- NA-Discuss - lists.icann.org

[Fwd: Re: [ga] Kaminsky on dns bugs - Bernstein responds]
by Jeffrey A. Williams Aug. 8, 2008

Aug. 8, 2008

FYI -------- Original Message -------- Subject: Re: [ga] Kaminsky on dns bugs - Bernstein responds Date: Fri, 08 Aug 2008 02:28:30 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: Joe Baptista <baptista(a)publicroot.org>,DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov>,ICANN SSAC Dave Piscitello <dave.piscitello(a)icann.org>,"matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,"Nevett, Jonathon" <jnevett(a)networksolutions.com> CC: Ga <ga(a)gnso.icann.org>, icann board <icann-board(a)icann.org>,Kieren McCarthy <kieren.mccarthy(a)icann.org>,Wendy Seltzer <wendy(a)seltzer.com>,"twomey(a)icann.org" <twomey(a)icann.org>,Peter Dengate Thrush <barrister(a)chambers.gen.nz>,GAC Rep <ssene(a)ntia.doc.gov>,Cheryl Langdon-Orr <cheryl(a)hovtek.com.au>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,"Brendler, Beau" <Brenbe(a)consumer.org>,Carl Wallace <CWallace(a)cygnacom.com>,Carlton Samuels <carlton.samuels(a)uwimona.edu.jm>,Chuck Gomes <cgomes(a)verisign.com>,"Darlene Thompson," <DThompson(a)GOV.NU.CA>,Evan Leibovitch <evan(a)telly.org>,ICANN Marc Salvatierra <marc.salvatierra(a)icann.org>,ietf-nomcom Mailing List <ietf-nomcom(a)ietf.org>,"Jacqueline A. Morris" <jam(a)jacquelinemorris.com>,Jeff Neuman <Jeff.Neuman(a)neustar.us>,"Nevett, Jonathon" <jnevett(a)networksolutions.com>,Robert Guerra <robert(a)privaterra.org>,Roland Perry <roland(a)internetpolicyagency.com>,Siavash Shahshahani <shahshah(a)irnic.ir> References: <874c02a20808081918x7955ea24yc13506a6e7dfa915(a)mail.gmail.com> Dr.Joe and all, Yes of course, some of have known for years and stated such years ago right here on the GA when the old DNSO was still in existance, myself and yourself Joe, included. It's all in the archives, which I am sure by now Kent Crispin or someone at ICANN is scowering in case "Creative" editing can be deployed or "Artistically" utilized as has been done before and also reported accordingly. But not to worry, I have two other seperately archived copies of all those archives! >:) Joe Baptista wrote: > > Well the long-awaited description of Dan Kaminsky's regarding the dns > vulnerabilities was released as a 104-slide Powerpoint presentation: > > http://www.doxpara.com/DMK_BO2K8.ppt > > On slide 34 it claims that DJB (Dr. Bernstein) WAS RIGHT. This is > something we all have known for years. But then Kaminsky went on to > hang himself by saying that DJB was "NOT PERFECT, we're seeing (and > patching, don't ask)". Kaminsky offers as an example that the > birthday attack protection was not implemented by Bernstein because he > believed port randomization was enough, and goes on to say that DJBDNS > has other known issues too. > > People this claim by Kaminsky is a load of crap and once again > furthers my claim that the recent security issues are nothing more > then the rehashing of old security problem that Bernstein addressed > years ago. > > In any case there was a response to this by Bernstein - the response > is below. As you can see Bernstein supports what I have been going on > about concerning these recent dns securities issues. The problems > have been known for years and this is nothing more then a rehash of > existing security issues to exploit user hysteria in the hope the > world can be tricked into accepting yet another useless insecure > protocol - being DNSSEC. > > I agree with Bernstein that the recent patches don't fix the problem. > In any case here is Bernsteins reply for the record. > > regards > joe baptista > > ---------- Forwarded message ---------- > From: D. J. Bernstein<djb(a)cr.yp.to> > Date: Thu, Aug 7, 2008 at 11:42 PM > Subject: Re: Kaminsky on djbdns bugs > To: dns(a)list.cr.yp.to > > Kyle Wheeler writes: > > That makes it easier for an attacker to guess the right number, but > > only somewhat (your chances per-guess go from one in four billion > to, > > say, thirty in four billion). This criticism of djbdns seems > > somewhat... well, specious. > http://cr.yp.to/djbdns/forgery.html has, for several years, stated > the > results of exactly this attack: > > The dnscache program uses a cryptographic generator for the ID and > query port to make them extremely difficult to predict. However, > > * an attacker who makes a few billion random guesses is likely to > succeed at least once; > * tens of millions of guesses are adequate with a colliding attack; > > etc. The same page also states bilateral and unilateral workarounds > that > would raise the number of guesses to "practically impossible"; but > then > focuses on the real problem, namely that "attackers with access to the > > network would still be able to forge DNS responses." > > I suppose I should be happy to see public awareness almost catching up > > to the nastiest DNS attacks I considered in 1999. However, people are > deluding themselves if they think they're protected by the current > series of patches. UIC is issuing a press release today on this topic; > > see below. > > ---D. J. Bernstein, Professor, Mathematics, Statistics, > and Computer Science, University of Illinois at Chicago > > > DNS still vulnerable, Bernstein says > > CHICAGO, Thursday 7 August 2008 - Do you bank over the Internet? If > so, > beware: recent Internet patches don't stop determined attackers. > > Network administrators have been rushing to deploy DNS source-port > randomization patches in response to an attack announced by security > researcher Dan Kaminsky last month. But the inventor of source-port > randomization said today that new security solutions are needed to > protect the Internet infrastructure. > > "Anyone who knows what he's doing can easily steal your email and > insert > fake web pages into your browser, even after you've patched," said > cryptographer Daniel J. Bernstein, a professor in the Center for > Research and Instruction in Technologies for Electronic Security > (RITES) > at the University of Illinois at Chicago. > > Bernstein's DJBDNS software introduced source-port randomization in > 1999 and is now estimated to have tens of millions of users. Bernstein > > released the DJBDNS copyright at the end of last year. > > Kaminsky said at the Black Hat conference yesterday that 120,000,000 > Internet users were now protected by patches using Bernstein's > randomization idea. But Bernstein criticized this idea, saying that it > > was "at best a speed bump for blind attackers" and "an extremely poor > substitute for proper cryptographic protection." > > DNSSEC, a cryptographic version of DNS, has been in development since > 1993 but is still not operational. Bernstein said that DNSSEC offers > "a > surprisingly low level of security" while causing severe problems for > DNS reliability and performance. > > "We need to stop wasting time on breakable patches," Bernstein said. > He > called for development of DNSSEC alternatives that quickly and > securely > reject every forged DNS packet. > > Press contact: Daniel J. Bernstein <press-20080807(a)box.cr.yp.to> > > -30- > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: Re: [At-Large] Moderation of Jeff Williams]
by Jeffrey A. Williams Aug. 7, 2008

