Worth Reading: Hype driven development

HDD happens when a development team picks the “newest, hottest technology” to use on a project, based on how the technology is trending on Twitter, or on a number of enthusiastic blog posts or conference talks. A key symptom of HDD is that contrary to the hype, progress doesn’t speed up when the new tech is developed but just the opposite: work slows to a crawl. —The New Stack

The post Worth Reading: Hype driven development appeared first on 'net work.

IPv6, DHCP, and Unintended Consequences

I ran into an interesting paper on the wide variety of options for assigning addresses, and providing DNS information, in IPv6, over at ERNW. As always, with this sort of thing, it started me thinking about the power of unintended consequences, particularly in the world of standardization. The authors of this paper noticed there are a lot of different options available in the realm of assigning addresses, and providing DNS information, through IPv6.

Alongside these various options, there are a number of different flags that are supposed to tell the host which of these options should, and which shouldn’t, be used, prioritized, etc. The problem is, of course, that many of these flags, and many of the options, are, well, optional, which means they may or may not be implemented across different versions of code and vendor products. Hence, combining various flags with various bits of information can have a seemingly random impact on the IPv6 addresses and DNS information different hosts actually use. Perhaps the most illustrative chart is this one—

Each operating system tested seems to act somewhat differently when presented with all possible flags, and all possible sources of information. As the paper notes, this can cause Continue reading

Worth Reading: W3C at the crossroads

The World Wide Web Consortium (W3C) has a hard decision to make: a coalition including the world’s top research institutions; organizations supporting blind users on three continents; security firms; blockchain startups; browser vendors and user rights groups have asked it not to hand control over web video to some of the biggest companies in the world. For their part, those multinational companies have asked the W3C to hand them a legal weapon they can use to shut down any use of online video they don’t like, even lawful fair use. —EFF

The post Worth Reading: W3C at the crossroads appeared first on 'net work.

Worth Reading: Network Time Protocol

Of these most important Internet protocols, NTP (Network Time Protocol) is the likely least understood and has the least attention and support. Until very recently, it was supported (part-time) by just one person — Harlen Stenn — “who had lost the root passwords to the machine where the source code was maintained (so that machine hadn’t received security updates in many years), and that machine ran a proprietary source-control system that almost no one had access to, so it was very hard to contribute to”. —CircleID

The post Worth Reading: Network Time Protocol appeared first on 'net work.

snaproute Go BGP Code Dive (14): First Steps in Processing an Update

In the last post on this topic, we found the tail of the update chain. The actual event appears to be processed here—

case BGPEventUpdateMsg:
  st.fsm.StartHoldTimer()
  bgpMsg := data.(*packet.BGPMessage)
  st.fsm.ProcessUpdateMessage(bgpMsg)

—which is found around line 734 of fsm.go. The second line of code in this snippet is interesting; it’s a little difficult to understand what it’s actually doing. There are three crucial elements to figuring out what is going on here—

:=, in go, is a way of appending the information in a data structure with more information. So, for instance, if you do something like this—

a-string = "this is a"
a-string := " string"

The result, in a-string, is this is a string. Whatever else this snippet is doing, then, it is taking something out of the data structure, and appending it to the bgpMsg structure. What, precisely, is it taking from the data structure?

The * (asterisk) is a way to reference a pointer within a structure. We’ve not talked about pointers before, so it’s worth spending just a moment with them. The illustration below will help a bit.

Each letter in the string “this is a string” Continue reading

Worth Reading: Stacking software to support FPGA’s in the data center

Any substantial change requires a big payoff to be implemented because change is inherently risky. It doesn’t help that the method of programming FPGAs efficiently using VHDL and Verilog are so alien to Java and C programmers, and that the tools for porting code from such high level programming languages, often through an OpenCL parallel framework, down to the logic gates on an FPGA are not as efficient as doing the VHDL and Verilog by hand, from scratch, but these tools are getting better. And finally, the application development and runtime stacks common in the enterprise do not know what to do with FPGAs. —The Next Platform

The post Worth Reading: Stacking software to support FPGA’s in the data center appeared first on 'net work.

Worth Reading: FPGA Accelerated Cloud

FPGAs have been an emerging topic on the application acceleration front over the last couple of years, but despite increased attention around use cases in machine learning and other hot areas, hands have been tied due to simply on-boarding with both the hardware and software. —The Next Platform

The post Worth Reading: FPGA Accelerated Cloud appeared first on 'net work.

Sunset Over Salt Marsh

The post Sunset Over Salt Marsh appeared first on 'net work.

Worth Reading: Car Makers Align with 5G

5G wireless technology has become a little like fully automated cars. Nearly every day some new study is forecasting an earlier than previously anticipated arrival of fully autonomous cars, while some respected expert is claiming full automation is decades away. With 19 automated fleets already plying controlled-use areas, I am inclined to buy the early onset assessment of automation vs. the over-the-horizon outlook from skeptics. —ITU Blog

The post Worth Reading: Car Makers Align with 5G appeared first on 'net work.

Worth Reading: Binge Watching Makes You Stupid

Binge is the new black. That’s what Netflix, and other media outlets tell us as they rev up for the holiday season. Are your in-laws too much? Kids driving you nuts? Had enough holiday cooking, cleaning, and entertaining? Well, take a break from real life and the stresses of the holidays and focus on something less confrontational: television. —Acculturated

The post Worth Reading: Binge Watching Makes You Stupid appeared first on 'net work.

