Re: Survey on the impact of software regulation on DNS systems

2025-04-09 Thread Michael De Roover
Hi Peter, I really appreciate this discourse too. With what's happening in the 
world now 
and with this particular executive order affecting even something as niche as 
DNS, I like 
how it offers a vessel to have this public discussion.

On Tuesday, April 8, 2025 7:40:44 PM CEST Peter 'PMc' Much wrote:
> So what You are saying is, it might still work to just talk to these
> people?
> In earlier times that was usually my stance when discussing matters
> in the underground - I might say, why do we not just make a date and
> actually talk to the concerned people, as basically they're also
> humans, like you and me? And occasionally things did indeed work
> out pleasantly that way...
> 
> But given the development of recent years, I mostly lost my
> optimism. Like a fellow mystician put it:  up upside down> and it is difficult to cope with sheer madness - I
> even made it onto the death-list of some activists ---

This is something I've been thinking about a lot recently, and does deserve 
some nuance. 
In one of the events that I previously mentioned, it was FSFE inviting me over 
and the rest 
of the practical bits essentially just lining up. The choice to rent out a 
hotel floor in 
Brussels, was quite smart. This meant that, just as I could easily go there 
from Antwerp, 
the politicians could also quite easily go there from their offices in "de 
Wetstraat / Rue de 
la Loi" (the street where their offices are located) to what was Hotel Le Grand 
Central at 
Rue Beillard 190. Being just 1.5km apart, it could even be walked to. The rest 
is really just a 
matter of pinging the right people.

What it makes me think about in Europe right now though, is how much that 
proximity 
has affected my ability to be there. Or for that matter, how much being a 
Belgian resident - 
the host country of these administrative buildings - has affected my ability to 
reach out to 
these people in the correspondence about the Chips Act. Unlike the GitHub 
lobby, that was 
just me voicing my concerns in response to a press release.

The reason why this is significant to me, is that when I visit Portugal (which 
I often do), 
suddenly I am a lot further away from these administrative affairs. It feels a 
lot more 
distant, because it is. Rather than 50km, suddenly it's 2000. And that is 
reflected in the 
media as well. So if I were born Portuguese and not just stay there for a 
couple of years, 
would I have the same beliefs about Brussels? Would I have the same access? In 
an ideal 
world, of course I should, every EU citizen should. But would that be reality?

That is where I turn my gaze across the pond, and the various executive orders 
that have 
been ratified so far. Going back to what started this thread, that was one of 
them. The 
event called "Liberation Day" was another. In response to that, even the EU's 
executive 
branch themselves have attempted to enter dialogue, by undoing their 2% tariff 
to the US. 
And it was, unsurprisingly, met with more dismissal. From politicians to 
politicians, 
organizations that by all accords, should be on the same level. This was never 
about 
reciprocity. And not even just across the pond, even inside the US there are 
various 
concerned speeches from presidential figures like Bernie Sanders and Barack 
Obama now.

Obama's presentation, as published by Hamilton College:
https://www.youtube.com/watch?v=nU3E8r0n27w[1]

So what could be done about it in the US, that is rapidly heading towards a 
fascist 
dictatorship? For us Europeans, I think it's most important to acknowledge how 
fragile 
democracy really is, and how history taught us how important it is to be 
upheld. For 
Americans meanwhile, the precedent has been an attempted insurrection, an 
attempted 
assassination, blatantly ignoring the rule of law, and crashing the stock 
market. In 2020, 
the US has also gotten very close to a civil war. To merely call it a state of 
turmoil, would be 
a grave understatement. Its administration is a loose cannon, willing to burn 
every bridge 
made with every single ally across centuries. As an onlooker, it's an ongoing 
exercise to 
remember that the administration is not its people.

