- NZNOG - lists.nznog.org

RE: [nznog] Conference Videocast
by mark.harris＠ssc.govt.nz 31 Jan '04

31 Jan '04

Richard Naylor wrote: > > Yes - all on DVD, but missed the start of Geoffs talk - > couldn't climb over > Si to get to DVD-R. Must get bigger van..... or a smaller Si ... ;-) mark

3 2

Re: [nznog] The Internet for n00bs
by Ewen McNeill 31 Jan '04

31 Jan '04

In message <1075610074.2007.305.camel(a)localhost>, Steve Withers writes: >On Sun, 2004-02-01 at 15:11, Anaru Hartley wrote: >> I kind of sense a "one track mind" approach to the >> issue at hand. There are plenty of alternatives, >> personally I don't think tightning the rope is going >> to help improve the Internet. The point was that some people (Dean cited his Nana as an example) really don't want to deal with all the complexity of keeping their system patched against the security hole du jour -- they just want an appliance that will let them talk to their grandchildren and maybe check a few details on their latest group's meetings. A 21st century telephone. The suggestion was then made (in a later talk) that the "only" solution to the mass of people who just wanted an applicance and were unwilling/unable to deal with the "dangerous" place that is the modern Internet, was an Internet-Lite -- the Internet for n00bs. The major part of its architecture was, essentially, a bunch of application proxies at the ISP with everything else firewalled off. The aim of this was to (dramatically) reduce the pool of reachable, unpatched, systems on the 'net. The current batch of worms to install open relays would be immunised against pretty much immediately for two reasons (couldn't reach open relays once established, couldn't reach remote hosts to infect them). >True. All you need is one ISP who offers "real" Internet....and everyone >would flock there. I know I would, if that was the choice. Yes, but you're l33t Steve. You'd flock there. Most people here would flock there. Much as I don't want to see "the Internet" become a dumbed down IntaWeb clone, I recognise that's just me ("when I want to be wrapped in cotton wool, I know where to find it"). There's a whole bunch of people, probably the majority by an order of magnitude, for whom the Internet, Large As Life, is scary, and intruding on their ability to just do the things they want to (eg, their machine keeps getting infected). So The Internet for n00bs will probably happen eventually. I just hope it isn't done in such a way that the only way to join the Real Internet (tm) is to qualify for your own ASN or by building tunnels through increasingly inappropriate application level protocols. A "walled garden" (to use the Citylink description of CafeNet) would be more appropriate -- with a way out for those that can figure out the gate, and a rule that they don't get to complain (or get out again) if they get run over by the traffic outside. Ewen

2 1

RE: [nznog] The Internet for n00bs
by Seton Wingfield 31 Jan '04

31 Jan '04

In my experience its never the people that find an exploit that end up causing the mayhem. If the flow of information from the exploit finders to the script kiddies could be stopped so would the majority of worms etc. I know this is old thinking but it seems like a easier option than firewalling off the Internet. I recently read the "Changes to Functionality in Microsoft Windows XP Service Pack 2" and in it, it states that the Internet Connection Firewall will be turned on by default. Changes like this and Microsoft's long term commitment to security via their "Trustworthy Computing" initiative may make the problems that you are trying to solve a thing of the past. http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6… http://www.microsoft.com/mscorp/innovation/twc/twc_whitepaper.asp The documents are MS Word format. -----Original Message----- From: Ewen McNeill [mailto:ewen(a)naos.co.nz] Sent: Sunday, 1 February 2004 11:17 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] The Internet for n00bs One of the things discussed at the (excellent, thanks everyone) NZNOG 2004 conference was that the Internet sucks, and that a large portion of this suckage is due to ignorant n00bs who do the wrong thing, get 0wned, etc. It was suggested that the "only" fix to this problem was to kill the end to end Internet, making the "Internet" a core exchange network (a la telco style), and allowing users only access to a local proxy at their ISP for a very limited set of services. Aside from my objection that this won't help much except in the short term (plenty of protocols already tunnel around such firewall limitations -- eg, look at everything that's been tunneled through HTTP), this really sucks for the l33t who find it awfully restrictive. An alternative approach to that type of thing is possibly just to heavily firewall -- at the ISP end of the link -- connections to all "potential n00b" users (SMTP to ISP mail server, POP/IMAP/HTTP/HTTPS to whereever and a few other common things) by default. And then provide an "opt out" system that anyone with a clue can use to disable the default firewalling. I would suggest: telnet ihaveaclue.$ISP where you have to enter "My name is $NAME, and I have a clue" (with $NAME expanded, but otherwise literally). Possibly that setting could be sticky; possibly it would need to be done on each reconnection.[0] The remaining aspect is that anyone who claimed to have a clue in this manner and then lets something on their connection get 0wned or otherwise abuses the privilege, (a) loses the ability to unblock themselves, and (b) gets their name published on a list of shame. This could pretty much be implemented today by anyone with a firewall (or customer facing ACLs) which can be set on a per-customer basis. Various RAS boxes have this sort of facility already; at least one ISP I know of firewalls accounts that are over due so they can reach the accounting website and that's about it. The alternative seems to be that the clueful will just tunnel everything through whatever still works. Tunnelling through DNS requests is painful but doable; tunnelling through most other things is almost tolerably efficient by comparision. And I guess bandwidth is cheap enough now that we can cope with a 20-50% overhead due to tunnelling.[1] Ewen [0] Anyone who can't automate doing it on each reconnection doesn't have a clue. [1] Still, it'll make the ATM tax look cheap. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Commerce Commission - bitstream etc.
by Simon Lyall 31 Jan '04