Aug. 7, 2008

-------- Original Message -------- Subject: Re: [At-Large] Moderation of Jeff Williams Date: Wed, 06 Aug 2008 21:11:18 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: At-Large Staff <staff(a)atlarge.icann.org>,GAC Rep <ssene(a)ntia.doc.gov>,DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,"matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,"ICANN Admin supp. Manager Karen Lettner" <karen.lettner(a)icann.org> CC: at-large(a)atlarge-lists.icann.org,Cheryl Langdon-Orr <cheryl(a)hovtek.com.au>,Dominik Filipp <dominik.filipp(a)dsoft.sk>,ICANN Kim Davies <kim.davies(a)icann.org> References: <C4C0E5D7.9DA1%staff(a)atlarge.icann.org> Nick and all, How was the post to which you refer, off topic? This is a Users organization and that post to which your refer is a user issue. Ergo it cannot by definition be "Off-Topic". At-Large Staff wrote: > Dear List Members: > > On Tuesday 5th August, Jeff Williams was notified by the Chair of the ALAC > that further off-topic postings such as that entitled ³How to carjack a top > Google exec, according to Google² would result in his posting privileges on > the public At-Large list being revoked, for a time to be decided by the > ALAC. > > Since that notification, further off-topic postings have been sent, and as a > consequence we have been asked to suspend his posting privileges. > > He will continue to receive messages from the list, however, posts sent to > the list will be bounced back to him automatically. > -- > Regards, > > Nick Ashton-Hart, Matthias Langenegger, Frederic Teboul > ICANN At-Large Staff > email: staff(a)atlarge.icann.org > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] What are ICANN and VeriSign doing regarding CERT Advisory #800113 / DNS Cache Poisoning?
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

