January 2004 - NZNOG - lists.nznog.org

list.waikato.ac.nz Has Moved
by Donald Neal 11 Dec '24

11 Dec '24

NZNOG-People, I have just finished migrating all of the mailing lists held at The University of Waikato from one server to another. I don't have any reason to believe that anything's gone wrong, but please bear with me for today if it turns out that something has. - Donald Neal -- Donald Neal | Q: How many Aucklanders does it take to change Systems Programmer/Analyst | a light bulb? The University of Waikato | A: Pass me that candle and I'll tell you. Hamilton, New Zealand | --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

RE: Sort of OT: are there any "Internet enabled" temperature sens ors/servers for Auckland?
by Greg Clare 18 Aug '21

18 Aug '21

May not be exactly what you are after? However DSE have an Internet weather station at the Albany HQ. http://www.dse.gen.nz/public/webdata/weather.htm Regards Greg > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Wednesday, 2 January 2002 2:47 pm > To: NZNOG > Subject: Sort of OT: are there any "Internet enabled" temperature > sensors/servers for Auckland? > > > Measuring the outside temperature, with geographic location given. > > -- > Juha > Take off every sig! > > - > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

problems with NTP on bigben?
by Simon Blake 03 Mar '05

03 Mar '05

Anybody else observed that bigben gained about 19 years at about 1:25pm this arvo? $ date Tue Jan 1 14:54:33 NZDT 2002 $ /usr/sbin/ntpdate -q truechimer.waikato.ac.nz server 130.217.76.32, stratum 2, offset -0.001089, delay 0.04276 1 Jan 14:49:38 ntpdate[17537]: adjust time server 130.217.76.32 offset -0.001089 sec $ /usr/sbin/ntpdate -q bigben.clix.net.nz server 203.167.224.60, stratum 1, offset 619315199.998172, delay 0.03613 1 Jan 14:49:55 ntpdate[17540]: step time server 203.167.224.60 offset 619315199.998172 sec - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

13 20

Re: [nznog] The Internet for n00bs
by Ewen McNeill 02 Feb '04

02 Feb '04

In message <401C49BA.5040507(a)saarinen.org>, Juha Saarinen writes: >There's something wrong about neutering the 'Net for newbies instead of >going after those who spoil it for them. FWIW, Dean's talk wasn't solely about people spoiling the net for newbies (although there's a lot of that too), but also that they're inadvertantly doing dumb things because it's not obvious that it's dumb and it's not obvious that there's a better way to do it. (For instance consider a newbie mailing out a 10MB attachement to the whole company when they could have just sent a link.) To that end I think that "seamless integration" of the local network (and local machine) and the Internet is counterproductive -- there really are differences and sometimes you've still got to be aware of them. (Not everyone has a gigabit link to their house yet.) >Given how spammers, phishers, crackers, VXers et al have so far managed >to work around every countermeasure devised against them, I have reason >to believe even NewbieNet would only be a temporary fix. Indeed. That was basically my point in one of the talks, that whatever restrictions you put in place would be "routed around" by those with an incentive to do so. Okay you're down to "mere applications", but applications -- especially those used by newbies -- are notoriously insecure. (Some of them even have extra, designed in, insecurity.) Jamie (Baddeley)'s suggestion of thin client is perhaps one of the few ways you might get enough control over the end appliance to control things; another is perhaps Knoppix-style bootable-readonly-device (or perhaps something PS/2, Xbox, etc like). My point was that you can get 75% of the immediate benefit of a "newbie applicance network" right now simply by firewalling customer connections at the edge -- and that if you do, please provide an opt-out mechanism. (I'd really prefer that it wasn't necessary to buy, say, a E1 link (wholesale connectivity) in order to get reasonably unfiltered access. And tunnelling everywhere sucks.) That said, short of a rigorous punishment technique,[0] rigorously applied, I don't think we're going to get all of those that spoil the 'net. Ewen [0] Death. Or perhaps transportation to the colonies. I hear Mars isn't too crowded this time of year.

6 7

Credit card fraudsters......
by Steve Withers 02 Feb '04

02 Feb '04

In my e-mail this morning, with a clickable button to take me to their 'secure site': From: security(a)visa-security.com Dear Sir/Madam, We were informed that your credit card is used by another person or stolen. It could happen if you have been shopping on-line, and someone got your "Billing information" including your credit card number. To avoid and prevent any further fraud and billing mistakes and to refund your credit card, it is strongly recommended to proceed filling in the secure form on our site and applying for our Zero Liability program. Program is free and it will help us to confirm the fact of fraud and investigate this accident as soon as possible. Sincerely yours, Visa Support Assistant, Alwin Desagun.

