Re: SA Internet security issues

On Wed, 5 Jul 2017 10:06:06 +0200
Nishal Goburdhan <[email protected]> wrote:
<snip> 
> not quite;  you can also use your ISP’s DNS servers, or, run your own.
> > however it's easy to spoof or hijack queries from there as well.  
> yes, considerably easier, than if you used your ISP, whom you,
> presumably trust.
> 
i cannot say that I have any trust in some of the major South African ISP's. 

without publicly shaming anyone (as it is not in my personal best
interest at this time), there can be more of an effort to actually
patch maintain and offer better service levels.

I mostly recommend my friends, family to use Google public DNS. 

The Google public dns does have it's issues, but are more trustworthy
than some of the south african 'service' offerings.


> 
> >   Also I have a feeling Ipv6 is also going to become a problem.
> >   Especially in terms of routing, the primaries for za do not all
> > route locally,  
> that’s a broad statement, with little evidence.  from a pretty well
> connnected, dual-stacked host in JNB, i see: nishal@jnb:~$ dig

like you, i also do not have any current evidence of issues with za
primaries, the most i have seen is literally ms, but this does not mean
that i do not share the feeling that it may be a problem sometime in the future.

as is quite clear, i am paranoid, and my tinfoil hat has saved my bacon
a few times, for example with the ipv6 linux kernel exploit of some
weeks ago, as i had a 'feeling' about that, and i was not vulnerable..
speaking of which... many people lose things that they do not even know
they have lost. i guess ignorance is bliss, lets hope that the things i
have lost, those play well with me, even if they mistakenly assume my
ignorance. i do not like to repay favors, but i do tho (and with interest)


> +nssearch za | awk -F ' ' '{print $11, $12, $13, $14}' 194.146.106.78
> in 0 ms. 204.61.216.55 in 1 ms.
> 2001:67c:1010:19::53 in 1 ms.
> 2001:500:14:6055:ad::1 in 1 ms.
> 196.4.160.27 in 3 ms.
> 2001:4200:ffff:a::1 in 17 ms.
> 196.21.79.50 in 17 ms.
> 2001:500:2e::1 in 170 ms.
> 192.5.4.1 in 179 ms.
> 
> for good measure, i also pasted in the results from a host in CPT
> below [2]. all of this tells me that 1 host isn’t dual stacked
> (naughty 3741 !), and one host is likely hosted out of ZA.  i don’t
> see any of the IPv6 problems you allude to. since there is no
> requirement to have all secondaries inside your country, and i
> recognise three of those hosts as anycast, i’ll ask again - what IPv6
> problem are you seeing, and are you sure it’s not just from your
> perspective? 
> 
> —n.
> 
> [2]  nishal@cpt:~$ dig +nssearch za | awk -F ' ' '{print $11, $12,
> $13, $14}' 196.21.79.50 in 0 ms.
> 204.61.216.55 in 7 ms.
> 2001:500:14:6055:ad::1 in 7 ms.
> 194.146.106.78 in 16 ms.
> 2001:67c:1010:19::53 in 16 ms.
> 196.4.160.27 in 17 ms.
> 2001:4200:ffff:a::1 in 32 ms.
> 2001:500:2e::1 in 156 ms.
> 192.5.4.1 in 282 ms.
> 

_______________________________________________
IOZ mailing list
[email protected]
http://lists.internet.org.za/mailman/listinfo/ioz