Re: Obviously...
UberX?
1664 publicly visible posts • joined 7 Mar 2018
in the early days, before CIDR, addresses where handed out in classful allocations
https://en.wikipedia.org/wiki/Classful_network#Background
it was a time when they assumed at most there would be a few thousand large institutions that needed to connect their computers.
the notion that everyone wold want let alone need a connected computer in their home was far fetched.
if you where a large institution you'd get a /8, a small institution would get a /24.
NAT was not a thing.
they could not envisage at the time how we would use these things.
do it
you won't get very far, its an rfc 1918 address, 10/8 can't be routed to across the internet which is why RFC 1918 addresses are used on consumer LAN's it doesn't matter that customers overlap rfc 1918 addresses as they need to be outbound NAT'd to reach a public internet address.
the network is like a road,
roads have existed for thousands of years.
some modern roads follow the same paths as old roman roads.
yet you can drive your horse & cart, old banger or modern electric or hyper car along them.
yes its got better surface on it today etc but still goes from a to b.
trainlines on the other hand, not so versatile as a road. you can run different generations of rail vehicles on them but they are highly regulated and the vehicles have to strictly adhere to the regulations.
icloud private relay user on virgin media here.
google is constantly throwing CAPTCHA's at me & quoting the icloud cloudflare ipv6 address i'm using.
just ironic that cloudflare tout ipv6 as a solution when i'm obviously being NAT'd by icloud/cloudflare to an IPv6 that google reputation engine has doubts about.
easy to block a single IPv4 or a subent allocated to a carrier, IPv6 address space is so vast that they typically dish out a /64 the whole of which would need blocking if not the entire subents allocated to the SP's.
Point being that the blast radius for IPv6 is far larger than IPv4 -literally in terms of total addresses that are on the naughty list.
The answer in those pa examples is to not expose the management interfaces to the internet.
If you do need to then at least restrict it to a small tiny range of IP’s that you control.
If they are open to all then expect them to be probed by aliens !!! Who may just decide to attack
The dominant player has more kit out there at varying levels of patching & is just statistically more likely to have vulnerabilities found.
Doesn’t mean that its vulnerabilities in that kit that causes miscreants to access the secure database running on Fujitsu hardware running Broadcom hyper visor running ibm os running oracle software that tunnels back to a 3rd party over https which the traffic is switched, routed, firewalled & otherwise secured by via Cisco equipment.
"We think the takeaway is clear:
No it’s not clear
Companies relying on on-premise VPN devices from vendors like Cisco and Citrix should strongly consider transitioning to modern cloud-based, remote access solutions."
Paying someone to do my work is not always a wise move especially when they care less about what I’m doing and are more interested in acquiring the next subscriber.
"Early VPNs were simple," the report says. "They only handled VPN connections and were easier to secure. Over time, vendors began combining multiple functions (like firewall, router, proxy, and VPN) into a single device."
All the early vpn systems I worked on (pix, checkpoint fw1, SRX, Sonicwall ) where also firewalls & by necessity also did routing. How can you have a firewall that doesn’t route?
This led to next-generation firewalls (NGFWs), which exploded in popularity following the pandemic-induced remote work rush of 2020. "The result is that NGFWs create a very large attack surface, which attackers are actively taking advantage of," the report authors wrote.
This makes it seem like NGFW are all about vpn’s, routing etc but ngfw is all about extra security like IPS, heuristics, AI detection, deep packet inspection leading to application detection and control etc.
https://en.wikipedia.org/wiki/Next-generation_firewall
It’s like someone is trying to rewrite a narrative here & getting it totally wrong while using all the buzzword bingo tech jargon words they think their pray have heard of or be impressed by.
the evidence should have been challenged & verified at every opportunity.
BT says address x & customer y, how to confirm that's accurate? Electoral roll, council tax payments would confirm who lives at the address and for how long. would have shown the discrepancy & helped the police locate the real address quite quick.
If they had got as far as pressing charges, and in the court case the defence said "not our chap's IP address", they'd have had serious egg on face for not having verified that simple, basic fact, and likely be up on a purjury charge (having sworn an oath as to the correctness of their evidence).
How do you prove to the court the evidence wasn’t verified?
Police used a tool which said a crime was committed by ip x belonging to isp y.
Police check with isp y who confirm name & address of subscriber who used ip x at the stipulated dates & times.