Joe and all, First, IMO, Joe is correct that DNSSEC will not save or fix any problems that are software related to DNS/BIND or client interfaces that are OS specific but were based upon what was known about Bind at the time of their creation. Second, Burnsteins DNS/BIND is only ONE version of DNS/BIND that is very secure. Our BindPlus is also very secure as well, no reported security problems reported in 49 months, and never a serious security hole found or reported sense it's release. Third, I respectfully disagree that ICANN can't do anything. They could have done allot over 6 years ago, and scoffed at anyone other than Paul Vixies Bind 8 at that time. That was a mistake, and many knew it but were silent publically. Forth, Joe is right, that with a little software Eng. forsight and expermintation most of the DNS/BIND security Holes are fixable and customizably so. What is missing is that there are very few GOOD software Eng., and even fewer that have an in depth understanding of DNS. Fifth, it is huge security problems like this that are bound to occur as long as social Eng. are making software decisions or managment decisions that are grounded in security and/or software. That's a leadership problem, and in this instance it is a ICANN leadership problem. Joe Baptista wrote: > > > On Wed, Aug 6, 2008 at 10:46 PM, George Kirikos <gkirikos(a)yahoo.com> > wrote: > > > Hello, > > Just to followup, ICANN sent out a news release earlier: > > http://www.icann.org/en/announcements/announcement-06aug > 8-en.htm > > It's a step in the right direction, to help educate folks. > However, > there's no true "fix", as the protocol itself is broken. A > move towards > DNSSEC or other secure DNS would be the only appropriate > long-term > solution. > > > There is nothing wrong with the protocol. Its the software thats the > issue. And this is easy to fix. I've run some tests and with a > little DNS magic you can make you DNS very secure. > > Another big help would be to update your software including any NAT > devices. > > The whole DNSSEC thing is another red herring in the making. > > Also there is nothing ICANN nor anyone else can do about this. The > world is running a lot of insecure servers. BIND has always been > buggy and true to form it will continue to be buggy. Have you any > idea how many buggy systems are out there. i.e. almost all of them. > Unless of course your running burnsteins DNS which already fixed this > problem a long time ago. > > It bother me that people who have no idea what the technical issues > are get so easily baited by this issue. George - let go the ICANN red > herring. Its just another smoke screen. > > The real issue here is what sort of out reach programs is ICANN > involved in to get people to upgrade and fix their buggy dns servers. > DNSSEC is not going to save them. > > cheers > joe baptista > > > > > If there's ever a cyber 9/11, as Lessig discussed at: > > http://news.slashdot.org/article.pl?sid=08/08/05/220229 > > widespread DNS cache poisoning might be one of the root > causes. > > I'd like to hear from VeriSign as to whether they're > planning to > implement DNSSEC or a secure DNS alternative for .com/net, > as PIR > intends for .org. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > > > Hello, > > > > ICANN and VeriSign have been oddly quiet over the entire > DNS cache > > poisoning issue: > > > > http://www.kb.cert.org/vuls/id/800113 > > > http://www.circleid.com/posts/87143_dns_not_a_guessing_game/ > > > > http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 > > > > > PIR has a pending proposal to implement DNSSEC for .org: > > > > http://www.icann.org/registries/rsep/ > > > > Is that something that VeriSign has plans to accelerate > for the > > important .com and .net registries, in order to prevent a > long-term > > meltdown in DNS confidence/trust should DNS cache > poisoning become > > widespread in August and beyond? > > > > No need for a "formal" press release, but I think the > community > > deserves to know that people are working on the long-term > solution to > > this problem, and making it a higher priority relative to > other > > lesser > > issues. > > > > Point #14 in the latest policy newsletter appears to be > the only > > "hint" > > that a few people are working on things: > > > > http://www.icann.org/topics/policy/update-jul08.htm#14 > > > > Hopefully something will happen before Cairo, as by then > there might > > be > > widespread disruptions to the internet. Perhaps the Board > might want > > to > > consider an early special meeting this week or next: > > > > http://www.icann.org/minutes/ > > > > instead of waiting until July 31st, in conjunction with > the SSAC. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ > > > > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] What are ICANN and VeriSign doing regarding CERT Advisory #800113 / DNS Cache Poisoning?
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

