosevelt > > "If the probability be called P; the injury, L; and the burden, B; > liability depends upon whether B is less than L multiplied by > P: i.e., whether B is less than PL." > United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] > =============================================================== > Updated 1/26/04 > CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. > div. of Information Network Eng. INEG. INC. > ABA member in good standing member ID 01257402 E-Mail > jwkckid1(a)ix.netcom.com > My Phone: 214-244-4827 >

1 0

Re: [NA-Discuss] [At-Large] I do not own it, it belongs to everyone, so let me make money selling it!
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

JFC and all, JFC, surely as a Frenchman you recognize that age old lady of the evening creed: "No money no honey, come back pay day"? Such is and as you should have known long ago, is the unspoken and unwritten creed of ICANN. All to sad, yes, but all too true. JFC Morfin wrote: > How nice this "Internet for the Rich". I love the Anglo-Saxon > practical money inductive reasoning ... There are definitly different > cultures on this list : "I sell", "I do", "I follow", "we wait for > the best opportunity for us", "may be, we could share". > We will see who is the winner. > jfc > > At 23:20 10/08/2008, Alan Greenberg wrote: > >Patrick and Hong, I find your comments a strong over-reaction. > > > >The issue that is being discussed is how to handle the situation of > >multiple people applying for the same TLD, and they cannot come to an > >agreement amongst themselves. Classic examples are ".web" and ".mail" > >but there are plenty of other examples. > > > >The paper discusses the various ways of addressing such conflicts, > >and comes to the conclusion that auctions are probably the preferable > >path. If you disagree with this, that is fine. The only seeming > >practical alternative is a subjective analysis of which is the best > >for the overall good of the Internet or the communities or whatever > >(the so-called beauty contest). I find that alternative far too > >fraught with potential problems, but if that is what you favour, it > >would be interesting to hear how you think it can be done properly. > > > >Using an auction to resolve the conflict does indeed mean that .web > >will not likely go to a small not-for-profit organization. If that is > >your concern, then in my mind, you are being somewhat unrealistic. > > > >On the positive side, the possible auctions of these relatively few > >high-profile TLDs will likely bring in a LOT of money. It has > >repeatedly been suggested that this wind-fall profit not be simply > >wrapped into ICANN general funds, or even used to offset the costs of > >offering new gTLDs. But rather it be used to (with appropriate > >caution) make it less expensive and less onerous for not-for-profits, > >cultural communities and developing countries folks to acquire new gTLDs. > > > >Now THAT is something that I think At-Large should make a strong > >statement about. > > > >Alan > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

The Pirate Bay blocked in Italy
by Jeffrey A. Williams Aug. 11, 2008

Aug. 11, 2008

All, The Pirate Bay, a BitTorrent site, has been blocked by (some/most ?) Italian ISPs. It seems it was an IP-based block. Thus, it can be circumvented quite easily. I wonder where the NA'S or the ALAC is on this one? Hiding perhaps? Or just disinterested? Under/non-funded to oppose effectively? Score: ALAC and Naralo's 0 IPC and the IP ACTA folks 1 What normally happens is: 1. Comp requests http://thepiratebay.org 2. ISP's DNS server looks up the IP address for http://thepiratebay.org to answer query 3. ISP's DNS server resolves http://thepiratebay.org to be http://83.140.176.200 4. ISP serves http://83.140.176.200 Italian ISPs stepped in at stage 3, and blocked that IP address from being served. Thus, the way to resolve this would be to use some other DNS resolution server (instead of theISP's). OpenDNS <www.opendns.com> provides such a service, with DNS servers 208.67.222.222 and 208.67.220.220 Italians can also continue to access TPB by using http://labaia.org/ ("La Baia" being "The Bay" in Italian.) Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Reminder] At-Large NARALO Conference Call @ Mon 11 Aug 21:00 – 22:00 ()
by Google Calendar Aug. 10, 2008