Worth Reading: Hyper Moore’s Law

Over the last year in particular, we have documented the merger between high performance computing and deep learning and its various shared hardware and software ties. This next year promises far more on both horizons and while GPU maker Nvidia might not have seen it coming to this extent when it was outfitting its first GPUs on the former top “Titan” supercomputer, the company sensed a mesh on the horizon when the first hyperscale deep learning shops were deploying CUDA and GPUs to train neural networks. —The Next Platform

The post Worth Reading: Hyper Moore’s Law appeared first on 'net work.

Worth Reading: Marai Strikes Again

More than 900,000 customers of German ISP Deutsche Telekom (DT) were knocked offline this week after their Internet routers got infected by a new variant of a computer worm known as Mirai. The malware wriggled inside the routers via a newly discovered vulnerability in a feature that allows ISPs to remotely upgrade the firmware on the devices. But the new Mirai malware turns that feature off once it infests a device, complicating DT’s cleanup and restoration efforts. —Krebs on Security

The post Worth Reading: Marai Strikes Again appeared first on 'net work.

Worth Reading: Social Media is Entertainment

Like TV it now increasingly entertains us, and even more so than television it amplifies our existing beliefs and habits. It makes us feel more than think, and it comforts more than challenges. The result is a deeply fragmented society, driven by emotions, and radicalized by lack of contact and challenge from outside. This is why Oxford Dictionaries designated “post-truth” as the word of 2016: an adjective “relating to circumstances in which objective facts are less influential in shaping public opinion than emotional appeals.” —MIT Technology Review

The post Worth Reading: Social Media is Entertainment appeared first on 'net work.

Worth Reading: SF Subway Hacked

The San Francisco Municipal Transportation Agency (SFMTA) was hit with a ransomware attack on Friday, causing fare station terminals to carry the message, “You are Hacked. ALL Data Encrypted.” Turns out, the miscreant behind this extortion attempt got hacked himself this past weekend, revealing details about other victims as well as tantalizing clues about his identity and location. —Krebs on Security

The post Worth Reading: SF Subway Hacked appeared first on 'net work.

Reaction: Openflow and Software Based Switching

Over at the Networking Nerd, Tom has an interesting post up about openflow—this pair of sentences, in particular, caught my eye—

The side effect of OpenFlow is that it proved that networking could be done in software just as easily as it could be done in hardware. Things that we thought we historically needed ASICs and FPGAs to do could be done by a software construct.

I don’t think this is quite right, actually… When I first started working in network engineering (wheels were square then, and dirt hadn’t yet been invented—but we did have solar flares that caused bit flips in memory), we had all software based switching. The Cisco 7200, I think, was the ultimate software based switching box, although the little 2ru 4500 (get your head out of the modern router line, think really old stuff here!) had a really fast processor, and hence could process packets really quickly. These were our two favorite lab boxes, in fact. But in the early 1990’s, the SSE was introduced, soldered on to an SSP blade that slid into a 7500 chassis.

The rest, as they say, is history. The networking world went to chips designed to switch Continue reading

Worth Reading: Kraken

How do you know how well your systems can perform under stress? How can you identify resource utilization bottlenecks? And how do you know your tests match the condititions experienced with live production traffic? You could try load modeling (simulation), but it’s not really feasible to model systems undergoing constantly evolving workloads, frequent software release cycles, and complex dependencies. —the morning paper

The post Worth Reading: Kraken appeared first on 'net work.

Worth Reading: The Dangers of the New UK Investigatory Powers Act

There is an old adage that trust takes years to build, seconds to break, and forever to repair. When it comes to the Internet and its users, the same holds true. For average Internet users, trust in the Internet has to be built. They have to gain confidence in the safety of their private information online. When a user’s private online information is made public, they lose trust in the Internet and its services. —The Internet Society

The post Worth Reading: The Dangers of the New UK Investigatory Powers Act appeared first on 'net work.

Traffic Pattern Attacks: A Real Threat

Assume, for a moment, that you have a configuration something like this—

Some host, A, is sending queries to, and receiving responses from, a database at C. An observer, B, has access to the packets on the wire, but neither the host nor the server. All the information between the host and the server is encrypted. There is nothing the observer, B, can learn about the information being carried between the client and the server? Given the traffic is encrypted, you might think… “not very much.”

A recent research paper published at CCS ’16 in Vienna argues the observer could know a lot more. In fact, based on just the patterns of traffic between the server and the client, given the database uses atomic operations and encrypts each record separately, it’s possible to infer the key used to query the database (not the cryptographic key). The paper can be found here. Specifically:

We then develop generic reconstruction attacks on any system supporting range queries where either access pattern or communication volume is leaked. These attacks are in a rather weak passive adversarial model, where the untrusted server knows only the underlying query distribution. In particular, to perform our attack Continue reading

Worth Reading: Navigating the Pentest World

The demand for penetration testing and security assessment services worldwide has been growing year-on-year. Driven largely by Governance, Risk, and Compliance (GRC) concerns, plus an evolving pressure to be observed taking information security and customer privacy seriously, most CIO/CSO/CISO’s can expect to conduct regular “pentests” as a means of validating their organizations or product’s security —CircleID

The post Worth Reading: Navigating the Pentest World appeared first on 'net work.

Butterfly

The post Butterfly appeared first on 'net work.