Nostr notes by

📅 Original date posted:2014-05-19 📝 Original message:It ...

2023-06-07T17:21:26+02:00

In reply to nevent1q…4ztf
_________________________

📅 Original date posted:2014-05-19
📝 Original message:It should be possible to configure bind as a DNS forwarder.. this can
be done in a zone context.. then you can forward the different zones to
different dnsseed daemons running on different non-public IPs or two
different ports on the same IP (or on one single non-public IP since
there's really no reason to expose the dnsseed directly daemon at all).

Rob

On Mon, 19 May 2014 21:14:32 +0100, Alex Kotenko wrote:
> Hmm, Ive mostly setup whats promised, testing DNS seeds now. There is
> one problem I see that I cant really solve myself.
> This dnsseed daemon cannot serve more than one name at once, which
> means that I cannot serve testnet and mainnet seeds off one daemon
> instance which means I need to buy two IP addresses for it. Thats
> unfortunate as it needs much more spendings from me to operate,
> second
> IP address will cost nearly as much as the server itself.
>
> Can anybody help with this? I cannot into C++ to fix that myself.
>
>
> Best regards,
>
> Alex Kotenko
>
> 2014-05-17 13:39 GMT+01:00 Andreas Schildbach :
>
>> On 05/17/2014 02:02 PM, Alex Kotenko wrote:
>>
>> > So, my understanding is that atm we have no working DNS seeds at
>> the
>> > testnet3, right? There are two DNS seeds known, of which one is
>> > unreachable atm, and another one is giving just one IP address,
>> which is
>> > also a dead node.
>>
>> Yes, thats my understanding too.
>>
>> > If Ill start a DNS seed of my own and make sure it works well,
>> will
>> > this help?
>>
>> Yes, definately.
>>
>> > Ive found this DNS seeder daemon
>> > , and it seems to be exactly
>>
>>> what I need to run a DNS seeder myself.
>>
>> Afaik this is what most of the other seeds are using, yes.
>>
>> > So if my understanding is correct, Ill setup a DNS seeds for
>> mainnet
>> > and for testnet at bitcoin-seed.alexykot.me [2]
>> > and testnet-seed.alexykot.me [4]
>> > , and also a well connected nodes for
>>
>>> mainnet and testnet on the same server.
>> > Is this a good plan? Will this all help?
>>
>> Sound great! Let me know if youve got something to test.
>>
>>
>
> ------------------------------------------------------------------------------
>> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For
>> FREE
>> Instantly run your Selenium tests across 300+ browser/OS combos.
>> Get unparalleled scalability from the best Selenium testing
>> platform available
>> Simple to use. Nothing to install. Get started now for free."
>> http://p.sf.net/sfu/SauceLabs [6]
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development at lists.sourceforge.net [7]
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>> [8]
>
>
>
> Links:
> ------
> [1] https://github.com/sipa/bitcoin-seeder
> [2] http://bitcoin-seed.alexykot.me
> [3] http://bitcoin-seed.alexykot.me
> [4] http://testnet-seed.alexykot.me
> [5] http://testnet-seed.alexykot.me
> [6] http://p.sf.net/sfu/SauceLabs
> [7] mailto:Bitcoin-development at lists.sourceforge.net
> [8] https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> [9] mailto:andreas at schildbach.de

📅 Original date posted:2014-05-19 📝 Original message:On ...

2023-06-07T17:21:26+02:00

In reply to nevent1q…zs7e
_________________________

📅 Original date posted:2014-05-19
📝 Original message:On Mon, 19 May 2014 19:49:52 -0400, Jeff Garzik wrote:
> On Mon, May 19, 2014 at 4:36 PM, Robert McKay <robert at mckay.com>
> wrote:
>> It should be possible to configure bind as a DNS forwarder.. this
>> can
>> be done in a zone context.. then you can forward the different zones
>> to
>> different dnsseed daemons running on different non-public IPs or two
>> different ports on the same IP (or on one single non-public IP since
>> there's really no reason to expose the dnsseed directly daemon at
>> all).
>
> Quite the opposite. dnsseed data rotates through a lot of addresses
> if available. Using the bind/zone-xfer system would result in fewer
> total addresses going through to the clients, thanks to the addition
> of caching levels that the bind/zone-xfer system brings.
>
> That said, if the choice is between no-service and bind, bind it is
> ;p

Setting it up as a zone forwarder causes each request to go through to
the dnsseed backend for each request.

Rob

📅 Original date posted:2013-12-08 📝 Original message:On ...

2023-06-07T17:10:32+02:00

In reply to nevent1q…kfzt
_________________________

📅 Original date posted:2013-12-08
📝 Original message:On Sun, 8 Dec 2013 13:14:44 -0800, Gregory Maxwell wrote:
> On Sun, Dec 8, 2013 at 1:07 PM, Drak <drak at zikula.org> wrote:
>> Simple verification relies on being able to answer the email sent to
>> the
>> person in the whois records, or standard admin/webmaster@ addresses
>> to prove
>> ownership of the domain
>
> Godaddy and many other CA's are verified from nothing other than a
> http fetch, no email involved.

It's just as easy to steal emails via a BGP or DNS redirect anyway..
you could even take over the actual domain at the registry level by
stealing a password reset via BGP or DNS redirect and actually many
registries will hand over control of a domain by faxing them a forged
driving license in the owner's name anyway so it doesn't even really
need to be a particularly sophisticated attacker. Once you have registry
control of the domain it's easy enough to get an SSL cert too, probably
even an 'extended validation' one.

When Afghanistan was taken over the entire .af TLD was probably
transferred using a forged fax to ICANN
(http://web.archive.org/web/20041017031020/http://www.iana.org/cctld/af/razeeq-letter-13aug02.pdf)
but I guess that's a little different :p

Rob