George and all, Well yes this is a move in the right direction. But it is far too little and perhaps far too late as we have seen with Apple. See: See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Secondly, it wasn't Dan k. that origanally made note of this and many other DNS security holes that can expose users to serious danger. That was done back in 2001 on the old DNSO GA mailing list. George Kirikos wrote: > Hello, > > Just to followup, ICANN sent out a news release earlier: > > http://www.icann.org/en/announcements/announcement-06aug08-en.htm > > It's a step in the right direction, to help educate folks. However, > there's no true "fix", as the protocol itself is broken. A move towards > DNSSEC or other secure DNS would be the only appropriate long-term > solution. > > If there's ever a cyber 9/11, as Lessig discussed at: > > http://news.slashdot.org/article.pl?sid=08/08/05/220229 > > widespread DNS cache poisoning might be one of the root causes. > > I'd like to hear from VeriSign as to whether they're planning to > implement DNSSEC or a secure DNS alternative for .com/net, as PIR > intends for .org. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > > > Hello, > > > > ICANN and VeriSign have been oddly quiet over the entire DNS cache > > poisoning issue: > > > > http://www.kb.cert.org/vuls/id/800113 > > http://www.circleid.com/posts/87143_dns_not_a_guessing_game/ > > http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 > > > > PIR has a pending proposal to implement DNSSEC for .org: > > > > http://www.icann.org/registries/rsep/ > > > > Is that something that VeriSign has plans to accelerate for the > > important .com and .net registries, in order to prevent a long-term > > meltdown in DNS confidence/trust should DNS cache poisoning become > > widespread in August and beyond? > > > > No need for a "formal" press release, but I think the community > > deserves to know that people are working on the long-term solution to > > this problem, and making it a higher priority relative to other > > lesser > > issues. > > > > Point #14 in the latest policy newsletter appears to be the only > > "hint" > > that a few people are working on things: > > > > http://www.icann.org/topics/policy/update-jul08.htm#14 > > > > Hopefully something will happen before Cairo, as by then there might > > be > > widespread disruptions to the internet. Perhaps the Board might want > > to > > consider an early special meeting this week or next: > > > > http://www.icann.org/minutes/ > > > > instead of waiting until July 31st, in conjunction with the SSAC. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [At-Large] Rogue pharmacy sites -- outrageous
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

Beau and all, Currently this is an ICANN responsibility that ICANN cannot clearly manage properly, and is reluctant to take responsibility for. Yet it is ICANN that "Created" these registrars and the RAA contracts for. So we will continue to see these sorts of abuse unless or until ICANN takes action in a reasonable amount of time, or DOC/NTIA intervenes. At this juncture, I prefer the latter. "Brendler, Beau" wrote: > http://www.knujon.com/news.html#08052008 > > This was passed on to me by a friend at Berkman affiliated with the > StopBadware.org project (http://www.stopbadware.org) > > >From the text: "This is an example of a practice we have seen all too > frequently where Internet companies will remove sites temporarily for > reported policy violations only to restore them shortly afterwards. In > some cases the domains move from one Registrar to another (occasionally > two Registrars with the same parent company, however), but this is a > situation where the domains went right back where they were before. > DIRECT INFO/PUBLICDOMAINREGISTRY was rated the 9th Worst Registrar in > terms of sponsoring spam sites previously." > > What provisions in the revised RAA address this sort of issue from a > consumer perspective? Or is this considered "outside ICANN's scope"? > > **************************************************************************** > ******** > SCANNED > > **************************************************************************** > ******** > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org All, Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: [Fwd 9th false reason given to: Request to mailing list NA-Discuss rejected]]
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

