Yahoo outage summary

Sean Donelan sean at donelan.com
Mon Jul 9 02:26:20 UTC 2007


On Sun, 8 Jul 2007, Steven M. Bellovin wrote:
>>> Any clue about the root cause, i.e., malice or accident?
>>
>> Does it matter?  You are screwed either way.
>>
> It tells us what we need to do to prevent such things from happening in
> the future.  For example, most misconfigurations could be blocked if
> all routers matched prefixes against originating ASNs, and it doesn't
> matter much if the assertion is digitally signed or not -- all that
> matters is that the check is done against some authoritative database
> run, say, by the RIRs.  (No, that's not quite the right solution, but
> it serves to illustrate my point.)  That's completely inadequate
> against an attacker.

The bad guys will (almost) always say Oops, it was an accident while
being very clever at deliberatly bypassing every safety feature you
can design into a system.

The foolish guys will (almost) always say Oops, I didn't know while also 
being very clever at accidently bypassing every safety feature you can 
design into a system.

Unfortunately engineering can't rely on human intentions.  Both the evil 
and the foolish have the same result.  The hope is the foolish will give
up before bypassing the last step, so you keep adding more steps to stop 
the fool. The hope is the evilish will go after something easier before 
bypassing the last step, so you keep adding more steps to stop the evil 
(sic).

As always evil or foolish gals do the same thing as evil or foolish 
guys.

Its not just IP addresses that exhibit misrouting. But it only 
occassionaly effects the important or famous enough to attract attention.

http://blog.oregonlive.com/siliconforest/2007/06/rivalry_between_qwest_comcast.html



More information about the NANOG mailing list