Re: Debian + Verisign's .com/.net hijack

[Arthur de Jong <arthur@tiefighter.et.tudelft.nl>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> While the "first generation" patches work with hardcoded values, there
> are others that are much more general. Check the link of the ISC patch
> for a description:
>
>   http://www.isc.org/products/BIND/delegation-only.html

This will only work for a little while as a colleague of mine noted. This
will block
  *   IN   A   64.94.110.11
but not
  *   IN   NS  64.94.110.11
which is a valid delegation. The 64.94.110.11 nameserver should then only
return 64.94.110.11 for all requests for A records.

- -- arthur - arthur@tiefighter.et.tudelft.nl - http://tiefighter.et.tudelft.nl/~arthur --
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)

iD8DBQE/aE23VYan35+NCKcRAsu1AKDTcrzQ664BAeERJjQ0gM/g/XEkdwCgrL7Z
0QCNqEsJooAzYP5oNtraSmU=
=4xx8
-----END PGP SIGNATURE-----