-------- Original Message -------- Subject: [Fwd 9th false reason given to: Request to mailing list NA-Discuss rejected] Date: Tue, 05 Aug 2008 20:14:19 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: "matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,GAC Rep <ssene(a)ntia.doc.gov> CC: DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov>,na-discuss-owner(a)atlarge-lists.icann.org,Wendy Seltzer <wendy(a)seltzer.com> Mattias and all, Yet again this is a false reason given. There were only 4 recipients which last I checked is less than 5, which is the max number of recipients according to Nicks most recent announcment. -------- Original Message -------- Subject: Request to mailing list NA-Discuss rejected Date: Wed, 06 Aug 2008 08:08:34 -0400 From: na-discuss-bounces(a)atlarge-lists.icann.org To: jwkckid1(a)ix.netcom.com Your request to the NA-Discuss mailing list Posting of your message titled "How to carjack a top Google exec, according to Google" has been rejected by the list moderator. The moderator gave the following reason for rejecting your request: "Too many recipients to the message" Any questions or comments should be directed to the list administrator at: na-discuss-owner(a)atlarge-lists.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Resend of:Apple DNS Patch Doesn't Fix Client Versions of OS X
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

All, Sorry that the list moderator/admin. has trouble counting to 5. So I have resent the below Email... Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: Re: [ga] More Registrar Malfeasance Reported]
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

All, Forwarding this as it seems that Nick is unable or unwilling to manage a list forum by his own rules properly. -------- Original Message -------- Subject: Re: [ga] More Registrar Malfeasance Reported Date: Tue, 05 Aug 2008 17:05:42 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: ga(a)gnso.icann.org, Governance/IGC <governance(a)lists.cpsr.org> CC: "alac(a)atlarge-lists.icann.org" <alac(a)atlarge-lists.icann.org>,Stacy Burnette <stacy.burnette(a)icann.org> References: <444690.28282.qm(a)web52209.mail.re2.yahoo.com> Danny and all, Thank you again for your diligance here. This again demonstrates why ICANN and especially the GNSO, and ICANN registrars need DOC/NTIA as well as other supervision. Danny Younger wrote: > > KnujOn has found at least 19 rogue pharmacy domains, sponsored through DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM (PDR) back in operation with the same content and at the same nameserver after being reported to ICANN by the Registrar as suspended. The nameserver is also sponsored by PDR and is itself an unlicensed pharmacy site. This is an example of a practice we have seen all too frequently where Internet companies will remove sites temporarily for reported policy violations only to restore them shortly afterwards. DIRECT INFO/PDR was rated the 9th Worst Registrar by KnujOn in terms of sponsoring spam sites previously. Clearly the consumer is not being protected by the current system. Full report here: http://www.knujon.com/news.html#08052008 > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Apple DNS Patch Doesn't Fix Client Versions of OS X
by Jeffrey A. Williams Aug. 4, 2008

Aug. 4, 2008

All, Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

RIAA's $222k Verdict Is Likely To Be Set Aside
by Jeffrey A. Williams Aug. 4, 2008

Aug. 4, 2008

All, Well seems that the recent RIAA legal "Big Gun" missed it's mark. So isn't it about/past time that ICANN's IPC discorge itself from the RIAA? See: http://recordingindustryvspeople.blogspot.com/ writes "Apparently the RIAA's http://news.slashdot.org/article.pl?sid=08/08/01/2251217&tid=123 'big gun' didn't fare so well this morning in Duluth, when he tried to persuade the judge in http://recordingindustryvspeople.blogspot.com/2007/01/index-of-litigation-d… Capitol v. Thomas that the part of the Copyright Act which says 'by sale or other transfer of ownership, or by rental, lease, or lending', can be disregarded. According to an http://blog.wired.com/27bstroke6/2008/08/judge-hints-at.html in-person account by Wired.com the Judge indicated that he is likely to grant a mistrial, setting aside the $222,000 jury verdict based upon his incorrect jury instruction, and that he will probably hand down his decision in September. Just yesterday some of the same lawyers http://recordingindustryvspeople.blogspot.com/2008/08/mpaa-loses-in-case-ag… got rebuffed by the US Court of Appeals for the Second Circuit in their attempt to argue that Cablevision's online storage for its customers constitutes a copyright infringement, in Cartoon Network v. CSC Holdings. There, too, the content owners had argued that the wording of the Copyright Act did not mean what it said. There, too, the Court politely but firmly disagreed." Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0