<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">

	<channel>

	<title>&#45; CircleID</title>
	<link>https://www.circleid.com/blogs/</link>
	<description>Postings from  on CircleID</description>
	<dc:language>en</dc:language>
	<dc:rights>Copyright 2026, unless where otherwise noted.</dc:rights>
	<dc:date>2026-04-08T19:45:00+00:00</dc:date>

	
	<item>
		<title> Ten Years of Passive DNS (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20210504-ten-years-of-passive-dns</guid>
		<link>https://circleid.com/posts20210504-ten-years-of-passive-dns</link>
		<description><![CDATA[The report, "A Decade of Passive DNS" provides a longitudinal analysis of the use and popularity of top-level domains over a ten-year period. The findings are based on what Farsight Security has seen in passive DNS from 2010-2019 based on a ten-year data rollup, excluding DNSSEC-related records. This study allows us to report on four measures for that period for each of the 1,576 IANA-recognized TLDs. <a href="https://circleid.com/posts20210504-ten-years-of-passive-dns">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Nation Scale Internet Filtering -- Do's and Don'ts (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20170718_nation_scale_internet_filtering_dos_and_donts</guid>
		<link>https://circleid.com/posts20170718_nation_scale_internet_filtering_dos_and_donts</link>
		<description><![CDATA[If a national government wants to prevent certain kinds of Internet communication inside its borders, the costs can be extreme and success will never be more than partial. VPN and tunnel technologies will keep improving as long as there is demand, and filtering or blocking out every such technology will be a never-ending game of one-upmanship. Everyone knows and will always know that determined Internet users will find a way to get to what they want, but sometimes the symbolic message is more important than the operational results. <a href="https://circleid.com/posts20170718_nation_scale_internet_filtering_dos_and_donts">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Limits of Notice and Takedown (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20170420_the_limits_of_notice_and_takedown</guid>
		<link>https://circleid.com/posts20170420_the_limits_of_notice_and_takedown</link>
		<description><![CDATA[In The Limits of Filtering, Evan Engstrom and Nick Feamster argue eloquently that the costs of a "takedown-staydown" system to defend against copyright infringement would be prohibitive for online service providers (OSPs) and therefore deprive OSPs of otherwise interested investors. I agree that Engstrom and Feamster raise some valid points, particularly including that content recognition technologies are not perfect... However, we must also remember that the current DMCA regime imposes significant costs... <a href="https://circleid.com/posts20170420_the_limits_of_notice_and_takedown">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Notice, Takedown, Borders, and Scale (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20170301_notice_takedown_borders_and_scale</guid>
		<link>https://circleid.com/posts20170301_notice_takedown_borders_and_scale</link>
		<description><![CDATA[I was on the front lines of the SOPA wars, because SOPA touched on two matters of strong personal and professional importance for me: protecting the Internet infrastructure, and protecting the economy from Internet related crime. I've continued to study this field and advise industry participants in the years since then. The 2017-02-20 paper by Annemarie Bridy entitled <em>Notice and Takedown in the Domain Name System: ICANN's Ambivalent Drift into Online Content Regulation</em> deserves an answer, which I shall attempt here. <a href="https://circleid.com/posts20170301_notice_takedown_borders_and_scale">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Let Me Make Yeti-DNS Perfectly Clear (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20160330_let_me_make_yeti_dns_perfectly_clear</guid>
		<link>https://circleid.com/posts20160330_let_me_make_yeti_dns_perfectly_clear</link>
		<description><![CDATA[The following rather alarming text caught my eye today... Had the text appeared under a less august letterhead, or signed by less qualified authors, there would be no cause for alarm. However, the letterhead was World Economic Forum and the authors were William J. Drake, Vinton G. Cerf, and Wolfgang Kleinwächter. As one of three coordinators for the Yeti-DNS project, this feels a bit like <em>I'm in big trouble now</em>. So, let's discuss the matter. <a href="https://circleid.com/posts20160330_let_me_make_yeti_dns_perfectly_clear">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Internet Security Marketing: Buyer Beware (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20150420_internet_security_marketing_buyer_beware</guid>
		<link>https://circleid.com/posts20150420_internet_security_marketing_buyer_beware</link>