Aug. 10, 2008

na-discuss(a)atlarge-lists.icann.org, this is a reminder for Title: At-Large NARALO Conference Call Time: Mon 11 Aug 21:00 – 22:00 (Time zone: Zurich) Where: Teleconference - Adigo Calendar: Description: 1900 UTC Start. Please find the details and participation instructions for this meeting on our meeting page: https://st.icann.org/naralo/index.cgi?meetings_and_events You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=OWdwZjJ1OWh1MG82dG10Mj… You are receiving this courtesy email at the account na-discuss(a)atlarge-lists.icann.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively, you can sign up for a Google account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

Re: [NA-Discuss] [At-Large] Updates to New gTLD Program Implementationand auctioning model.
by Jeffrey A. Williams Aug. 10, 2008

Aug. 10, 2008

Vittorio and all, Your essentially correct, Vittorio IMO. The real problem is in your example of .CAT, that it is already in use. So, first use in commerce would apply under the law. As for .XXX, or for that matter any other "String" as a gTLD, or even a IDN gTLD is that national laws as to use would likely apply. If for instance, .XXX's specifically forbid sexual related registrations of DN's in that name space, I can't see how it would than be a problem per se. However as ICANN's oversight has been poor of it's Registries and Registrars, the problems of accountability and legal liability become the issue. Yet I don't see how any of this has much to do with whether or not auctioning gTLD's is a good implementation method or not. But still all of this still points back to the beginning. Self regulation simply doesn't work. Oversight is necessary. The more the better, and the better that oversight is, the better the "Greater Good" can and will be served. Vittorio Bertola wrote: > Bret Fausett ha scritto: > > On Aug 10, 2008, at 2:20 PM, Alan Greenberg wrote: > >> Using an auction to resolve the conflict does indeed mean that .web > >> will not likely go to a small not-for-profit organization. If that is > >> your concern, then in my mind, you are being somewhat unrealistic. > > > > I was on the Council when this first came up, and the concern I heard > > from the ALAC then was about regionalism, rather than "non-profits" v. > > "for profits." I don't know that we care which among many U.S. > > corporate entities wins the battle for the next big ASCII TLD gold mine. > > > > The ALAC concern, as I understood it, was about whether a foreign > > registry services provider ought to win the bid for the IDN versions > > of COM/NET/ORG over a competitor in the region in which the language > > is spoken. At bottom, it's a debate about free trade v. regional > > protectionism, a subject on which the nations of the world have > > significantly different positions. > > Another case is when the two competing bids have completely different > purposes and "social value". I.e. what happens if Catalonia applies for > .cat to serve its 7-million Catalan speakers, but at the same time > Caterpillar does the same and puts more money on the table, only to use > the TLD for a nicer URL for their one corporate website? > > If I remember well, the last versions of the process presented in Paris > said that auctions would only be used if all applicants were > "non-community", ie generic, while if at least one was a community > applicant then they would have used a beauty contest. But I'm not sure > whether this is still the intention. > > I already said when .xxx was on the table that IMHO there is no way that > you can get out of this mess without making subjective political > judgements on who "deserves better", or whether a string is "against > public policy", etc. In the end, I just hope that these decisions will > be taken by an accountable political entity (e.g. the Board) rather than > by an unaccountable "expert panel", disguised as if they could be objective. > -- > vb. Vittorio Bertola - vb [a] bertola.eu <-------- > --------> finally with a new website at http://bertola.eu/ <-------- > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: [ga] Updates to New gTLD Program Implementation]
by Jeffrey A. Williams Aug. 10, 2008

