Slashdot Mirror
SiteFinder: the Verisign Slides
Steve Loughran writes "It's been pretty quiet in public on the SiteFinder front, but it does
not mean that VeriSign are accepting defeat.
On October 15, the ICANN Security and Stability committee met to discuss it, as
can be seen from the long
transcript. The new item from this is a VeriSign
review of Site Finder,
which is very interesting." Loughran further analyzes the Verisign presentation, below.
Some key points:
- English-only responses only merits a 'moderate' response. I am sure the rest of the world thinks their language is only 'moderately' important.
- A lot of problems are viewed as minor, fixable with 'user education' or 'application patch'. I wonder if DNS patches were the application VeriSign expected us to patch?
- Apparently most spam doesnt forge sender domains; only 3-5%. So checking domain validity doesn't help much as an effective spam filter. A SpamAssassin representative commented that there are so few invalid domains in their corpus is that they get filtered earlier, so this data may be bogus.
- An acknowledged troublespot could be automated HTTP programs getting confused by the new responses, but they hadn't heard of that, and using HTTP over port 80 in this way by automated tool is discouraged according to BCP 56 .
- User studies liked it, but since the core finding was "there's more functionality than you get with a 404 so it's helpful for me", the study may have been flawed. Site Finder did nothing for 404 pages, only for unknown hosts.
- Most of the problems with services such as SMTP relate to misconfigured systems, and these did not show up with the small scale tests VeriSign tried.
I myself am most offended by the "we shouldn't be automating access over port 80" comment. Hello? VeriSign? What do you think Web Services are?
While Site Finder was up, I tested how SOAP stacks handled misconfigured addresses: the results are published on xml.com. Both SOAP stacks tested choked on the 302 response, giving errors to the clients that are nowhere near user intelligible. So VeriSign are making things harder, despite their apparent obliviousness or denials. I shall be sharing my data with VeriSign, and encourage anyone else to do the same."
WE can
YOU can
ICANN
Darn it, *what* am I going to do with a PowerPoint document? Can someone please post a conversion (possibly PDF?)
.doc, .ppt, .xls, and finally officially ban NYT links (every other site that requires registration *except* NYT is specifically disallowed).
I wish Slashdot would make a policy against
May we never see th
If folks want more reason to eliminate links to Microsoft's document formats other than the obvious reasons, how about this: Slashdot is a place where more people than any other are aware of macro viruses and the nasty disease vector produced by these formats (which are designed for *internal use only*, not distribution -- that's what PDF is for).
:-( Not good. Slashdot generally doesn't link to executables from oddball sources ("Here's a neat .exe I got from someone on IRC that claims to exhibit the problem my story is about!"), and that should really be extended to formats that can contain executable data.
I mean, can you imagine the impact if a link to a virus-infected macro Word document was posted on Slashdot's main page.
May we never see th
He's not the only one. For one thing there are privacy implications _outside_ the US.
Oddly Draconis
Too cynical to live, too stubborn to die.
PDF available here.
(posting anonymous - just say no to karma whoring)
Issue: Mistyped domain name in multiple command-line applications (ftp, telnet, etc.)
Behaviour Before SiteFinder: "host not found" error message.
Behaviour After SiteFinder: Different error message (TCP reset or ICMP port unreachable) or timeout depending on the application and the user interface
Judgment of Change: A change in expected behaviour.
Suggested Remedy if Applicable: User education
User education? What the hell type of user education are they expecting here? "Well Johnny, before when you got that TCP error you knew that what happened was that the service wasn't available on that host. Now you're going to have to check to make sure you really are accessing the correct host before making that assumption."
Verisign, there's plenty of offence intended in this next statement, so I sure hope you understand it: Fuck you.
in a human readable (Google HTML translation) here
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
I am sure that a lot of people will like Verisign's comments about handling traffic other than http.
Instead of returning a host not found, we will return another type of error (TCP reset for example) to the client application.
I know that some computer users know nothing about DNS, IP addresses, etc. But, who is there to say for sure that something will send a TCP reset? What if someone were to change it to now accept mail (using SMTP as an example)?
While it most likely won't happen, I can't trust these folks further than they can throw the person responsible for false renewal notices. I think the Verisign marketing departement takes the cake by coming up with the most destructive ideas to boost their bottom line.
From the article:
Issues more likely to occur with at least moderate impact & how addressed:
English-only web page
can be addressed by service operator
End-user error reporting
software update required
Spam filtering
filter update required
Automated HTTP tools
software update required
Resolvers with non-DNS fallback
software update required
Using DNS to check domain availability for registration purposes
software update required
Email delivery
most issues can be addressed by service operator
In other words, "Not our problem."
Your credit card information wants to be free.
Anyone know of any good (preferably Open-Source) burn-down-Verisign's-headquarters software? I'm interested in embedding it in all my future applications.
- The Amazina Llama
Anyone know of any good (preferably Open-Source) burn-down-Verisign's-headquarters software?
Use a scriptable HTTP client, such as Wget or Curl, to bombard http://sitefinder.verisign.com:80/ with valid requests. I wrote a short C program (no, I haven't had time to sit down with the llama book to learn Perl, and I needed a test case for my safe string library anyway) that does just this.
Will I retire or break 10K?
It only stands to reason that if you want to claim everybody loves your new service, and if everybody doesn't, you ought to have to show some legitimate reason for claiming they do.
'course, being a monopoly and all, well, I imagine they couldn't really care less...