		<description><![CDATA[As security breaches increasingly make headlines, thousands of Internet security companies are chasing tens of billions of dollars in potential revenue. While we, the authors, are employees of Internet security companies and are happy for the opportunity to sell more products and services, we are alarmed at the kind of subversive untruths that vendor "spin doctors" are using to draw well-intentioned customers to their doors. Constructive criticism is sometimes necessarily harsh, and some might find the following just that, harsh. But we think it's important that organizations take a "buyers beware" approach to securing their business. <a href="https://circleid.com/posts20150420_internet_security_marketing_buyer_beware">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Secure Unowned Hierarchical Anycast Root Name Service - And an Apologia (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20141107_secure_unowned_hierarchical_anycast_root_name_service_and_apologia</guid>
		<link>https://circleid.com/posts20141107_secure_unowned_hierarchical_anycast_root_name_service_and_apologia</link>
		<description><![CDATA[In Internet Draft draft-lee-dnsop-scalingroot-00.txt, I described with my coauthors a method of distributing the task of providing DNS Root Name Service both globally and universally. In this article I will explain the sense of the proposal in a voice meant to be understood by a policy-making audience who may in many cases be less technically adept than the IETF DNSOP Working Group for whom the scalingroot-00 draft was crafted. I will also apologize for a controversial observation concerning the addition of new root name servers... <a href="https://circleid.com/posts20141107_secure_unowned_hierarchical_anycast_root_name_service_and_apologia">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Painting Ourselves Into a Corner with Path MTU Discovery (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20140629_painting_ourselves_into_a_corner_with_path_mtu_discovery</guid>
		<link>https://circleid.com/posts20140629_painting_ourselves_into_a_corner_with_path_mtu_discovery</link>
		<description><![CDATA[In Tony Li's article on path MTU discovery we see this text: "The next attempt to solve the MTU problem has been Packetization Layer Path MTU Discovery (PLPMTUD). Rather than depending on ICMP messaging, in this approach, the transport layer depends on packet loss to determine that the packet was too big for the network. Heuristics are used to differentiate between MTU problems and congestion. Obviously, this technique is only practical for protocols where the source can determine that there has been packet loss. Unidirectional, unacknowledged transfers, typically using UDP, would not be able to use this mechanism. To date, PLPMTUD hasn't demonstrated a significant improvement in the situation." Tony's article is (as usual) quite readable and useful, but my specific concern here is DNS... <a href="https://circleid.com/posts20140629_painting_ourselves_into_a_corner_with_path_mtu_discovery">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Wow! BIND9 9.10 Is out, and What a List of Features! (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20140430_wow_bind9_910_is_out_and_what_a_list_of_features</guid>
		<link>https://circleid.com/posts20140430_wow_bind9_910_is_out_and_what_a_list_of_features</link>
		<description><![CDATA[Today the e-mail faerie brought news of the release of BIND9 9.10.0 which can be downloaded from here. BIND9 is the most popular name server on the Internet and has been ever since taking that title away from BIND8 which had a few years earlier taken it from BIND4. I used to work on BIND, and I founded ISC, the home of BIND, and even though I left ISC in July 2013 to launch a commercial security startup company, I remain a fan of both ISC and BIND. <a href="https://circleid.com/posts20140430_wow_bind9_910_is_out_and_what_a_list_of_features">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Extreme Vulnerability at the Edge of the Internet - A Fresh New Universal Human-Rights Problem (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20140206_extreme_vulnerability_at_the_edge_of_internet_universal_problem</guid>
		<link>https://circleid.com/posts20140206_extreme_vulnerability_at_the_edge_of_internet_universal_problem</link>
		<description><![CDATA[By design, the Internet <em>core</em> is stupid, and the <em>edge</em> is smart. This design decision has enabled the Internet's wildcat growth, since without complexity the core can grow at the speed of demand. On the downside, the decision to put all smartness at the edge means we're at the mercy of scale when it comes to the quality of the Internet's aggregate traffic load. Not all device and software builders have the skills - and the quality assurance budgets - that something the size of the Internet deserves. <a href="https://circleid.com/posts20140206_extreme_vulnerability_at_the_edge_of_internet_universal_problem">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> On the Time Value of Security Features in DNS (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20130913_on_the_time_value_of_security_features_in_dns</guid>