Meanwhile for organizations like ISC and the IETF, perhaps the expression of 
dissent by 
adopting primary/secondary was more than just "social justice" as what I 
opposed it for 
way back when. If that is one of the few ways that American people and 
organizations can 
still reach their government, that is praiseworthy. Better than a swasticar, 
that much is for 
sure. And for nonprofit organizations like ISC, it's even more genuine because 
the added 
work would've been a net liability. That is in stark contrast with for-profits, 
who may well 
only care about public perception to not harm sales. So for nonprofits to enact 
these 
things, that is truly admirable. Coming to terms with that, has been long 
overdue. I 
should've known better.

> ! > will be not far into the future that safety-critical mate

Re: Cannot import keys into dnssec-policy

2025-04-09 Thread Matthijs Mekking




On 4/9/25 02:29, Bagas Sanjaya wrote:

On Tue, Apr 08, 2025 at 07:38:44AM -0500, Matthijs Mekking wrote:

This time I was able to reproduce, thanks.

The reason why the key created by dnssec-keygen is retired because named
thinks it was in use already. When there is key timing metadata, the key is
considered to be in use (now or in the past).

Only not previously used keys are considered as a successor in key
rollovers.

Try generating the key with dnssec-keygen -G. This will create a key without
setting timing metadata.


Indeed it solves the problem. Thanks!



I will update the documentation accordingly.


Both in KB and dnssec guide in BIND ARM?


Yes
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


BIND 9.11.4-P1 unexpected process exit

2025-04-09 Thread Duleep Thilakarathne
Hi,

Bind service unexpectedly exited a few days back with the following error:
Could someone possibly suggest some more troubleshooting? This service has
run for more than a year without issue.

dispatch.c:3422: REQUIRE(resp->item_out == isc_boolean_true) failed, back
trace
#0 0x438bed in ??
#1 0x7f2954ab3ada in ??
#2 0x7f2955d296dd in ??
#3 0x7f2955df43c8 in ??
#4 0x7f2954ad9c4b in ??
#5 0x7f2954471e25 in ??
#6 0x7f295419bbad in ??
exiting (due to assertion failure)

Regards
DT
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: BIND 9.11.4-P1 unexpected process exit

2025-04-09 Thread Mark Andrews
This was fixed roughly 6 years ago in a later version of BIND 9.11 which has
since been EoL’d.  Upgrade to a supported version.

> On 9 Apr 2025, at 23:22, Duleep Thilakarathne  wrote:
> 
> Hi,
> 
> Bind service unexpectedly exited a few days back with the following error: 
> Could someone possibly suggest some more troubleshooting? This service has 
> run for more than a year without issue. 
> 
> dispatch.c:3422: REQUIRE(resp->item_out == isc_boolean_true) failed, back 
> trace
> #0 0x438bed in ??
> #1 0x7f2954ab3ada in ??
> #2 0x7f2955d296dd in ??
> #3 0x7f2955df43c8 in ??
> #4 0x7f2954ad9c4b in ??
> #5 0x7f2954471e25 in ??
> #6 0x7f295419bbad in ??
> exiting (due to assertion failure)
> 
> Regards
> DT
> -- 
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
> this list
> 
> ISC funds the development of this software with paid support subscriptions. 
> Contact us at https://www.isc.org/contact/ for more information.
> 
> 
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742  INTERNET: ma...@isc.org

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: Cannot import keys into dnssec-policy

2025-04-09 Thread Bagas Sanjaya
On Tue, Apr 08, 2025 at 07:38:44AM -0500, Matthijs Mekking wrote:
> This time I was able to reproduce, thanks.
> 
> The reason why the key created by dnssec-keygen is retired because named
> thinks it was in use already. When there is key timing metadata, the key is
> considered to be in use (now or in the past).
> 
> Only not previously used keys are considered as a successor in key
> rollovers.
> 
> Try generating the key with dnssec-keygen -G. This will create a key without
> setting timing metadata.

Indeed it solves the problem. Thanks!

> 
> I will update the documentation accordingly.

Both in KB and dnssec guide in BIND ARM?

-- 
An old man doll... just what I always wanted! - Clara


signature.asc
Description: PGP signature
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users