Why would the court not accept that as evidence? How do you challenge that? Do you know what your public ip is today? Do you know when it last changed? Do you know what the public ip your isp thinks is assigned to your address & does it match what you actually have?
Took the police many months to challenge that evidence during which time the innocent parties had their lives turned upside down due to the investigation.
Hindsight shows it was trivial to confirm if the ip at the address was what the isp thought it was.
I suspect the police further investigated once they had the router in their possession and their tool told them further offences occurred & they knew for sure there was no internet connection at the address which made it obvious there was an issue which then prompted openreach to do a physical audit that revealed the true issue resulting in the guilty party being apprehended.
Adverse Inference
After a change in the law in 1994, the right to silence under English law was amended because the court and jury were allowed to draw adverse inference from such a silence.[5] Under English law, the police, cautioning someone, say, "You do not have to say anything. But it may harm your defence if you do not mention, when questioned, something which you later rely on in court". Under English law, the court and the jury may draw an adverse inference from fact that someone did not mention a defence when given the chance to do so if charged with an offence.[5][6]
https://en.wikipedia.org/wiki/Adverse_inference
just the investigation of this caused great harm to the innocent people caught up in this.
crossed lines is no where near as rare as it is being made out to be!
The tribunal ultimately dismissed all of the trio's arguments, ruling in favor of the police on all matters, despite acknowledging the "highly distressing and far-reaching consequences" of the investigation.
It concluded that the RIPA requests were lawful and were necessary and proportionate to the severity of the alleged crime. There was no other way of confirming the identity of the user, the tribunal said.
The tribunal concurred with the police in that the error was not theirs, but that of BT and its response to the RIPA requests. The ruling states efforts to "seek further information from BT... yielded no meaningful response."
The police could not have reasonably anticipated that the "rare occurrence" of crossed wires at a cabinet could have derailed their investigation so substantially, the judgement adds.
the tribunal should have sided with the complainants here.
Yes it was a nasty job that the police had to investigate but a little extra effort could have reduced the impact on the innocent people caught up in this.
Lessons should have been learnt & the police should be made to incorporate those lessons in their investigations.
The most important lesson should be to confirm that the broadband router MAC & IP addresses match the ones the ISP see.
if it is no match then likely the wrong address.
Could even just turn it off, & phone the ISP and ask if they still see it & is passing traffic.
Police relied on records of the ISP which turned out to be wrong instead of confirming those records where actually factual themselves by confirming the router details matched what the ISP where seeing.
These individuals have had their lives wrecked through no fault of their own.
quite trivial to check the IP & MAC of the router corresponds to what the carrier thinks it is.
if the suspect doesn't reveal the wifi password then a cable plugged into the router and a laptop with a quick look google for whats my ip would suffice.
shows how close we can be to a major problem due to an un disclosed mistake that non of us can actually verify for ourselves before hand.
did the project manager do the code changes to remove log4j or did they instruct a team member to do so & got no feed back as to why that was a bad idea.
I don't think I've met a project manager that actually does the work, they typically ensure the project is managed to achieve its goals.
Japan's maglev is forecast to cut Tokyo to Osaka travel time from 150 minutes (on the already speedy Tokaido Shinkansen) to around 67 minutes
320 miles in 2.5 hours would be amazing.
Imagine London to Edinburgh in under 3 hours or even under ~2 hours with the newer faster maglevs.
For many reasons we won’t get that here.
We should all know by now how horrendous it is to fix things that are outside of the norms that organisations follow to process things.
With digital id, how are helpless citizens expected to rectify problems that are no fault of their own & no one wants to take ownership for resolving?
I had an issue once where a contract arrived in my name and address but got a service I never ordered. I phoned the company, a top 3 uk service provider, and they wouldn’t put me through to their fraud department, instead asking me a bunch of questions and essentially saying I had ordered the service & to not worry about it. Towards the end of the call they asked for my email address to which I supplied an obvious fake address & they claimed it was proof I wasn’t the one who ordered & said id get a phone back in 15 minutes from their fraud team.
I had to phone back the following day, luckily the next guy was far more on the ball, took things more seriously and I got a letter from them a few days later that they’ve registered it as fraud and nullified searches etc.
It should have been easy to deal with but was surprisingly annoying. Even just finding their number to call wasn’t straightforward & their ivr geared to fix things via their automated process. There wasn’t an option to report fraud and no one I spoke to put me through to their dedicated fraud team.