		<link>https://circleid.com/posts20130913_on_the_time_value_of_security_features_in_dns</link>
		<description><![CDATA[There are some real problems in DNS, related to the general absence of Source Address Validation (SAV) on many networks connected to the Internet. The core of the Internet is aware of destinations but blind to sources. If an attacker on ISP A wants to forge the source IP address of someone at University B when transmitting a packet toward Company C, that packet is likely be delivered complete and intact, including its forged IP source address. Many otherwise sensible people spend a lot of time and airline miles trying to improve this situation... The problems created for the Domain Name System (DNS) by the general lack of SAV are simply hellish. <a href="https://circleid.com/posts20130913_on_the_time_value_of_security_features_in_dns">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> DNS Firewalls In Action - RPZ vs. Spam (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20120103_dns_firewalls_in_action_rpz_vs_spam</guid>
		<link>https://circleid.com/posts20120103_dns_firewalls_in_action_rpz_vs_spam</link>
		<description><![CDATA[In general, a network firewall is just a traffic filter... Filtering rules can be anything from "allow my web server to hear and answer web requests but not other kinds of requests" to "let my users Ping the outside world but do not let outsiders Ping anything on my network." The Internet industry has used firewalls since the mid-1980's and there are now many kinds, from packet layer firewalls to web firewalls to e-mail firewalls. Recently the DNS industry has explored the firewall idea and the results have been quite compelling. In this article I'm going to demonstrate a DNS firewall built using RPZ (Response Policy Zones) and show its potential impact on e-mail "spam". <a href="https://circleid.com/posts20120103_dns_firewalls_in_action_rpz_vs_spam">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> DNS Changer (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20120327_dns_changer</guid>
		<link>https://circleid.com/posts20120327_dns_changer</link>
		<description><![CDATA[One fine night in November 2011 I got an opportunity to get my hands dirty, working on a project for the United States Federal Bureau of Investigation (FBI). They were planning to seize a bunch of computing assets in New York City that were being used as part of a criminal empire that we called "DNS Changer" since that was the name of the software this gang used to infect a half million or so computers. <a href="https://circleid.com/posts20120327_dns_changer">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Refusing REFUSED (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20120111_refusing_refused_for_sopa_pipa</guid>
		<link>https://circleid.com/posts20120111_refusing_refused_for_sopa_pipa</link>
		<description><![CDATA[The U.S. Congress' road to Stopping Online Piracy (SOPA) and PROTECT IP (PIPA) has had some twists and turns due to technical constraints imposed by the basic design of the Internet's Domain Name System (DNS). PIPA's (and SOPA's) provisions regarding advertising and payment networks appear to be well grounded in the law enforcement tradition called <em>following the money</em>, but other provisions having to do with regulating American Internet Service Providers (ISPs) so as to block DNS resolution for pirate or infringing web sites have been shown to be ineffectual, impractical, and sometimes unintelligible. <a href="https://circleid.com/posts20120111_refusing_refused_for_sopa_pipa">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	
	<item>
		<title> DNS Policy is Hop by Hop; DNS Security is End to End (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20121012_dns_policy_is_hop_by_hop_dns_security_is_end_to_end</guid>
		<link>https://circleid.com/posts20121012_dns_policy_is_hop_by_hop_dns_security_is_end_to_end</link>
		<description><![CDATA[The debate continues as to whether ISP's can effectively filter DNS results in order to protect brand and copyright holders from online infringement. It's noteworthy that there is no argument as to whether these rights holders and their properties deserve protection - nobody is saying "content wants to be free" and there is general agreement that it is harder to protect rights in the Internet era where perfect copies of can be made and distributed instantaneously. What we're debating now is just whether controlling DNS at the ISP level would work at all and whether the attempt to insert such controls would damage Secure DNS (sometimes called DNSSEC). <a href="https://circleid.com/posts20121012_dns_policy_is_hop_by_hop_dns_security_is_end_to_end">More...</a>]]></description>
		<dc:date>2026-04-08T12:45:00-07:00</dc:date>
	</item>
	

	</channel>
</rss>