Posts by -v(o.o)v-

India to cripple its tech sector with proposed encryption crackdown

RIM/Blackberry bent over for India's previous job. Why would they not again?

IETF doc proposes fix to stop descent into data centre 'address hell'

FDB means forwarding database

Wait, what? TrueCrypt 'decrypted' by FBI to nail doc-stealing sysadmin

As per NSA: go around the crypto, my guess is they either found the password hardcopy or they found the "rescue" disk.

Congratulations! You survived the leap secondocalypse

Re: All is not well, though

Everyone knows what Poettering is like. But it is a new low. Does Debian's systemd still use Google DNS even though several people complain about it?

Cisco in single SSH key security stuff-up

Re: Suggestion

One obvious benefit (coming from ISP/IXP world here) for Cisco is that it is easy to hire people who can manage it. And when the tech team grows that is very important.

Secure web? That'll cost you, thanks to Mozilla's HTTPS plan

Re: Bring up DANE

Agreed.

DANE is indeed the solution but it is not getting client support. Chrome had it in a test build once. Wonder why - vested commercial interests?

What the BLEEP? BitTorrent's secure messaging app arrives

Just what the world needs: another closed source chat app with closed spec and not interoperable. No thanks, I won't be installing yet another chat app.

HGST says its NVMe flash card will manage 750,000 IOPS

Re: Very cool

Not really. SLOG is very small in size and is better served with RAM based products not NAND flash. L2ARC requires some system RAM for structures and to effectively use such large L2ARC would need tons of it. Not a cost-effective product for ZFS caching IMO.

Troubleshooting feature on Cisco routers is open to data-slurp abuse

Most ridiculous "research" in field of IT security in a while, if Reg's summary is correct. Like above posters had said, what about tcpdump in *nix, pcap in all systems etc.

It is really laughable and puts the whole "cconference" where it was presented in bad light.

Re: Cable pr0n?

Cisco 7609-S with top bezel removed, dual RSP-720.

Finally, Mozilla looks at moving away from 'insecure' HTTP. Maybe

Re: Thawte et al, hand-rubbing

I've said it before and I'll say it again:

We *must* have push for client support for DANE, TLSA records in DNSSEC. That will solve a whole heap of problems including deprecating the sloppy CA system.

Hawk like an Egyptian: Google is HOPPING MAD over fake SSL certs

HTTP public key pinning (HPKP) could help, unless the "DPI box" would strip the header.

Insert 'Skeleton Key', unlock Microsoft Active Directory. Simples – hackers

Re: domain controller is restarted

You can argue on semantics (and downvote) but each of the FSMO roles can run on only one DC per forest/domain (some are per forest some per domain) as you clearly know.

My reply was about the "only one DC" which clearly was not true in the case of Ops Masters. Of course they should be transferred out before boot but the OP did not mention it.

Re: domain controller is restarted

"There are no functions that either one can't do on its own or you can live without for the time for a reboot."

Untrue. FSMO roles run on only one DC. In large enough domain/forest they become important enough that they cannot be restarted just like that.

Demon Internet goes TITSUP: Outage borks ancient ISP

Localisation of issues

"According to Demon, engineers have localised the issue"

Me? I always localise issues to Burmese. 'Cause I'm cool like that. Sometimes I even locate issues if I feel like fixing stuff.

That 8TB Seagate MONSTER? It's HERE... (You'll have to squint, 'cos there are no specs)

Re: Now you can lose 8TB of data in one shot instead of just 4!

But these cheap SSDs will only last a while when written to heavily so they are suitable only for home use.

Look, no client! Not quite: the long road to a webbified Vim

With today's complex dynamic websites I do not see a browser becoming a Web server (with PHP, rails or even more complex languages) and a database server so that you could just point it to a directory.

But one can dream, yes.

Time to ditch HTTP – govt malware injection kit thrust into spotlight

DANE is the solution

In my opinion DANE/TLSA records in DNSSEC signed zones would be the answer.

Self-sign the cert but put cert thumbprint in DNS - browser verifies the cert from HTTPS matches what is in TLSA. Would also work against dodgy CAs and loading own CA-certs as is done by enterprises using SSL decryption systems.

Uptake of this has been glacially slow. I do wonder why......

The internet just BROKE under its own weight – we explain how

Luckily there are systems out there doing NAT66 for those that need it even though it is not "pretty".

Canadian ISP Shaw falls over with 'routing' sickness

Re: BGP

No.