5 5

The Internet for n00bs
by Ewen McNeill 02 Feb '04

02 Feb '04

One of the things discussed at the (excellent, thanks everyone) NZNOG 2004 conference was that the Internet sucks, and that a large portion of this suckage is due to ignorant n00bs who do the wrong thing, get 0wned, etc. It was suggested that the "only" fix to this problem was to kill the end to end Internet, making the "Internet" a core exchange network (a la telco style), and allowing users only access to a local proxy at their ISP for a very limited set of services. Aside from my objection that this won't help much except in the short term (plenty of protocols already tunnel around such firewall limitations -- eg, look at everything that's been tunneled through HTTP), this really sucks for the l33t who find it awfully restrictive. An alternative approach to that type of thing is possibly just to heavily firewall -- at the ISP end of the link -- connections to all "potential n00b" users (SMTP to ISP mail server, POP/IMAP/HTTP/HTTPS to whereever and a few other common things) by default. And then provide an "opt out" system that anyone with a clue can use to disable the default firewalling. I would suggest: telnet ihaveaclue.$ISP where you have to enter "My name is $NAME, and I have a clue" (with $NAME expanded, but otherwise literally). Possibly that setting could be sticky; possibly it would need to be done on each reconnection.[0] The remaining aspect is that anyone who claimed to have a clue in this manner and then lets something on their connection get 0wned or otherwise abuses the privilege, (a) loses the ability to unblock themselves, and (b) gets their name published on a list of shame. This could pretty much be implemented today by anyone with a firewall (or customer facing ACLs) which can be set on a per-customer basis. Various RAS boxes have this sort of facility already; at least one ISP I know of firewalls accounts that are over due so they can reach the accounting website and that's about it. The alternative seems to be that the clueful will just tunnel everything through whatever still works. Tunnelling through DNS requests is painful but doable; tunnelling through most other things is almost tolerably efficient by comparision. And I guess bandwidth is cheap enough now that we can cope with a 20-50% overhead due to tunnelling.[1] Ewen [0] Anyone who can't automate doing it on each reconnection doesn't have a clue. [1] Still, it'll make the ATM tax look cheap.

12 16

RE: [nznog] Conference Videocast
by mark.harris＠ssc.govt.nz 31 Jan '04

31 Jan '04

Richard Naylor wrote: > > Yes - all on DVD, but missed the start of Geoffs talk - > couldn't climb over > Si to get to DVD-R. Must get bigger van..... or a smaller Si ... ;-) mark

3 2

Re: [nznog] The Internet for n00bs
by Ewen McNeill 31 Jan '04

31 Jan '04

In message <1075610074.2007.305.camel(a)localhost>, Steve Withers writes: >On Sun, 2004-02-01 at 15:11, Anaru Hartley wrote: >> I kind of sense a "one track mind" approach to the >> issue at hand. There are plenty of alternatives, >> personally I don't think tightning the rope is going >> to help improve the Internet. The point was that some people (Dean cited his Nana as an example) really don't want to deal with all the complexity of keeping their system patched against the security hole du jour -- they just want an appliance that will let them talk to their grandchildren and maybe check a few details on their latest group's meetings. A 21st century telephone. The suggestion was then made (in a later talk) that the "only" solution to the mass of people who just wanted an applicance and were unwilling/unable to deal with the "dangerous" place that is the modern Internet, was an Internet-Lite -- the Internet for n00bs. The major part of its architecture was, essentially, a bunch of application proxies at the ISP with everything else firewalled off. The aim of this was to (dramatically) reduce the pool of reachable, unpatched, systems on the 'net. The current batch of worms to install open relays would be immunised against pretty much immediately for two reasons (couldn't reach open relays once established, couldn't reach remote hosts to infect them). >True. All you need is one ISP who offers "real" Internet....and everyone >would flock there. I know I would, if that was the choice. Yes, but you're l33t Steve. You'd flock there. Most people here would flock there. Much as I don't want to see "the Internet" become a dumbed down IntaWeb clone, I recognise that's just me ("when I want to be wrapped in cotton wool, I know where to find it"). There's a whole bunch of people, probably the majority by an order of magnitude, for whom the Internet, Large As Life, is scary, and intruding on their ability to just do the things they want to (eg, their machine keeps getting infected). So The Internet for n00bs will probably happen eventually. I just hope it isn't done in such a way that the only way to join the Real Internet (tm) is to qualify for your own ASN or by building tunnels through increasingly inappropriate application level protocols. A "walled garden" (to use the Citylink description of CafeNet) would be more appropriate -- with a way out for those that can figure out the gate, and a rule that they don't get to complain (or get out again) if they get run over by the traffic outside. Ewen

