Russ

Author Archives: Russ

Worth Reading: Reddit’s Warrant Canary

A critical aspect of that promise was a legally experimental, categorical statement known as a “warrant canary.” A warrant canary, as the Electronic Frontier Foundation explains, “is a colloquial term for a regularly published statement that a service provider has not received legal process that it would be prohibited from saying it had received. Once a service provider does receive legal process, the speech prohibition goes into place, and the canary statement is removed,” thereby informing the public that the process has been received. -via Just Security

LinkedInTwitterGoogle+FacebookPinterest

The post Worth Reading: Reddit’s Warrant Canary appeared first on 'net work.

Securing BGP: A Case Study (7)

In the last post on this series on securing BGP, I considered a couple of extra questions around business problems that relate to BGP. This time, I want to consider the problem of convergence speed in light of any sort of BGP security system. The next post (to provide something of a road map) should pull all the requirements side together into a single post, so we can begin working through some of the solutions available. Ultimately, as this is a case study, we’re after a set of tradeoffs for each solution, rather than a final decision about which solution to use.

The question we need to consider here is: should the information used to provide validation for BGP be somewhat centralized, or fully distributed? The CAP theorem tells us that there are a range of choices here, with the two extreme cases being—

  • A single copy of the database we’re using to provide validation information which is always consistent
  • Multiple disconnected copies of the database we’re using to provide validation which is only intermittently consistent

Between these two extremes there are a range of choices (reducing all possibilities to these two extremes is, in fact, a misuse of the Continue reading

Worth Reading: Cryptography isn’t easy

Cryptography is harder than it looks, primarily because it looks like math. Both algorithms and protocols can be precisely defined and analyzed. This isn’t easy, and there’s a lot of insecure crypto out there, but we cryptographers have gotten pretty good at getting this part right. However, math has no agency; it can’t actually secure anything. For cryptography to work, it needs to be written in software, embedded in a larger software system, managed by an operating system, run on hardware, connected to a network, and configured and operated by users. Each of these steps brings with it difficulties and vulnerabilities. -via Schneier on Security

LinkedInTwitterGoogle+FacebookPinterest

The post Worth Reading: Cryptography isn’t easy appeared first on 'net work.

Review; Algorithms in a Nutshell

algorithms-in-a-nutshellAlgorithms in a Nutshell
George T. Heineman, Gary Pollice, Stanley Selkow
O’Reilly Media

In the midst of the SDN craze (or haze, depending on your point of view), we often forget that all networks are, in the final analysis, driven by software. Every control plane ever developed or deployed is a software application running on top of a physical device. And every control plane, every queuing mechanism, every forwarding mechanism, and everything we work on in the networking field is based on some sort of algorithm. But what is an algorithm, really? What sorts of algorithms are there, and what are they used for? These are the questions this book specifically takes aim at answering.

The authors begin with a chapter discussing the concepts of algorithms; this chapter contains a really helpful section on the difference between the classes of algorithms available, such as greedy and Chapter 2 focuses on the math of algorithm performance, providing information on the difference between O(1), O(n), O(n log n), and many other expressions describing the feed at which algorithms operate. This is one of the most helpful and clearly explained sections in the book. The third chapter explains the building blocks of algorithms, specifically focusing on the conventions used in the book, and some challenges around measuring the performance and accuracy of any given algorithm.

Chapter 4 considers sorting algorithms, and chapter 5 search. These three kinds of algorithms probably cover 80-90% of all algorithm usage in real code. These three classes of algorithms actually provide the building blocks for many other kinds of algorithms. For instance, Shortest Path First (SPF) requires a sorted heap or list of nodes, edges, and reachable destinations in the network—but we have to sort a list to have a sorted list to use in SPF.

Chapter 6 jumps into material directly applicable to network engineering; here is where Dijkstra’s SPF algorithm is covered. This chapter will be extremely useful to network engineers to read and understand, even though the terminology is often different. Chapters 7, 9, and 11, on path finding in AI, computational geometry, and emerging algorithm categories, are interesting, but not all that useful for the average (or above average) network engineer.

