New Nominet drop catching flaw revealed?

[davedevelopment]

In case anyone doesn't follow the blog... https://www.greywing.uk/the-blog/new-nominet-drop-catching-flaw-revealed

 

[Murray]

Is this what @Hay discovered?

 

[foz]

Burdensome flaw on the registry. Must get hammered.

 

[davedevelopment]

Just confirmed it myself, my existing IPs (different data centres) all share the same limits, I added a new IP at another data centre and seemed to get a fresh set.

Server A (existing): #usage,C,60,304,86400,309753
Server B (existing): #usage,C,60,304,86400,309653
Server C (new): #usage,C,60,1,86400,1

 

[Fred Steven]

So would this flaw also allow simultaneous dac sockets from different IP addresses each with its own allowance

 

[lazarus]

This one must have been around since the start? How lame is that, for a "World Leading" cyber security outfit.

 

[foz]

This one must have been around since the start? How lame is that, for a "World Leading" cyber security outfit.

Lame indeed. They're going to be in for one hell of shock (heavy demand) moving forward

 

[super-whois]

https://twitter.com/peterblackwales/status/1288707043214471168

"I once went to a presentation at the nominet HQ in Oxford and they couldnt get the powerpoint to work"

Sums it up nicely.

 

[ukbackorder]

I brought this to their attention on the 25th May, 28th May, 9th June, 17th June, 24th June and on 17th July they confirmed that using it would breach their AUP. So they are aware but as they didn't fix it in 2 maintenances they probably don't care. I'm not getting dragged into a discussion here so just letting you know how they perceive it. Originally it worked by repeatedly disconnecting/reconnecting from the same server. I assumed it had been in use for a long time before I found it and told them. They attempted a 'patch' which stopped that but now allows some (doesn't work on all servers) to get two different quotas on IP4 and IP6 on the same server. I haven't seen it work on more than 2 quotas even over different datacenters - I guess it totals up IP4 and IP6 separately. However there may be even more flaws. But in the past 2 months with initially daily lengthy discussions, about problems and solutions, with nominet they haven't done anything. Why is that... could it be they don't care because they're going to an auction system soon?

 

[lazarus]

Kudos to Greywing! for bringing it to light.

 

[Edwin]

Shockingly simple flaw. Truly shameful.

In case anyone fancies it...
https://www.theregister.com/about/company/contact/

 

[super-whois]

I haven't seen it work on more than 2 quotas even over different datacenters - I guess it totals up IP4 and IP6 separately.

Sounds like it might be two load balanced servers, that keep separate usage counts.

 

[Hay]

i reported this to Nominet weeks back, initially, you didn't need ipv6... There was a rouge server active in the cluster therefore due to a round-robin config on their LB's... all you needed to do was reconnect 4-5 times to land on the rouge server which would give you double quota.. and when you team this with TDDac you had 4 x the quota... I reported that to them and they fixed it but appear to have broken ipv6 in doing so... i also reported the IPV6 issue to them about a week or so ago so who knows why its been left in tact.

 

[3gmedia]

I wondered why I couldn't those great names.

 

[Nigel]

If nominet's own staff can't sort this then they need to contract it out. They should call off the consultation and focus on providing a fair and flaw free drop system. They clearly haven't got the level of expertise required, or the will power to sort it. If they want a consultation it should be one on their pay and bonuses which have rocketed in the past 6 years, whilst they trashed the .uk namespace, and provided an inadequate and unfair service to their members.

 

[Murray]

All that talk on the other thread about how can you prove anyone is cheating, well this seems fairly straight forward and easy lol

Not that I would say this is cheating so much as exploiting a flaw

 

[super-whois]

Not that I would say this is cheating

So you believe that exceeding the limit set out in the DAC Contract isn't cheating?

 

[aZooZa]

Bring back Jay Daley.

 

[Murray]

So you believe that exceeding the limit set out in the DAC Contract isn't cheating?

If Nominet are giving you more quota than they should I can't blame anyone for using it

 

[davedevelopment]

Not sure how I feel about using it. Someone mentioned nominet saying that anyone exploiting it would be contravening the AUP, but perhaps if that were the case, nominet should have announced something for all to see.