Aug. 10, 2008

All, As an FYI -------- Original Message -------- Subject: [ga] Updates to New gTLD Program Implementation Date: Sun, 10 Aug 2008 07:32:44 -0700 From: Glen de Saint Géry <Glen(a)icann.org> To: "mail=ga(a)gnso.icann.org" <ga(a)gnso.icann.org> [To: council[at]gnso.icann.org; liaison6c[at]gnso.icann.org] [To: ga[at]gnso.icann.org; announce[at]gnso.icann.org] [To: regional-liaisons[at]icann.org] http://www.icann.org/en/announcements/announcement-08aug08-en.htm Updates to New gTLD Program Implementation 8 August 2008 Economic Case for Auctions in New gTLDs Paper Released -- During the ICANN meeting in Paris, France, ICANN staff made a commitment to release a paper describing the economic case for auctions as a tiebreaking mechanism for resolving contention among identical or confusingly similar applications for new gTLDs. ICANN is today making the Economic Case for Auctions in New gTLDs paper available so that the community can provide feedback on this element of the forthcoming implementation plan. The paper [PDF, 52K] was prepared by ICANN's auction design consultant PowerAuctions LLC with support from ICANN staff. The paper notes that auctions as a tiebreaking mechanism accomplish a goal of allocative efficiency through a transparent, objective and scalable process for the resolution of gTLD applications. This paper does not address specific details on how an auction process to resolve string contention may be conducted. These details will be provided as part of the larger information on new gTLD implementation to be presented to the community in the near future. A public forum has been established at at http://forum.icann.org/lists/auction-consultation/. Comments submitted to auction-consultation(a)icann.org will be considered until 7 September 2008 23:59 UTC (8 Aug 2008). -------------------------------------------------------------------------------- String Similarity Algorithm Update -- ICANN staff recently completed a workshop with SWORD, the partner who is assisting ICANN with the creation of an algorithm that will help automate the process for assessing similarity among proposed and existing TLD strings. SWORD's verbal search algorithms are used by various patent and trademark offices throughout the world. SWORD has completed a beta algorithm and reviewed several test cases with ICANN staff. This is being done in order to refine the parameters and discuss how the algorithm could be successfully integrated as a tool to help implement the GNSO's recommendation that new gTLD strings should not result in user confusion with existing TLDs. -------------------------------------------------------------------------------- Backend Registry Certification Not Available in First Round -- On 31 January 2008, ICANN posted an announcement (http://www.icann.org/en/announcements/announcement-2-31jan08.htm) to inform the community that it was exploring a potential initiative for the certification of backend registry operators for new gTLDs. ICANN staff has determined not to proceed with this initiative in the first round of the new gTLD process. The initiative was suggested as a possible means to streamline the application process for new gTLDs and to create a pool of pre-qualified registry operators who could provide assistance in the event of a registry failure. Exploration of the initiative was also prompted by inquiries from community members who expressed the potential positive aspects that creation of the certification might promote. During the exploration of the initiative, ICANN consulted with the community including technical experts and gTLD and ccTLD registries and registry service providers. Potential operational benefits and risks of implementing the initiative were assessed. Ultimately, a decision was made to not proceed with certification as part of the initial new gTLD application round based upon a number of factors. Some of these are: additional assessment as to effects certification might have on the marketplace, e.g., whether the implementation might cause expansion or contraction; additional collaboration with the community as to the terms of such a certification; and weighing the potential post-certification activities including ongoing testing, re-certification and the introduction of new compliance activities. It was also deemed important to be able to assess the positive and negative aspects of the new gTLD implementation without possible crossover effects of this additional certificat! ion. This independence of interactions can be better assured by introducing the certification (if it is deemed appropriate after additional analysis) at a later date. Both ccTLD and gTLD backend registry operators can still offer to provide registry services to new gTLDs. The Request for Proposals for new gTLDs, when published, will detail the minimum technical criteria and pre-delegation check requirements that must be met by every applicant prior to the approval of their TLD for insertion into the root. New gTLD applicants might choose to build their own registry infrastructure and systems, retain the services of an existing gTLD or ccTLD registry services provider, or contract with another technical services provider. Glen de Saint Géry GNSO Secretariat gnso.secretariat(a)gnso.icann.org http://gnso.icann.org

1 0

Re: [NA-Discuss] [ga] Vixies vixens make big boo boo on successful Russian DNS hack
by Jeffrey A. Williams Aug. 10, 2008