Implications for me where potential impact to credit rating from the criminal taking services out in my name then defaulting.
They possibly also purchased an iPhone from a different company but in my name.
The ramifications from mistakes is huge and never considered
something more along the lines of AOL/CompuServe/Prodigy where the intermediary can do all the scanning etc and not left to the client.
https://en.wikipedia.org/wiki/CompuServe
Yes I'm well aware of dns filtering, makes you wonder why they are taking the approach they are when other methods are available.
It was entirely possible to put a mechanism in place that was lighter-touch, but also had teeth for the bigger players, but they ignored that because our legislators have no clue how the internet actually works or is used beyond their own use of social media to campaign and search engines to Google their own names.
That was my point. They could have done something more focussed & constructive but chose this route which is open ended & vague with obvious scope for mission creep without needing additional legislation.
They used a feeble excuse & now have a huge privacy concerning tool to gather data on what you did when & where which effectively turns law abiding citizens into criminals until investigation proves otherwise while the real criminals will just carry on as they where before hand.
If they can’t find them now, forcing everyone to provide id when going online still won’t find them.
This will stop people openly discussing things that the government deems as unpalatable though which could simply be complaining about paying taxes or loss of freedom rights.
A better way to keep citizens and. kids safe online would be for the BBC to run a walled garden Internet that can be accessed via an app on our phones/tablets or a website.
The BBC can then run scam scanning and provide a means and mechanism to report dangerous content.
parents can then rely on the service to keep kids safe online and adults can use it too safe in the knowledge that there is less risk of happening across undesirable material & if we did we could report it & prompt action can be taken.
it would go some way to justifying our licence fee.
Personally I'd open it up for global use as kids planet wide can take advantage of the walled garden approach.
The fact that government hasn't come up with the idea or that big tech hasn't either just shows that no one is interested in stopping the nasty content but they are interested in censoring us using the nasty content as the stick.
if it was run by big tech with a requirement that in order to reach their subscribers vendors must adhere to these scanning solutions etc it'll have a better chance of success,
everyone would know that to go raw internet there be dragons but go by walled garden & your kids are safe. easy message to get through.
yes there will be monsters who would seek to deliberately put nasty content in there but as a walled garden it should be easier to spot, easier to report & easier to stamp out. all while leaving the raw internet for the rest of us.
4chan can stop the additional fines by providing copies of its illegal content risk assessments and information about its qualifying worldwide revenue to Ofcom.
When opening the investigation, Ofcom said it was looking to understand whether 4chan has failed, or is failing, to abide by its duties under the Online Safety Act.
4chan is well regarded as the cesspit of the internet, I'd imagine there is plenty of content there to take more proactive enforcement including speaking to regulators in the nations that host 4chan & also invoking law enforcement in this jurisdictions to quash the content and those posting it. the fact they are not doing so demonstrates this is more about control of content by strong-arming those that run the sites.
Tech secretary Liz Kendall said: "The Online Safety Act is not just law, it's a lifeline. Today we've seen it in action, holding platforms to account so we can protect people across the UK.
"Services can no longer ignore illegal content, like encouraging self-harm or suicide, circulating online which can devastate young lives and leave families shattered.
"This fine is a clear warning to those who fail to remove illegal content or protect children from harmful material. We fully back the regulator in taking action against all platforms that do not protect users from the darkest corners of the internet."
First look at beefed-up requirements
Among Ofcom's proposed amendments to its obligations to platforms was the requirement for in-scope apps and websites to make use of hash-matching technology, which is seen as a more accurate, automated way of preventing the dissemination of illegal content such as CSAM.
Hash matching involves a system fingerprinting an image and comparing the hash it generates to a database of known harmful images, which are also hashed. If an image's hash matches or shows signs of similarity with one in the database, then it can be removed entirely autonomously and reported to local authorities for follow-up investigations.
again shows its enforced self censorship by the content providers using extensible tools the government controls.
While platforms are forbidden from guiding users toward these types of workarounds, this alone is unlikely to prevent VPNs being used to bypass geo-blocks and similar measures.
so this drivers normal users into using extra techniques to restore service to the services they use which will look just like the techniques used by the bad actors who are posting & hosting the nasty content we all want to be eradicated.
this won't stop the evil doers but does Beverly impinge on normal peoples ability to use services and severely impacts our privacy.
