Greylisting Still Works - Part I

Greylisting is a hoary technique for rejecting spam sent by botnets and other poorly written spamware. When a mail server receives an attempt to deliver mail from a hitherto unseen sending host IP address, it rejects the message with a "soft fail" error which tells the sender to try again later. Real mail software does try again, at which point you note that the host knows how to retry and you don't greylist mail from that IP again. more

Why OIRA Needs to Coordinate Federal Cyber Security Regulation

Two quick facts about American industry's resilience against cyber-attack, (1) our critical infrastructure is inadequately protected and (2) federal regulation will be required to fix the problem, reliance on market forces alone will not be sufficient irrespective of whether or not Sony Pictures survives. Although regulation is needed, it needs to be coordinated and, above all, cost-effective. Which agency is charge of regulating cybersecurity? Right now, it's a free for all with agencies staking out turf and claims of authority. more

A Packet of Lies

I've been reading the kerfuffle around Comcast's blocking of various random network protocols with interest. Whilst I remain convinced that blanket "network neutrality" legislation remains just a form of digital gripe water (cures colic for cybernauts), there's clearly a problem. As I previously alluded there's a definite consumer protection issue over what you buy when it says 'Internet' on the tin. So here's tuppence worth of additional input... more

By 2021 Cost of Cybercrime to Top Annual Natural Disasters and Global Drug Trade Costs, Says Report

By 2021, it is estimated that cybercrime will cost the global economy more than $6 trillion in damages, exceeding annual costs for natural disasters and the global drug trade. more

5G Frequency Fees Are Waived in Singapore to Help Drive Market Tests

Singapore government has waived telecom frequency fees for 5G trials until December 2019 in order to catalyze market growth and discovery of potential use cases. more

Google and Others Launch M-Lab, Allows Users Track ISP Performance

Announced today, Google Inc. along with the New America Foundation's Open Technology Institute, PlanetLab Consortium, and academic researchers are launching a new initiative called Measurement Lab, or M-Lab. According to Google's announcement, M-Lab is an open, distributed server platform for researchers to deploy Internet measurement tools. "The goal of M-Lab is to advance network research and empower the public with useful information about their broadband connections. By enhancing Internet transparency, M-Lab helps sustain a healthy, innovative Internet." more

New Geographical Top-Level Domains and Auctions

I was surprised by ICANN's "Economic Case for Auctions in New gTLDs" paper especially with view to the latest presentation on the new generic Top-Level Domain (gTLD) implementation process in Paris. That Paris presentation highlighted the protection of community interests such as religious organisations, geographically based communities or indigenous groups and suggested a preference of bona fide community-based applicants against pure generic applications for the same string. Contrary to this the only text passage in the current paper where ICANN considered the community-based applicants is "a 25% bidding credit could be offered to community-based bidders whose community is located primarily in least-developed countries". This reminds me of the discussion on discounts for HIV medicine... more

China Clamps Down on VPNs, Carriers Told to Block Access by Feb. 1

State-run telecommunications firms in China are given until February 1 to block people from using VPNs, shuttering key ways both locals and foreigners still manage to access the global, unfiltered web on a daily basis. more

Google’s Gigabit Gambit

Want a gig (1000 megabits per second) of Internet access bandwidth? Google says you could have it by the end of next year "from Manhattan to rural North Dakota (sic, I think they meant Vermont)" if their proposal to the FCC is accepted forthwith according to CNET's newsblog. Not only a gig but a mobile gig, accessible by cellphone or roaming computer -- no fiber required. Sound too good to be true? -- it isn't, IMHO! Engineering is not the problem... more

Some Random Notes from IETF 115

The IETF held its 115th meeting in London in November 2022. This was another in the set of hybrid meetings with specific support for online attendees in addition to the normal face-to-face meetings for the week. In no particular order, here are a few of my impressions from the IETF meeting. more

New CEO Stresses ICANN’s Role in Cybersecurity

One summer sport in Internet governance is speculating on what direction ICANN's new CEO will take it in. Making the media rounds yesterday on Fox and Lehrer News Hour to talk about the recent DDoS attacks on US and S. Korea government and commercial websites, new CEO Rod Beckstrom pushed how the response to cyber attacks is a coordinated effort, he also alluded to ICANN's role in similar attacks. Responding to a question on the News Hour about the USG policy response to dealing with cyber attacks, Beckstrom highlighted the critical role of ISP filtering, and identified the "organic" as well as "somewhat structured" coordination which occurs during a typical response. More interestingly, he plugged ICANN's facilitating role. more

DMARC and Message Wrapping

I have groused at length about the damage that anti-phishing technique DMARC does to e-mail discussion lists. For at least two years list managers and list software developers have been trying to figure out what to do about it. The group that brought us DMARC is working on an un-DMARC-ing scheme called ARC, which will likely help somewhat, but ARC isn't ready yet, and due to ARC's complexity, it's likely that there will be many medium or small mail systems that enforce DMARC and can't or won't use ARC. more

Trademark Attorneys Warn Companies About the Upcoming .CM Cybersquatting Possibilities

In light of recent announcements regarding Cameroon's country code Top-Level Domain, .CM, being opened to public registration, Tresa Baldas reports on Law.com: "Trademark attorneys are warning companies about a new target for cybersquatters known as '.cm,' which is the country code -- or top level domain -- for the West African nation of Cameroon. The dot-cm domain is a hot target for scammers, they say, due to 'cm' being a common typographical error for 'com' in the popular dot-com domain. Attorneys say this is significant to brand owners because Internet users searching for brand owners' Web sites frequently mistype dot-com as dot-cm and wind up on a bogus site. Not only is Web traffic lost, they say, but a brand name can get diluted or tainted along the way." (Also see, Nation of Cameroon Typo-Squats the Entire .com Space from 2006) more

Email Portability, DKIM, and Socio-Political Implications on Tech Development

A few years ago, cell phone portability was introduced in the United States which caused a major shift in the market. The same thing happened this past year in Israel, following a major battle involving the cell carriers, consumer groups and the Israeli parliament (The Knesset). What if the same happened with email addresses? Ridiculous, you say? May be so, but there is chatter here in Israel to create a law which forces the local service providers hands to do just that. more

Luddites of the 21St Century Unite?

In the past few weeks doom and gloom stories about the future were printed, discussed and opined in the press. The down and out of the message of futurists is that the middle class is going to be swept away in the coming years because of software and robotic solutions (from here on: automated processes), making humans redundant... Do Luddites of the 21st century need to rise? I want to look at the topic from a few angles. more