Aug. 10, 2008

Dr. Joe and all, Thanks for also saving/archiving the original story. History if saved in this manner can never be truthfully revised. BTW, I and 200 odd other or our members also archived this story including all metadata for forensics purposes as well if needed in the future for legal purposes. I hope SANS will also be covering it as well as did NetworkWorld. FWIW, it may be time to keep a closer watch on Circleid, which I have also written for on occasion. Yellow journalism is not a good thing... Joe Baptista wrote: > > The news story below was first published on CircleID. It has since > been yanked and is no where to be found on CircleID. Maybe we are > witnessing a bit of history revision. This makes me sad because > CircleID was a publication I once wrote for. In fact I was one of the > first paid writer for the organization. Probably the only one at the > time. And it is sad to see revision at an organization I was once > associated with. > > However it is understandable considering Vixie, the sacred cow of DNS, > made such a stupid and silly statement in the article. > > Basically an internet researcher in Russia was able to break the Vixie > patch and poison a servers cache after some 10 hours, billions of > connections over a gigabit connection. Vixies response was "before > somebody gets all excited about it let's be clear that it takes two > billion packets on average to defeat UDP port randomization, which in > this case was a fully utilized gigabit Internet connection for a > period of ten hours." and proceeded to draw parallels that the level > of risk was reasonably low because of this rationalization. > > I think sometime Vixie lives in the dark ages of the net, when > everything was low bandwidth and script kiddies were a novelty. > Indeed Polyakov, the Russian researcher, should be congratulated for > his success in this attack considering the poor russian was using such > limited resources. > > Unlike script kiddies or real internet criminals Polyakov did not have > the resources required, being hundreds of thousands of computers > connected through a maze of IRC botnets on hundreds of thousands of > both DSL and gigabit connections to conduct a proper attack. Poor man > had to do it with one computer and one high speed internet link. If > he had better resources - like the kiddies - he could probably do it > in much less time - 10 - 20 minutes? > > Under these circumstances I'm not surprised the story was yanked. The > quote makes Vixie look like an idiot. > > In any case - here is the original story no longer published at > CircleID. > > > Latest news postings on CircleID > URL: http://www.circleid.com/news/ > Updated: 10 hours 46 min ago > > Emergency DNS Patch Still Vulnerable, Proves Russian Physicist > > 10 hours 19 min ago > A Russian physicist has been able to successfully poison the latest > BIND patch with fully randomized ports. In other words, the emergency > fix put in place to patch the Domain Name System (DNS) vulnerability > for BIND, Internet's most popular DNS software, has been demonstrated > to be vulnerableand still exploitable by criminals. > > Evgeniy Polyakov from Moscow, Russia in a blog post today, has shown > how using two fairly powerful computers and a fast broadband > connection, one could successfully attack the patched DNS server in > less than 10 hours. With a fast connection, "any trojaned machine can > poison your DNS during one night" says Polyakov in his blog post. > > As demonstrated by security expert, Dan Kaminsky on Wednesday at the > Black Hat security conference, the vulnerability, if exploited by > criminal, could be detrimental to the Web as well as services such as > email. > > Paul Vixie, president of the Internet Systems Consortium (ISC), the > organization in charge of maintaining the BIND software has verified > that Polyakov's exploit looks real. However "before somebody gets all > excited about it," Vixie says, "let's be clear that it takes two > billion packets on average to defeat UDP port randomization, which in > this case was a fully utilized gigabit Internet connection for a > period of ten hours." In other words, the probability of a successful > attack is fairly minimal. On the other hand, in the case of an > unpatched server, an attack was "narrowed down to six seconds," Vixie > noted. > > In the long term, Vixie says "we'll go on improving our forgery > resilience, as will every recursive DNS implementor, while we continue > pushing DNSSEC as the ultimate long term solution to the entire > forgery problem including this off-path-attacker problem." > > More under: DNS, DNSSEC, Security > Categories: Net coverage > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

RIAA Foiled again By "Innocent Infringement" Defense
by Jeffrey A. Williams Aug. 9, 2008

