Worth Reading: DNS query name minimization

One new thing you need to add your DNS security policies is “query name minimizations” (RFC 7816). I thought I’d mention it since many haven’t heard about it. Right now, when DNS resolvers lookup a name like “www.example.com.”, they send the entire name to the root server (like a.root-servers.net.). When it gets back the answer to the .com DNS server a.gtld-servers.net), it then resends the full “www.example.com” query to that server. This is obviously unnecessary. The first query should be just .com. to the root server, then example.com. to the next server — the minimal amount needed for each query, not the full query. —Robert Graham @ Errata Security

The post Worth Reading: DNS query name minimization appeared first on rule 11 reader.

Wooden Bridge

The post Wooden Bridge appeared first on rule 11 reader.

Worth Reading: Supporting new DNS RR types

The Domain Name System has always been intended to be extensible. The original spec in the 1980s had about a dozen resource record types (RRTYPEs), and since then people have invented many more so now there are about 65 different RRTYPEs. But if you look at most DNS zones, you’ll only see a handful of types, NS, A, AAAA, MX, TXT, and maybe SRV. Why? A lot of the other types are arcane or obsolete, but there are plenty that are useful. Moreover, new designs like DKIM, DMARC, and notoriously SPF have reused TXT records rather than defining new types of their own. Why? It’s the provisioning crudware. —John Levine @ CircleID

The post Worth Reading: Supporting new DNS RR types appeared first on rule 11 reader.

Worth Reading: Hacking through the random number generator

Late Last Autumn, a Russian mathematician and programmer named Alex decided he’d had enough of running his eight-year-old business. Though his St. Petersburg firm was thriving, he’d grown weary of dealing with payroll, hiring, and management headaches. He pined for the days when he could devote himself solely to tinkering with code, his primary passion. The time had come for an exit strategy. —Brendon Koerner @ Wired

The post Worth Reading: Hacking through the random number generator appeared first on rule 11 reader.

Worth Reading: Why you should document first

Programmers and project managers sometimes think the phrase “doc-driven development” means putting a lot of comments in code or working closely with doc writers as development happens. That’s because it’s hard to imagine how development can possibly happen after documentation, because surely documentation can’t happen until there’s something to actually document. —Seth Kenlon @ Opensource

The post Worth Reading: Why you should document first appeared first on rule 11 reader.

Worth Reading: The shape of HPC and AI iron to come

In the IT business, just like any other business, you have to try to sell what is on the truck, not what is planned to be coming out of the factories in the coming months and years. AMD has put a very good X86 server processor into the market for the first time in nine years, and it also has a matching GPU that gives its OEM and ODM partners a credible alternative for HPC and AI workload to the combination of Intel Xeons and Nvidia Teslas that dominate hybrid computing these days. —Timothy Prickett Morgan @ The Next Platform

The post Worth Reading: The shape of HPC and AI iron to come appeared first on rule 11 reader.

Worth Reading: We’re Still on Whois?

Here we are in a modern age, and yet the load on the public whois service at APNIC continues unabated. It’s believed they’re mostly queries from automatic systems, checking the authority over an IP address, almost certainly from firewall checks, an amount of manual data exploration by law enforcement and IPR agencies, and at the tail end, ISPs doing semi-automatic router configuration. —George Michaelson @ APNIC

The post Worth Reading: We’re Still on Whois? appeared first on rule 11 reader.

Worth Reading: The TCP Tortoise

As LinkedIn migrated to serving its pages on HTTP/2 earlier this year, it became imperative that we identify and use the most optimal transport layer strategy for our users’ network. Being a Transmission Control Protocol-centric (TCP) infrastructure, we initiated an effort to study the effects of different TCP congestion control strategies in different geographies. We found that with the right strategy, we could significantly improve our site speed, resulting in up to 7% faster content downloads. —Prasanna Vijayanathan @ Linkedin

The post Worth Reading: The TCP Tortoise appeared first on rule 11 reader.

On the ‘web: What your momma never told you about OSPF

Nick Russo and I talk about the OSPF routing protocol, covering some of those things you’ve probably never thought about, and giving away one of my favorite interview questions in the process. You can see the original episode at the Network Collective here.

The post On the ‘web: What your momma never told you about OSPF appeared first on rule 11 reader.

Worth Reading: NVMe for Data Centers

The Non-Volatile Memory Express (NVMe) specification defines a new method to access solid-state drives (SSDs) over a PCIe bus, and it’s forecasted to grow exponentially over the next few years thanks to its performance advantages and lower latencies compared with legacy protocols (such as SATA). NVMe-enabled storage infrastructures are not only seeing wide deployment, but they’re now entering other data center areas that were once typically reserved for legacy HDDs and SSDs. NVMe has become an agent for next-generation data centers. To understand this evolution, it’s important to review the history and examine some of the new application workloads that are being transformed by this protocol. —Anand Jayapalan @ The Data Center Journal

The post Worth Reading: NVMe for Data Centers appeared first on rule 11 reader.