Chapter 8 discusses network flow diagrams, which are a superset of many of the traffic engineering, service chaining, and queuing theory problems engineers face in real networks. Chapter 10 should be familiar to engineers who’ve looked at the m-way trees and treis used in packet switching.

Overall, this is really useful book for network engineers who want to dig deeper into the software roots of how network protocols and switching work. There are a few chapters that don’t directly apply to the common sets of problems network engineering involves, but readers won’t miss a lot skipping those sections if the overall length of the book seems like it’s too much.

The reading difficulty is moderate, and the time to read is pretty long (partially because of the many code examples and the depth of the concepts covered).

LinkedInTwitterGoogle+FacebookPinterest

The post Review; Algorithms in a Nutshell appeared first on 'net work.

Worth Reading: Warrantless Searches

…the government assumes that any communication entering or leaving the country has a foreigner on one end — and thus is eligible for warrantless searching. As the new Brennan Center report makes clear, the implications of this position are especially dire given the global structure of the Internet, where even Americans’ domestic communications may be routed or stored abroad without the parties to those communications even knowing. -via Just Security

LinkedInTwitterGoogle+FacebookPinterest

The post Worth Reading: Warrantless Searches appeared first on 'net work.

Worth Reading: Intel and the Network Arms Race

Networking is undergoing a huge transformation. Software is surely a huge driver for enabling technology to grow by leaps and bounds and increase functionality. But the hardware underneath is growing just as much. We don’t seem to notice as much because the port speeds we deal with on a regular basis haven’t gotten much faster than the specs we read about years go. But the chips behind the ports are where the real action is right now.

LinkedInTwitterGoogle+FacebookPinterest

The post Worth Reading: Intel and the Network Arms Race appeared first on 'net work.

What should IETF “standard track” actually mean?

This post is going to be a little off the beaten path, but it might yet be useful for folks interested in the process of standardization through the IETF.

Last week, at the IETF in Buenos Aires, a proposal was put forward to move the IPv4 specifications to historic status. Geoff Huston, in his ISP column, points out the problem with this sort of thing—

As one commenter in the Working Group session pointed out, declaring IPv4 “Historic” would likely backfire and serve no better purpose other than exposing the IETF to ridicule. And certainly there is some merit in wondering why a standards body would take a protocol specification used by over 3 billion people, and by some estimated 10 billion devices each and every day and declare it to be “Historic”. In any other context such adoption figures for a technology would conventionally be called “outstandingly successful”!

The idea to push IPv4 to historic is, apparently, an attempt to move the market, in a sense. If it’s historic, then the market won’t use it, or will at least move away from it.

Right.

reaction-02Another, similar, line of thinking came up at the mic during a discussion around whether Continue reading

IS-IS LiveLesson Publishing Soon

is-is-livelessonWhile the IS-IS book is still useful, it is getting on a little in age, and some people find learning through video to be more helpful. I’ve recorded seven hours of video on IS-IS in the form of a LiveLesson with Cisco Press. They should be available on the 18th of April (just a few days from now), and apparently they’re already available as a sneak peek.

Thanks to Brett (who runs, and has run, all my projects at Cisco Press and Addison-Wesley), Pete (who patiently recorded my many fumbles), and Chris Cleveland, who has been my steadfast editor for all things Cisco Press and Addison-Wesley for some fifteen years now), for making this happen. This is the first, I think, of a number of new video projects I have on tap, so watch this space.

And no, I’m not going to stop writing books (just a gentle reminder).

LinkedInTwitterGoogle+FacebookPinterest

The post IS-IS LiveLesson Publishing Soon appeared first on 'net work.

The Design Mindset (5)

So far, in our investigation of the design mindset, we’ve—

We also considered the problem of interaction surfaces in some detail along the way. This week I want to wrap this little series up by considering the final step in design, act. Yes, you finally get to actually buy some stuff, rack it up, cable it, and then get to the fine joys of configuring it all up to see if it works. But before you do… A couple of points to consider.

It’s important, when acting, to do more than just, well, act. It’s right at this point that it’s important to be metacongnitive—to think about what we’re thinking about. Or, perhaps, to consider the process of what we’re doing as much as actually doing it. To give you two specific instances…

ooda-complexityFirst, when you’re out there Continue reading

1 … 131 132 133 134 135 … 162