31 Jan '04

I was having a look though the documents here: http://www.comcom.govt.nz/telecommunications/localloop.cfm I was a bit disappointed at the lack of Local Loop access but there seemed to be some positive talk about the Bitstream service. However the last three pages (Appendix 5) of the Final Report Appendices basically define this as a 128up/256down service with VOIP, video and similar functionality specifically excluded. In other words Telecom will only have to open up a minimal level ADSL service slightly faster than Jetstart (with a recommended provisioning cost of $185 ) . I also see nothing about removing the requirement for all home customers with DSL to also have a voice phone line so I presume it's still in there which means that their be no option to replace home customer's main phone line with a VOIP system (like some people are doing in the US) or for people just to use their cellphones. Which overall looks like at least another couple of years of "more of the same" with respect to high speed Internet for most people. Or have I misinterpreted the recommendations? -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

9 18

For Spamassassin users fed up with AV notifications
by Juha Saarinen 29 Jan '04

29 Jan '04

Apropos the recent storm of AV notifications caused by MyDoom... found this gem on the Exim-users list: http://www.timj.co.uk/linux/bogus-virus-warnings.cf Put it in e.g. /etc/mail/spamassassin, restart SA, and it loads the file. -- Juha

1 0

RE: [nznog] Conference Videocast
by Chris Hellberg 29 Jan '04

29 Jan '04

I'm another watcher and thumbs up for the video quality! Lots of the interlude music seems to be in minor keys. It's almost as if it's funeral music to play for the foresaken networks :) ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

RE: [nznog] Credit card fraudsters......
by Stephen Andrew 29 Jan '04

29 Jan '04

On Friday, 30 January 2004 9:42 AM, Steve Withers <mailto:swithers(a)mmp.org.nz> wrote: > In my e-mail this morning, with a clickable button to take me to their > 'secure site': > > From: security(a)visa-security.com > > Dear Sir/Madam, [snip] A similar thing had an "honourable" mention in Bruce Schneier's CryptoGram this month. Nice pice of social engineering - the victim already believes there are unauthorised transactions on their card which are being dealt with by Visa and so doesn't chase them up when they appear on their statement. http://www.schneier.com/crypto-gram-0401.html#10 -- Andrew This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way.

1 0

Conference Videocast
by Tony McGregor 28 Jan '04

28 Jan '04

The good folks at CityLink will be multicasting the talks from the conference tomorrow and Friday. So if you can't be here, check out www.r2.co.nz. There are pictures from today's sessions on the conference page. www.nznog.org. Tony ---------------------------------------------------------------------------- Tony McGregor Mail: T.McGregor(a)cs.waikato.ac.nz Department of Computer Science Phone: +64 7 838 4651 Waikato University Fax: +64 7 858 5095(w) +64 7 825 5047(h) Private Bag 3105 Home: +64 7 825 5040 mobile: (021)313004 Hamilton, New Zealand www: http://www.cs.waikato.ac.nz/~tonym ----------------------------------------------------------------------------

7 9

Recent worm infestations
by Juha Saarinen 28 Jan '04

28 Jan '04

For those who haven't noticed the flood of emailed viruses and bounces caused by the dictionary attack the new Windows worm(s) create(s), read and weep: http://www.kaspersky.com/news.html?id=3614506 http://www.datafellows.com/v-descs/novarg.shtml Plus the usual AV sites. Looks like it's running amok in NZ. -- Juha

7 11

RE: [nznog] Conference Videocast
by Finnigan, Jamie (NZ - Wellington) 28 Jan '04

28 Jan '04

> We had 12 viewers a few minutes ago, but I'm not sure they weren't all > just Citylink staff wanting to see the light glinting off Carl's head > :-) I'm another .. but I'm only here for the fantastic music that gets played during intervals. :) Jamie -- CAUTION: This e-mail and any attachment(s) contains information that is both confidential and possibly legally privileged. No reader may make any use of its content unless that use is approved by Deloitte separately in writing. Any opinion, advice or information contained in this e-mail and any attachment(s) is to be treated as interim and provisional only and for the strictly limited purpose of the recipient as communicated to us. Neither the recipient nor any other person should act upon it without our separate written authorisation of reliance. Deloitte is a member firm of Deloitte Touche Tohmatsu. Deloitte Touche Tohmatsu is a Swiss Verein (association), and, as such, neither Deloitte Touche Tohmatsu nor any of its member firms has any liability for each other's acts or omissions. Each of the member firms is a separate and independent legal entity operating under the names "Deloitte," "Deloitte & Touche," "Deloitte Touche Tohmatsu," or other related names. Services are provided by the member firms and not by the Deloitte Touche Tohmatsu Verein. If you have received this message in error please notify us immediately and destroy this message. Thank you. Deloitte Internet: www.deloitte.co.nz

1 0