Worth Reading: The Coco Block Chain

Today I am proud to introduce the Coco Framework, an open-source system that enables high-scale, confidential blockchain networks that meet all key enterprise requirements—providing a means to accelerate production enterprise adoption of blockchain technology. Coco achieves this by designing specifically for confidential consortiums, where nodes and actors are explicitly declared and controlled. Based on these requirements, Coco presents an alternative approach to ledger construction, giving enterprises the scalability, distributed governance and enhanced confidentiality they need without sacrificing the inherent security and immutability they expect. —Mark Russinovich @ Azure

The post Worth Reading: The Coco Block Chain appeared first on rule 11 reader.

Thoughts on Grey Failures

In this video I work through some thoughts around grey failures—a big thanks to Ivan for discussing this with me, which was very helpful. The paper mentioned in the video can be found here.

The post Thoughts on Grey Failures appeared first on rule 11 reader.

Worth Reading: Automated Safe Cracking

In the process of building his safecracking robot, which he will demonstrate live at the Defcon cybersecurity conference next week, Seidle discovered a series of real vulnerabilities in the relatively cheap, but popular, SentrySafe he tested. But the larger lesson of his work goes beyond his particular safe’s security flaws. It points instead to a new reality for vendors of physical security equipment: If automated tools can crack your locks or safes, the increasing affordability of those tools makes you more vulnerable than ever. —Andy Greenberg @ Wired

The post Worth Reading: Automated Safe Cracking appeared first on rule 11 reader.

Worth Reading: Deep dive into Sky Lake

The architecture of Skylake is very different from that of the prior “Haswell” and “Broadwell” Xeon chips, and will be carried forward with the next-generation “Cascade Lake” processors that will very likely be implemented in a highly tuned 14 nanometer process – what Intel calls 14++ nanometer in its chip manufacturing presentations. (We had not heard of Cascade Lake before, and assumed future Xeons would be based on the “Kaby Lake” design already implemented in the Xeon E3 chips for single-socket servers.) The point is, the Socket P form factor for Xeon SP processors will be used for at least two generations of server chips, and possibly more. —Timothy Prickett Morgan @ The Next Platform

The post Worth Reading: Deep dive into Sky Lake appeared first on rule 11 reader.

Japanese Temple

The post Japanese Temple appeared first on rule 11 reader.

Worth Reading: Ops is everyone’s job now

Distributed systems are never “up”; they exist in a constant state of partially degraded service. Accept failure, design for resiliency, protect and shrink the critical path. You can’t hold the entire system in your head or reason about it; you will live or die by the thoroughness of your instrumentation and observability tooling. You need robust service registration and discovery, load balancing, and backpressure between every combination of components. You need to learn to integrate third-party services; many core functions will be outsourced to teams or companies that you have no direct visibility into or influence upon You have to test in production, and you have to do so safely; you cannot spin up a staging copy of a large distributed system. —Charity Majors @ opensource

The post Worth Reading: Ops is everyone’s job now appeared first on rule 11 reader.

Worth Reading: Web archiving and the importance of context

One of the most basic tenants of all data science is that data doesn’t exist in a vacuum, it is the result of a massive pipeline of explicit and implicit decisions, yet so much of the output of the data science world proceeds as if data can be cleanly separated from the contexts in which it is created. Nowhere is this more apparent than the world of web archiving. —Kalev Leetaru @ Forbes

The post Worth Reading: Web archiving and the importance of context appeared first on rule 11 reader.

Worth Reading: Making mainstream switches malleable

While the hyperscalers of the world are pushing the bandwidth envelope and are rolling out 100 Gb/sec gear in their Ethernet switch fabrics and looking ahead to the not-too-distant future when 200 Gb/sec and even 400 Gb/sec will be available, enterprise customers who make up the majority of switch revenues are still using much slower networks, usually 10 Gb/sec and sometimes even 1 Gb/sec, and 100 Gb/sec seems like a pretty big leap. —Timothy Prickett Morgan @ The Next Platform

The post Worth Reading: Making mainstream switches malleable appeared first on rule 11 reader.

Worth Reading: What we learn in transitioning from card catalogs

When we transition to a new technology, do we lose valuable metadata? Could errors be introduced in the process of transfer of data from one medium to another? It’s an issue society has already had to confront — when the world’s libraries transitioned to digital and online catalogs from their older systems based on paper cards. —David Cassel @ The New Stack

The post Worth Reading: What we learn in transitioning from card catalogs appeared first on rule 11 reader.

On the ‘web: Hyperconvergence in the Network

First there is white box; the networking world is already moving in this direction. While network devices, such as firewalls, routers, and switches were once purchased in an “appliance” model, many parts of the networking world are quickly moving towards a disaggregated model, where the hardware and software are purchased as separate “things.” This enables the concept of white box—although the box might not actually be white. The terms “bright box” and “grey box” attempt to capture the reality that you might still buy boxes from brand named vendors, but rather than buying them for their software capabilities, you can now buy them for their hardware capabilities.

The post On the ‘web: Hyperconvergence in the Network appeared first on rule 11 reader.