Several routers have FIB capacity of 512k routes as either hard limit or configurable limit where memory from other types (IPv6, VPNv4/6) can be reduced and given to IPv4. TCAM is expensive so lower end routers like 3B/3C non-XL models of Cisco 7600 PFC are at capacity.

Indie ISP to Netflix: Give it a rest about 'net neutrality' – and get your checkbook out

Re: wireless

Last mile in the US is a disgrace, according to many well-known Americans in the industry. See any of the numerous threads on N---G mailing list for example.

Re: That's rather interesting

Ok, I'll try. I work at a very small ISP around the world but try to follow what is happening in the West.

Big problems with the U.S. Netflix situation are geographical and "telco-political" (yeah I made that up, deal with it). Very large country, largely sparsely populated where these micro/nano-ISPs (often wireless/WISP) provide only viable service that could described as "approaching broadband". Other option would be the incumbent and bad DSL over bad copper, often at ridiculous prices. To someone not from US it may seem unbelievable that even in middle of urban area, say Silicon Valley, there might be only one provider who can service you with residential fibre or high-speed cable.

The other issue is importance of private peering over Internet Exchanges. In Europe large amount of interconnection between providers is done at IXPs. At US there are very few IXPs and providers have their own private peering arrangements. Add to this the geographical/competetive situation and politics of peering by the big (at least a local monopoly really) players and what is left is the 1000 mile dark fibre from the rural WISP to Netflix.

FRIKKIN' LASERS could REPLACE fibre-optic comms cables

Re: Actually light doesn't "bounce off" the edges of a fibre optic cable....

Multi-mode fibre does "bounce" the light around whereas single mode fibre acts as you had described. MMF is still widely used in data centres (with SR optics) though many people has realized that for green-field it makes sense to go all-SMF (LR equivalent optics on-premises and shorter distances outside; ER, ZR etc. for long-haul).

Apple gets patent for WRIST-PUTER: iTime for a smartwatch

Re: I don't get the moaning

You seem to have mistaken that a US patent is a simple thing to do. It is not.

THUD! WD plonks down SIX TERABYTE 'consumer NAS' fatboy

Re: Bays

Good question - here, have an upvote. I would also be interested in knowing the answer.

Re: Fuck me with a broomstick backwards

Linux sw RAID makes me want to start rack the wrecks, my nerves are so racked (48 U high ones baby!)

Re: Are you implying...

Very large part of the high cost is caused by the very high cost of licensing per port. Which is one of the reasons why there is the "new" 25Gb consortium (see recent Reg article).

Re: Are you implying...

It should be noted that Link aggregation (LAG, Portchannel, etc.) does not usually increase speed between two hosts because the decision on which bundle member is used is usually based on hash of L3 (IP) or L2 (MAC, not good in routed network) addresses of the peers. So it would generally be beneficial only when multiple clients are transferring data at the same time. And of course for redundancy.

You did not say you expect this but I see often the misconception that a single client would get faster speed with a LAG so I wanted to make it clear.

There are other ways to load-balance such as round-robin but those are usually not used because it may cause packets arriving out of order. I am not sure if that happens often on a simple network with a single switch but I'd still avoid it.

The final score: Gramophones 1 – Glassholes 0

Bravo Dabbsy

Well done, sir. Invoking the immortal BR quote was the cherry on the top.

Point DNS blitzed by mystery DDoS assault

Such attacks against authoritative DNS servers may be mitigated quite successfully with anycasted servers and Response Rate Limiting.

Sounds like the victim did not use them. At least RRL is very easy to configure and cheap so there is no excuse to not use it. Anycast at scale may be cost-prohibitive for small shops.

Red Hat to ship RHEL 7 release candidate with a taste of container tech

Re: Centos?

Could be many months. CentOS 6 was way behind but I recall 6 had a lot of problems. In any case it will be several weeks to couple months.

Running OpenSSL? Patch now to fix CRITICAL bug

Honest mistake, surely - right? I'll go get more tin foil.

Helpdesk/Service Desk Recommendations

RT or OTRS

Indosat fat-thumbs route announcements (again)

Those should have been caught by prefix count limits at Indosat BGP peers early on. Guess they did not configure such limits. Not sure who to blame more - Indosat for a mistake or the peers for negligently accepting.

Custom ringback tones: Coming to your next contract mobe?

This has been available (and very popular) on all carriers in certain south-east asian countries for years.