danyork

Has anyone here tried this?

They had me interested... right up until they talked about using proprietary protocols. That concerns me.

I'd note that Michael Kende left his position at the Internet Society in May 2016. (I work at ISOC.)

The good news is that Amazon has been slowly rolling out IPv6 support across various AWS services (ex. S3, CloudFront). Once they support IPv6 on EC2, though, that will be the big breakthrough!

I would also appreciate a sanity-check from any Windows users who can confirm the "nslookup" syntax that is equivalent to `dig ns <domainname>`. I haven't used nslookup in many years and I don't have any Windows boxes around. I believe it should be:

nslookup -type=NS <domainname>

(in the non-interactive mode of nslookup). Do I have that right?

This is my own article I'm submitting. I would be very interested in any feedback on the points I raise from HN readers. I'll note that a discussion here ( https://news.ycombinator.com/item?id=12772993 ) helped in some of my thinking around the topic.

Thanks in advance.

Thank you all for the comments. They were very helpful in feeding into this article I wrote on the topic:

https://www.internetsociety.org/blog/tech-matters/2016/10/ho...

Thank you!

Thanks. Yes, as you say, it's obvious now... but when you consider that each of those DNS providers has their own globally distributed network involved many servers (via anycast), you can understand why people think that one provider is enough.

Thanks. Someone else pointed out to me that some of the advanced features offered by DNS providers, particularly around geographic redirection, is something that is not standardized between providers and so can't be easily duplicated. I can see that - and understand why it would cause you to use only one provider if that was a service you found of value.

I remember hearing about this project quite some time ago. I am not sure it is still active. The last papers about the project are from 2006 - https://www.cs.cornell.edu/people/egs/beehive/paper.php

There's a bit of exquisite irony in the fact that just yesterday an article on the Dyn blog was:

Recent IoT-based Attacks: What Is the Impact On Managed DNS Operators? - http://hub.dyn.com/traffic-management/recent-iot-based-attac...

It's a good piece about how IoT-based DDoS attacks are carried out. And now Dyn has the answer...

HN thread about that article at: https://news.ycombinator.com/item?id=12764650

Other HN threads on related articles:

Krebs on Security: https://news.ycombinator.com/item?id=12761859

NY Times: https://news.ycombinator.com/item?id=12765652

Bloomberg: https://news.ycombinator.com/item?id=12763501

Dyn: https://news.ycombinator.com/item?id=12764650

Well, Krebs sees this as an extension of the attacks that took down his site a few weeks ago after he wrote about this research. So he wrote about it, attackers take down his site. His co-author Doug Madory speaks about it, attackers take down Madory's employer's site.

Krebs indicates in an update at the end that a source had heard rumors in criminal channels that an attack against Dyn was being planned.

Doug Madory's presentation was on the agenda for NANOG and so attackers would have had plenty of time to know about it.

Journalist and security researcher Brian Krebs believes this is someone doing a DDoS as payback for research into questionable "DDoS mitigation services" that he and Dyn's Doug Madory did. Doug just presented his results yesterday at NANOG and Krebs believes this is payback. Read more: https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twit...

Well, there's pretty much no way to impose the geographic borders of the US onto the Internet. Our networks here in the US are all global and integrated with other networks all around the world. The only places where this kind of geographic control is possible are countries like Iraq, Iran, China and others where the government controls all the ISPs. Countries with more freedom have a free flow of information and packets - and to me that is a very GOOD thing.

We don't know yet, but the attack very easily could have been coming from a botnet of devices entirely inside the US. Geographic borders don't matter much at all for the Internet.

Yes, I think this attack has brought to everyone's attention that many companies have gone away from what used to be the extremely common practice of having your authoritative DNS serving shared across multiple DNS hosting providers. This would have addressed the issue... and we're seeing that by the end of the day many of these sites have gone to having multiple providers.

Agree with shortstuffsushi that this is just someone getting your domain name info and spamming you. It sadly happens all the time.

Go to http://whois.icann.org/en and enter your domain name and see what info is public about you. If all your info is public, you may want to see if your registrar offers "private" registration where your info does not appear in WHOIS.

https://cloudharmony.com/status-for-dyn is now (12:43pm EDT) showing Dyn's "US East" and "US West" centers as being down. Anyone know anything about this Cloudharmony service? How often does it update? and what is it monitoring?

Many articles are now coming out about this outage this morning: http://www.techmeme.com/161021/p3#a161021p3

Yes, having to put two stacks into constrained devices is certainly challenging. In the ideal world we'd either: 1. Jump ahead to a IPv6-only world and just support one stack; or 2. Increase the memory in devices to allow two stacks. (But of course with more memory comes more cost.)

This is excellent news! Now we have all the major browser vendors committing to include WebRTC. I look forward to seeing this get implemented and deployed.

But, sadly, the Guardian's business model is based around advertising and so they need the eyeballs... so to get the eyeballs on quick approach is to write the click-bait headlines. :-(

As noted by stronglikedan, the process to comment on an RFC is to send email to the author of the RFC, or alternatively, to the email list for the IETF Working Group from which the RFC came.

In this case, that would be the general Apps Area Working Group ( https://datatracker.ietf.org/wg/appsawg/charter/ ) and so comments could be sent to that list. Although sending to the author is probably the best initial route.

If the author receives enough comments to justify a new version, the process would then begin to publish a new version that would then obsolete the older version.

I would note that this particular document (the original RFC 7763 that is the origin for this HN thread) started discussion back in July 2014 with https://tools.ietf.org/html/draft-seantek-text-markdown-medi... and evolved over time until this publication now.

Correct, the author of the Internet-Draft is the one to contact.

The draft is written by a Time Warner Cable employee, Lee Howard. Lee has been an outspoken advocate for IPv6 for many years and has been very involved with TWC's rollout of IPv6. (I am a TWC customer and did get IPv6 in Keene, NH, about 2 years ago.)

RCS is the legacy telcos ongoing attempt to try to somehow get into the messaging game that all of the Internet-based communications app are doing (WhatsApp, FB Messenger, Line, Kik, Skype, iMessage, etc.).

Basically, they'd like all their SMS revenue back!

Dean Bubley had a great analysis - "Google + GSMA announcement on RCS is no gamechanger" : http://disruptivewireless.blogspot.co.uk/2016/02/google-gsma...

Awesome chart! While you are updating it, you may also want to reflect that Microsoft changed "Lync" to be called "Skype for Business" in April 2015 - https://technet.microsoft.com/en-us/library/dn913785.aspx http://blogs.technet.com/b/scottstu/archive/2015/04/13/contr...

As far as I know "Skype for Business" is still using Lync's protocols, so your line would still be accurate.

Great to see this support added to the GNU C Library. Thanks for sharing the link!

The article is from April 2015 but still a good one to see out there. More developer articles about DNSSEC like this one would be good to see.