Aug. 9, 2008

All, Seems to me that this RIAA saga has reached a level of the RIAA becoming a "Cyber bully" and therefore their Domain Name would seem to be a representation of a "Abusive Domain name. Time to take their Domain Down? Well I think so. Further, seems that the RIAA has demonstrated yet again it's decided lack of legal expertise. Small wonder eh? But they still can't seem to get the message. That being that their tactics and acumen in this area of law is less than professional or reasonable. I think I would elect to go to trial if I were the defendant or her lawyer. That way they have a chance of reducing even further the $200.00 and possibly can seek their own damages as well. http://recordingindustryvspeople.blogspot.com/ NewYorkCountryLawyer writes "In an interesting development in a Texas case against a college-age defendant who was 16 at the time of the infringement, the Judge has http://recordingindustryvspeople.blogspot.com/2008/08/innocent-infringement… denied the RIAA's summary judgment motion and ordered a trial of the damages even though the defendant admitted copyright infringement using Kazaa based on the 'innocent infringement' defense, which could reduce the statutory damages to $200 per song file. Relying on [2]BMG v. Gonzalez (PDF), the reasoning of which I http://recordingindustryvspeople.blogspot.com/2007/01/how-riaa-litigation-p… have criticized on the 'innocent infringement' issue, the RIAA argued that Ms. Harper does not qualify for the 'innocent infringement' defense, since CD versions of the songs, sold in stores, have copyright notices on them. In its http://beckermanlegal.com/Documents/maverick_harper_080808.pdf 15-page decision (PDF) the Harper court rejected that contention, holding that 'a question remains as to whether Defendant knew the warnings on compact discs were applicable in this KaZaA setting', since 'In this case, there were no compact discs with warnings.' Finding that there was a factual issue as to what the defendant knew or didn't know at the time of the infringement, the Court ordered a trial of the damages unless the RIAA agrees to accept $200 rather than the $750-plus it seeks per infringed song." Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

EFF Warns That Email Privacy Is In Jeopardy
by Jeffrey A. Williams Aug. 9, 2008

Aug. 9, 2008

All, Well yet again one of the IPC's favorite sons, the MPAA this time, has seen fit to be snoops and desires to snoop on your email via government assistance. But EFF is hopefully coming to the rescue. Good for them! Perhaps they should also get the assistance of the ACLU's Atty.'s as well. Is there any doubt that the MPAA like its twin the RIAA and their other Intellectual property paranoists need to be revoked from the IPC? No doubt in my and our members minds. I wonder if there is some way I can Enjoin this action? I do have a pending case! If so, I hope one of the EFF Atty's will contact me by phone or via Email. See: http://www.hothardware.com/ According to the Electronic Frontier Foundation (EFF), a http://www.hothardware.com/News/Electronic_Privacy_in_Jeopardy/ dangerous legal precedent has just been set that can potentially unravel existing federal privacy protections for e-mail and Internet usage. The http://www.eff.org/press/archives/2008/08/05 alert from the EFF is not just to sound a general warning, but it also takes the form of an Amicus curiae (friend of the court) brief, filed with the federal 9th US Circuit Court of Appeals, asking for the court's legal finding to be overturned... The findings of this case could become the foundation of a legal precedent upon which other similar cases can subsequently be based. If that were to be the case, then the unauthorized retrieving of e-mails from an e-mail server would not be considered a violation of the federal Wiretap Act, which will then open the door for government-sponsored snooping. Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

More on/update to: BIND Still Susceptible To DNS Cache Poisoning
by Jeffrey A. Williams Aug. 9, 2008

Aug. 9, 2008

All, Well it seems that the ISC patch didn't do all that much. Typical. This is what happens when you have less than interested folks attempting to do security related fix's. Lets hope DHS gets on the ball and gets this noted soon! I am relatively sure ICANN won't. Yet, our BindPlus stands up to the test so far! >:) No holes here. I wonder how Berstein's is doing? See: John Markoff of the NYTimes writes about a Russian hacker, Evgeniy Polyakov, who has http://www.nytimes.com/2008/08/09/technology/09flaw.html?partner=rssnyt&emc… successfully poisoned the latest, patched BIND with randomized ports. Originally, the randomized ports were never supposed to completely solve the problem, but just make it http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 harder to do. It was thought that with port randomization, it would take roughly a week to get a hit. Using his own http://tservice.net.ru/~s0mbre/blog exploit code, two desktop computers and a GigE link, Polyakov reduced the time to 10 hours. Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0