You may think the rules are wrong. (And they may well be.) But they are the rules, and you can't complain about people preventing you evading them
why not?
is it a criminal offence to complain now?
is someone doing something wrong by complaining about something that hinders their ability to do what they did without issue a few months back?
not sure I like where things are heading, the current lot are a disaster & the next lot people are looking to to stop the madness have their own different concerns that people may be desperate enough to over look.
the worse thing is that its not just in the UK but seemingly across all western nations
given the stealth in which this appears to have been implemented, I would not be surprised if disabling the feature just stops M$ telling you about it but it actually happens in the background.
Sounds like the OSA thing where file share hoisters are required to check your files against provided hashes & then report you for violations or near misses.
creepy
Linux is now fully ready for the desktop!!
"This was triggered by a non-malicious software issue with one of our vendor partners which has now been resolved, and the network has fully recovered. We apologise for any inconvenience this caused our customers."
basically they had one of their outsourced teams do some work on the system responsible for their BGP peering and something went badly wrong.
why it took so long to roll back & why it happened during our day needs answering.
as a VF customer years back we where implementing new WAN circuits and their converged voip solution, submitting requests for the voip stuff their offshore teams would ask me for details to complete their change request forms, instead of getting piecemeal requests I'd have them send me their form & I'd fill it out and send back to them, instead of 2 weeks of back & forth before they'd agree it I could get it done in 1 day. They were happy as they didn't have to do it & our customer was happy as their project got back on track.
I realised then how vulnerable VF was to their offshore teams making mistakes.
next job in a largish retailer, VF where the sole network provider, I did query why we didn't have 2 different providers given the risk of 1 provider having a major issue etc.
they went down hard yesterday because of reliance on a single vendor.
its not difficult to use multiple service providers in 2025.
To gain access to the DC and have the confidence and forthrightness to embark on a tidy up involving removal of kit Steve & his boss must have had the right authority in the business to do so.
if i had come across an unfamiliar, undocumented unpowered (as it had no power cable) box in a dc i'd have removed it too.
my 1st suspicion would be that someone has attempted to infiltrate our systems, especially if i worked in an insurance company.
not sure how the actions could have resulted in dismissal, especially in what should have been a regulated environment.
i would have traced the cables though and checked the switch to see if it detailed what it was meant to be & checked our records to see what was meant to have been patched into the switch ports but we all know how inaccurate documentation can be.
had i done the checking while the thing was still connected i'd have noted the switch interface as being up & traffic passing, i'd have still disconnected it though because as a network guy with admin access to switches i should know what it was.
If a server guy had removed it because they didn't know what it was i still can't conceive as to why they'd get sacked.
it's possible the device was a network tap with passthrough capability for when it fails or disconnected from a mains supply as in this case, but it could be poe.
https://www.amazon.co.uk/Dualcomm-1000Base-T-Gigabit-Ethernet-Network/dp/B004EWVFAY?th=1
should have been quite obvious what it was especially as lights should be blinking
used to use them at a previous job but failed to see the point as no one looked at the data.
doesn't really matter where your backups are stored if they are not protected somehow.
strongly encrypted backups in the cloud should be as well protected as in your physical safe place.
if your cloud provider isn't using strong encryption & controls for your precious data then its not protected.
This is why governments mandating back doors in cloud providers is a recipe for disaster for us all.
if the office was a 10min drive or walk or bus then i suspect many wouldn't mind being in the office.
i was lucky enough to find a job 5 mins walk from home.
i was able to have lunch at home and let the dog out etc.
evening changes i would go into the office and use my several screens at my desk instead of the single screen at home etc etc plus be able to focus in an empty office.
i'd changed my job by lockdown & when my monitor broke i invested in a 40" replacement.
proved invaluable for the evening & overnight changes i wound up doing especially as my laptop only had a 13" screen. The office then was only 10 miles away and pre pandemic was ~ 1 hour each way in rush hour, post pandemic when everyone was wfh it was 20 minutes each way during what was rush hour.
really made you wonder why everyone bothered coming in.
when we got outsourced we had to ask permission to go to what was once our office plus find a sponsor so naturally that didn't happen often. There was a clause in the outsourced contract that we could be asked to go to one of their offices within, i think, 30 miles of what was our main office. Obviously it was a strategy to force people out.
