Subject: Evil bit (RFC3514) finally implemented

From: Martin Sustrik <[email-masked]>
Date: Sun, 01 Apr 2012 15:36:45 +0200

Hi all,

During yesterday's takedown of the Internet [1] it has become 
painstakingly obvious that the ability to distinguish malicious packets 
in a quick and efficient manner is one of the most pressing security 
concerns of today.

Thus, RFC3514 (a.k.a. "evil" bit) [2] support was implemented [3] in 
the Linux kernel today.

It is our hope that other operating systems and network devices will 
follow the suite soon and help us make Internet a safer and more 
welcoming place for everyone!

Martin

[1] http://pastebin.com/GFkQnf6e
[2] http://tools.ietf.org/html/rfc3514
[3] http://article.gmane.org/gmane.linux.kernel/1276103

---

From: "Bjoern A. Zeeb" <[email-masked]>
Date: Sun, 1 Apr 2012 18:05:19 +0000

On 1. Apr 2012, at 13:36 , Martin Sustrik wrote:

Hey,

> During yesterday's takedown of the Internet [1] it has become painstakingly obvious that the ability to distinguish malicious packets in a quick and efficient manner is one of the most pressing security concerns of today.
> 
> Thus, RFC3514 (a.k.a. "evil" bit) [2] support was implemented [3] in the Linux kernel today.
> 
> It is our hope that other operating systems and network devices will follow the suite soon and help us make Internet a safer and more welcoming place for everyone!

Wow.  This is great news!  Happy to see you catching up after only 9 years [1].   I fear it should not have been backed out [2] given its obvious need these days ;-)

/bz

References:
[1] http://svnweb.freebsd.org/base?view=revision&revision=112929
[2] http://svnweb.freebsd.org/base?view=revision&revision=112985

-- 
Bjoern A. Zeeb                                 You have to have visions!
   It does not matter how good you are. It matters what good you do!

---

From: "Eggert, Lars" <[email-masked]>
Date: Mon, 2 Apr 2012 07:44:11 +0000

It's taken Linux 9 years longer to implement it, and it will take them 9 years longer to remove it, too :-)

Lars

---

From: Tony Finch <[email-masked]>
Date: Mon, 2 Apr 2012 16:22:08 +0100

Martin Sustrik <[email-masked]> wrote:
>
> Thus, RFC3514 (a.k.a. "evil" bit) support was implemented in the Linux
> kernel today.

Gosh, that's amazingly slow.
http://lists.freebsd.org/pipermail/cvs-all/2003-April/001098.html

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Fair Isle, Faeroes: North or northeast 5 to 7, occasionally 4 at first,
perhaps gale 8 later in Fair Isle. Rough or very rough. Snow then snow
showers. Good, occasionally very poor.

---

From: Ray Bellis <[email-masked]>
Date: Mon, 2 Apr 2012 18:10:48 +0000

On 1 Apr 2012, at 15:36, Martin Sustrik wrote:

Hi all,

Hey, they can't do that!  I've got a real use for it...

See draft-bellis-behave-natpresent-00<http://tools.ietf.org/html/draft-bellis-behave-natpresent-00>

http://tools.ietf.org/html/draft-bellis-behave-natpresent-00

Ray

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 03 Apr 2012 11:51:59 +0200

> http://lists.freebsd.org/pipermail/cvs-all/2003-April/001098.html

Two implementations?  Then we need an interop event.

/Simon

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 3 Apr 2012 12:04:04 +0200

On Tue, Apr 03, 2012 at 11:51:59AM +0200,
 Simon Josefsson <[email-masked]> wrote 

> Two implementations?  Then we need an interop event.

And a standard API since Linux uses IP_EVIL and FreeBSD
IP_EVIL_INTENT...

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 3 Apr 2012 11:59:49 +0100

Anyone who wants to do an interop event is welcome to come to my lair under the
third volcanic island on the left.

No need to send a response, my tracking system will alert me to your impending
arrival, and my Directorate will bring you to my presence.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Stephane Bortzmeyer
> Sent: 03 April 2012 11:04
> To: Simon Josefsson
> Cc: [email-masked]
> Subject: Re: Evil bit (RFC3514) finally implemented
>

---

From: Steven Bellovin <[email-masked]>
Date: Tue, 3 Apr 2012 12:26:47 -0400

> Two implementations?  Then we need an interop event.

See https://www.cs.columbia.edu/~smb/3514.html for some other responses
and implementations.

		--Steve Bellovin, https://www.cs.columbia.edu/~smb