2 1

RE: [nznog] The Internet for n00bs
by Seton Wingfield 31 Jan '04

31 Jan '04

In my experience its never the people that find an exploit that end up causing the mayhem. If the flow of information from the exploit finders to the script kiddies could be stopped so would the majority of worms etc. I know this is old thinking but it seems like a easier option than firewalling off the Internet. I recently read the "Changes to Functionality in Microsoft Windows XP Service Pack 2" and in it, it states that the Internet Connection Firewall will be turned on by default. Changes like this and Microsoft's long term commitment to security via their "Trustworthy Computing" initiative may make the problems that you are trying to solve a thing of the past. http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6… http://www.microsoft.com/mscorp/innovation/twc/twc_whitepaper.asp The documents are MS Word format. -----Original Message----- From: Ewen McNeill [mailto:ewen(a)naos.co.nz] Sent: Sunday, 1 February 2004 11:17 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] The Internet for n00bs One of the things discussed at the (excellent, thanks everyone) NZNOG 2004 conference was that the Internet sucks, and that a large portion of this suckage is due to ignorant n00bs who do the wrong thing, get 0wned, etc. It was suggested that the "only" fix to this problem was to kill the end to end Internet, making the "Internet" a core exchange network (a la telco style), and allowing users only access to a local proxy at their ISP for a very limited set of services. Aside from my objection that this won't help much except in the short term (plenty of protocols already tunnel around such firewall limitations -- eg, look at everything that's been tunneled through HTTP), this really sucks for the l33t who find it awfully restrictive. An alternative approach to that type of thing is possibly just to heavily firewall -- at the ISP end of the link -- connections to all "potential n00b" users (SMTP to ISP mail server, POP/IMAP/HTTP/HTTPS to whereever and a few other common things) by default. And then provide an "opt out" system that anyone with a clue can use to disable the default firewalling. I would suggest: telnet ihaveaclue.$ISP where you have to enter "My name is $NAME, and I have a clue" (with $NAME expanded, but otherwise literally). Possibly that setting could be sticky; possibly it would need to be done on each reconnection.[0] The remaining aspect is that anyone who claimed to have a clue in this manner and then lets something on their connection get 0wned or otherwise abuses the privilege, (a) loses the ability to unblock themselves, and (b) gets their name published on a list of shame. This could pretty much be implemented today by anyone with a firewall (or customer facing ACLs) which can be set on a per-customer basis. Various RAS boxes have this sort of facility already; at least one ISP I know of firewalls accounts that are over due so they can reach the accounting website and that's about it. The alternative seems to be that the clueful will just tunnel everything through whatever still works. Tunnelling through DNS requests is painful but doable; tunnelling through most other things is almost tolerably efficient by comparision. And I guess bandwidth is cheap enough now that we can cope with a 20-50% overhead due to tunnelling.[1] Ewen [0] Anyone who can't automate doing it on each reconnection doesn't have a clue. [1] Still, it'll make the ATM tax look cheap. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Commerce Commission - bitstream etc.
by Simon Lyall 31 Jan '04

31 Jan '04

I was having a look though the documents here: http://www.comcom.govt.nz/telecommunications/localloop.cfm I was a bit disappointed at the lack of Local Loop access but there seemed to be some positive talk about the Bitstream service. However the last three pages (Appendix 5) of the Final Report Appendices basically define this as a 128up/256down service with VOIP, video and similar functionality specifically excluded. In other words Telecom will only have to open up a minimal level ADSL service slightly faster than Jetstart (with a recommended provisioning cost of $185 ) . I also see nothing about removing the requirement for all home customers with DSL to also have a voice phone line so I presume it's still in there which means that their be no option to replace home customer's main phone line with a VOIP system (like some people are doing in the US) or for people just to use their cellphones. Which overall looks like at least another couple of years of "more of the same" with respect to high speed Internet for most people. Or have I misinterpreted the recommendations? -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

9 18