The technology worked as advertised or better. At 19 million miles (30 million km) from Earth, DSOC achieved 267 Mbps. At 386 million kilometers (240 million miles), it achieved a sustained downlink data rate of 6.25 Mbps, peaking at 8.3 Mbps.
Is the downlink on earth or the probe?
i appreciate the article mentioned an earth downlink being a telescope but sometimes 'downlink' is used interchangeably. i will assume the earth receiving end for all mentions in the article.
would be good to know the receive & transmit rates of the probe & separately the earth receiving station.
I'd expect the probe to be able to send at a higher rate than the probe due to more power available here.
for the earth station to receive at 6.25mbps from the probe at 240 million miles away is extremely impressive.
& yes i appreciate that the probes send rate is likely more important than the receive rate as its the data it has recorded that we want.
I also wonder how the rate is windowed down given the latency peaks at 22 mins to mars type distances. i guess spending at least 66 mins to max bandwidth & link quality is worth the higher bandwidth
It will almost certainly be rejected by them & the only way the government will get it passed will be to include it in the manifesto at the next general election & win.
this is wishful thinking
don't be surprised when teh house of lords rushes this through.
What makes you think they they would reject this?
I’ve heard a number of Labour ministers state that digital id will deter migrants from coming to the uk
https://news.sky.com/story/digital-id-cards-would-help-to-deter-migrants-from-heading-to-uk-harriet-harman-says-13395054#:~:text=Digital%20ID%20cards%20would%20help%20to%20deter%20migrants%20from%20heading%20to%20UK%2C%20Harriet%20Harman%20says
Can anyone explain how it’ll deter migrants illegally entering the uk,
Bonus question, if they are so bad they act as a deterrent, why do normal law abiding citizens need or want them?
Surely the better way is to mandate illegal migrants have digital id & everyone else uses what we’ve already got.
Make it make sense!
"Digital ID is an enormous opportunity for the UK," said prime minister Keir Starmer. "It will make it tougher to work illegally in this country, making our borders more secure. And it will also offer ordinary citizens countless benefits, like being able to prove your identity to access key services swiftly – rather than hunting around for an old utility bill."
No thanks
The only way this works is to constantly validate everyone’s validity.
If I’m retired, what’s to stop me signing up for work at a bunch of places and sub my authorised work out to someone else for a fee, could be a nice supplement to my pension.
So many ways this nonsense can be exploited which shows the reasons given are mere excuses and not the true reason they want this.
Given all the lies since 1997 this is just the latest incarnation of governments trying to be authoritarian.
They work for us, we don’t work for them
Diverse routing should ensure separate feeds to at least 2 separate parts of the facility/building.
Re power over a single bridge, you then ensure you have an upstream backed by a generator with enough fuel for at least a couple of weeks time enough to get extra fuel to last until the bridge & main power feed is restored. For data you’d likely use a microwave link to bolster the fibre running through the bridge.
There is always a way provided you pay for it.
if you wanted 443 blocked, you'd just block 443 & not bother with the tcp rst/fin thing.
the tcp rst/fin thing alludes to some kind of inspection going on, which we know they do.
i suspect their detection turned to prevention with the tcp rst/fin.
tcp rst/fin also gracefully ends sessions along the path so alleviates resources but shutting any stateful tracking.
...also. I like how you think the government of China is communist. I expect you think National Socialists were socialist as well. That level of naïveté is adorable.
China is officially a socialist state under the leadership of the Communist Party of China (CPC).
The CPC is the country’s sole governing party, and its political system is rooted in Marxist-Leninist principles.
However, China’s economy is a mix of socialism and market capitalism.
Since the late 1970s, it has introduced market-oriented reforms, allowing private businesses, foreign investment, and capitalist-style competition while keeping major sectors (like banking, energy, and defense) under state control.
Government of China is run by "Communist Party of China", communist is in its title.
truly not sure where you where going with your statement.
Its well known that BC wanted to let go their smaller customers in favour of their global 1k.
VCF9 with on prem private cloud capabilities would be appealing to the smaller operators outside of that global 1k.
Biggest issue with the cloud are teh vampire costs, where some dev has spun up a load of stuff that is still running long after they've gone and much of it is possibly not needed but no one knows so teh company is charged for things they may not be needing & the cloud provider is the benefactor.
Same issue can & will happen on prem but the cost is effectively just some electric & no cloud provider profits.