Subject: [Asrg] 7. BCP - Verisign and wildcards

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Sep 2003 12:39:09 -0400

Just to follow up on this - I just spoke to an engineer at Verisign and 
he informed me that the SMTP daemon is being replaced in a few hours 
with an RFC-compliant one. As for not giving a warning - this came from 
a higher policy level at Verisign and he is just an engineer.

Yakov

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Tue, 16 Sep 2003 19:24:50 +0200

At 12:39 PM -0400 2003/09/16, Yakov Shafranovich wrote:

>  Just to follow up on this - I just spoke to an engineer at Verisign
>  and he informed me that the SMTP daemon is being replaced in a few
>  hours with an RFC-compliant one. As for not giving a warning - this
>  came from a higher policy level at Verisign and he is just an
>  engineer.

	Word from Paul Vixie is that the ISC is working feverishly on a 
more general solution to this problem.  Unfortunately, that's about 
all I know at the moment.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 17 Sep 2003 04:47:32 +0200

> all I know at the moment.

Isn't it kinda funny ...

*.museum points to 195.7.77.20

    museum.                 IN NS  ns.icann.org.
    museum.                 IN NS  nic.icom.org.
    museum.                 IN NS  nic.museum.
    museum.                 IN NS  ns1.getty.edu.
    museum.                 IN NS  ns-ext.vix.com.

Please note especially
    ns.icann.org
    ns-ext.vix.com
in that list.

Btw. there are about 10 other TLDs that also have *.tld records.

Please don't get me wrong, I am really upset about VeriSigns "coup",
but there is more to fix than just .com/.net and not all white hats
are without big black spots ...

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: Brad Knowles <[email-masked]>
Date: Wed, 17 Sep 2003 04:50:41 +0200

>  are without big black spots ...

	Right.  This is why ISC is working on a real solution to the 
overall problem.  According to the article by Declan McCullagh at 
<http://news.com.com/2100-1032_3-5077530.html>, there should be a fix 
for this published by tomorrow.

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Sep 2003 23:02:33 -0400

Brad Knowles wrote:

>     Right.  This is why ISC is working on a real solution to the overall 
> problem.  According to the article by Declan McCullagh at 

Here is a relevant message from the IETF mailing list:

-------- Original Message --------
Subject: Re: [Fwd: [Asrg] Verisign: All Your Misspelling Are Belong To Us]
Date: 17 Sep 2003 02:32:42 +0000
From: Paul Vixie <[email-masked]>
To: [email-masked]
References: <[email-masked]>

 > It is worth noting that if we are to "pass judgement against" Verisign
 > there are at least half-dozen other TLDs that blazed the trail.  We just
 > overlooked them because of their size as compared to .NET and .COM.

when people started beating on my phone ringer about wildcards yesterday
evening, and screaming for patches to bind to somehow make it all better,
i asked "but other tld's do this, what's the big deal?"  as near as i can
figure it, the problem is one of expectation.  if someone signs up for .nu
they know there'll be a wildcard there before they sign, and they can take
appropriate precautions (like only using it for web or e-mail, and not
naming hosts under that tld).  the expectations for .com and .net to not
have wildcards were all set many years ago, and it's the violation of those
expectations that's got people angry enough to publish patchware about it.
-- 
Paul Vixie

---

From: Jonathan Morton <[email-masked]>
Date: Wed, 17 Sep 2003 12:04:48 +0100

> the expectations for .com and .net to not

New versions of BIND 9.{1,2,3} have just been released:

-- snip --
In response to high demand from our users, ISC is releasing a patch for 
BIND
to support the declaration of "delegation-only" zones in 
caching/recursive
name servers.  Briefly, a zone which has been declared 
"delegation-only" will
be effectively limited to containing NS RRs for subdomains, but no 
actual
data outside its apex (for example, its SOA RR and apex NS RRset).  
This can
be used to filter out "wildcard" or "synthesized" data from NAT boxes 
or from
authoritative name servers whose undelegated (in-zone) data is of no 
interest.
-- snip --

--------------------------------------------------------------
from:     Jonathan "Chromatix" Morton
mail:     [email-masked]
website:  http://www.chromatix.uklinux.net/
tagline:  The key to knowledge is not to rely on people to teach you it.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 19 Sep 2003 03:14:13 -0400

> New versions of BIND 9.{1,2,3} have just been released:

The "Snubby" mail rejector daemon has been now upgraded to version 1.5!
It accepts EHLO and most SMTP commands, and looks RFC compliant. Once 
again for the BCP area we must account for this behavior and similar 
theoretical DNS issues in BCPs for spam tools and MUA/MTA authors.

Additionally, as per below log, it accepts mail addressed to 
<postmaster> as per section 4.5.1 of RFC 2821. It does not accept mail 
addressed to <[email-masked]>, so misaddressed 
mail bounces UNLESS the sender's MTA/MUA uses the <postmaster> format. 
The mail log appears below:

-------------snip------------
open 64.94.110.11 25

220 Snubby Mail Rejector Daemon v1.5 ready
HELO snubby.org
250 snubby
RSET
250 Ok
HELO snubby.org
250 snubby
MAIL FROM:<>
250 Ok
RCPT TO:<postmaster>
250 Ok
RCPT TO:<[email-masked]>
550 <unknown[68.27.148.70]>: Client host rejected: The domain you are
trying to
send mail to does not exist.
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: ASRG test
From: [email-masked]

This is a test for the ASRG - see www.irtf.org/asrg

.
250 Ok: queued as E449472F8
RSET
250 Ok
EHLO shdhdh.com
250-snubby
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-XVERP
250 8BITMIME
RSET
250 Ok
QUIT
221 Bye

Connection to host lost.