DNS

Cloud Security Hinges on IP Addressing

In the first part of this trilogy, I discussed the importance of automatically provisioned second generation DNS in connection with Software Defined Networking (SDN) and Software Defined Data Centre (SDDC). In the second post, I talked about IP addressing, private enterprise networks, and how DHCP does not meet the requirements of multitenant Infrastructure-as-a-Service (IaaS) cloud environments. I will now wrap up this trilogy by putting these two thesis into real-life context. more

Chuck Norris Botnet and Broadband Routers

Last week Czech researchers released information on a new worm which exploits CPE devices (broadband routers) by means such as default passwords, constructing a large DDoS botnet. Today this story hit international news... The spread of insecure broadband modems (DSL and Cable) is extremely wide-spread, with numerous ISPs, large and small, whose entire (read significant portions of) broadband population is vulnerable. more

The Harsh Reality of Spam and Online Security… Should I Stay or Should I Go?

Working in the anti-spam and online malware fight can be depressing or at best invoke multiple personality disorder. We all know things are bad on the net, but if you want a dose of stark reality, check out Brian Kreb's fantastic 'Security Fix' blog on the Washington Post site... Speaking to an old friend who asked me what I was doing these days, I recently likened the fight against this relentless onslaught to having one's pinky in a dyke, and there are days when I don't even think we have a dyke! more

Will a Global TAR Make DNSSEC Stick?

Two US Government contractors and the National Institute of Science and Technology have released a white paper, "Statement of Needed Internet Capability," detailing possible alternatives and considerations for a Trust Anchor Repository (TAR) to support DNSSEC deployment. The document was released through the DNSSEC-Deployment Group this week with a request that it be circulated as widely as possible to gather feedback. A Trust Anchor Repository (TAR) refers to the concept of a DNS resource record store that contains secure entry point keys... more

How Tiered Internet Pricing Could Actually Facilitate P2P

Time Warner Cable's planned experiment with tiered charging for Internet access has generated a flurry of coverage in the blogsphere, but no new insights (at least that I've seen). The primary problem ISP's complain about is that 5% of their customers use 90% of the available bandwidth and when they examine this traffic, it's mostly peer-to-peer file sharing... more

Minimum Disclosure: What Information Does a Name Server Need to Do Its Job?

Two principles in computer security that help bound the impact of a security compromise are the principle of least privilege and the principle of minimum disclosure or need-to-know. As described by Jerome Saltzer in a July 1974 Communications of the ACM article, Protection and the Control of Information Sharing in Multics, the principle of least privilege states, "Every program and every privileged user should operate using the least amount of privilege necessary to complete the job." more

Is a New Set of Governance Mechanism Necessary for the New gTLDs?

In order to be able to reply to the question of whether a new set of governance mechanisms are necessary to regulate the new Global Top Level Domains (gTLDs), one should first consider how efficiently the current Uniform Domain-Name Dispute-Resolution Policy (UDRP) from the Internet Corporation for Assigned Names and Numbers (ICANN) has performed and then move to the evaluation of the Implementations Recommendations Team (ITR) recommendations. more

Internet Governance: There Are No Masterplans

Please pardon me if I start this story by telling about an incident that happened to me at the Madrid airport while flying to the ICANN meetings in Rio.

It was about midnight when, after flying in from Turin, my hometown, I had to go through the passport control to reach my gate for the flight to Rio. The war between the US/UK and Iraq had started two days before, and even if the Spanish government was among its supporters, security checks were apparently proceeding as usual. Passport controls inside the EU for EU citizens usually take a few seconds, and the line ahead of me was proceeding quickly. more

WSIS Leaving More Questions Than Answers

Two things are important to stress. First, nothing was decided in this meeting, and no actions will be taken until the next meeting in 2005. Secondly, and more importantly, as with anything the devil is in the details. Given the vagueness of the documents available, there are few reliable conclusions that can be drawn from the summit...Before any judgments can be made about the effectiveness, or feasibility of the ideas outlined in the Plan of Action more concrete information is needed. The details of these plans are currently unknown to the Internet community at large, and may even be unknown to the members of the WSIS. Based on the information that is available it appears the Plan of Action needs to be thought through a little more thoroughly. more

First Nine English-Language newgTLDs Delegated by ICANN - .Camera, .Clothing, .Singles and More…

This past week brought word that the first nine Latin / ASCII "new Generic Top Level Domains (newgTLDs)" were delegated by ICANN and are now found in the root of DNS. This means that the registries behind these newgTLDS can now start the process of making "second-level domains" (the ones we normally register) available in each of these TLDs. more

ICANN 35: What’s Going Down, Down Under (Want the Low Down?)

As I've been getting ready to catch my plane for ICANN 35 (Sydney), I can't help but thinking that there are a lot of things going down these days that will dramatically affect makeup of the Internet for years to come. Next year at this time, the root could be a very, very different place. A few of the items that will be getting deconstructed, discussed, debated Down Under are outlined below... more

What’s Going on at ICANN in Cairo

Following up on the big decision at the Paris ICANN meeting in June to make new Top-Level Domains available, there's lots of activity at the ICANN conference in Cairo, Egypt this week. A few of the hot topics of discussion that we are following are the applications process for new generic Top-Level Domains (gTLDs), Registry/Registrar Cross Ownership, and restructuring of the ICANN Board. more

A Short History of DNS Over HTTP (So Far)

The IETF is in the midst of a vigorous debate about DNS over HTTP or DNS over HTTPS, abbreviated as DoH. How did we get there, and where do we go from here? (This is somewhat simplified, but I think the essential chronology is right.) Javascript code running in a web browser can't do DNS lookups, other than with browser.dns.resolv() to fetch an A record, or implicitly by fetching a URL which looks up a DNS A or AAAA record for the domain in the URL. more

This Is Not Your Father’s Traceroute Tool

Traceroute is a network tool that helps determine the path packets take as they travel from one location to another, identifying all of the "hops" along the way. I wonder why they are called hops*? Almost all operating systems have traceroute utilities built in. The command is just that "traceroute", Windows systems abbreviate the command as "tracert" to deal with the 8.3 file naming convention of old... So, let's look at what information traceroute gives you. more

Video on How the DNS Works

CENTR, the Council of European National Top Level Domain Registries, has produced the following video to help explain the functioning of the Domain Name System (DNS). more