The Back Door Feature Problem

In Don’t Forget to Lock the Back Door! A Characterization of IPv6 Network Security Policy, the authors ran an experiment that tested for open ports in IPv4 and IPv6 across a wide swath of the network. What they discovered was interesting—

IPv6 is more open than IPv4. A given IPv6 port is nearly always more open than the same port is in IPv4. In particular, routers are twice as reachable over IPv6 for SSH, Telnet, SNMP, and BGP. While openness on IPv6 is not as severe for servers, we still find thousands of hosts open that are only open over IPv6.

This result really, on reflection, should not be all that surprising. There are probably thousands of networks in the world with “unintentional” deployments of IPv6. The vendor has shipped new products with IPv6 enabled by default, because one large customer has demanded it. Customers who have not even thought about deploying IPv6, however, end up with an unprotected attack surface.

The obvious solution to this problem is—deploy IPv6 intentionally, including security, and these problems will likely go away.

But the obvious solution, as obvious as it might be, is only one step in the right direction. Instead of just Continue reading

Worth Reading: The Wandera Report

The Wandera 2017 Mobile Leak Report, a global analysis of almost 4 billion requests across hundreds of thousands of corporate devices, found more than 200 mobile websites and apps leaking personally identifiable information across a range of categories – including those that are essential for work. —The Internet Society

The post Worth Reading: The Wandera Report appeared first on 'net work.

Worth Reading: A review of technical developments in cryptography

The biggest practical development in crypto for 2016 is Transport Layer Security version 1.3. TLS is the most important and widely used cryptographic protocol and is the backbone of secure Internet communication; you’re using it right now to read this blog! After years of work by hundreds of researchers and engineers, the new TLS design is now considered final from a cryptography standpoint. —EFF

The post Worth Reading: A review of technical developments in cryptography appeared first on 'net work.

Writing Tools: 2017

From time to time, folks ask me about how I write so much, or rather “how do you get so much done???” The reality is I tend to be very focused on tools and process. As I just revisited my tools over the new year, particularly when looking at a lot of new material that needs to be written, I thought it might be helpful to someone, perhaps, to write a post about what I’m using as the year turns over. Right now, I use—

• Word
• OneNote
• Zotero
• Notepad++
• Smartedit
• CorelDRAW
• Acrobat Standard

I know I’m “old fashioned” in this tool set; I don’t do fancy markdown, markup, marksideways, or any of that stuff. I don’t swear by a platform (I don’t have a dog in the the Apple versus Microsoft fight), etc. But this set of tools has been modified, thought, and rethought across the last 20 years and the writing of millions of words of text contained in hundreds of papers, 11 books, many hours of classroom time, etc. I have been through periods when I really focused on finding some cool new tool to write with, maybe trying to “get rid of distractions,” or whatever else. Continue reading

Worth Reading: Smile vector

Smile Vector is a Twitter bot that can make any celebrity smile. It scrapes the web for pictures of faces, and then it morphs their expressions using a deep-learning-powered neural network. Its results aren’t perfect, but they’re created completely automatically, and it’s just a small hint of what’s to come as artificial intelligence opens a new world of image, audio, and video fakery. Imagine a version of Photoshop that can edit an image as easily as you can edit a Word document — will we ever trust our own eyes again? —The Verge

The post Worth Reading: Smile vector appeared first on 'net work.

Worth Reading: Monitoring in containers

Monitoring is the hidden hero inside container infrastructure. Much like driving a car, we don’t think about what’s happening under the hood until something goes wrong. We want to pivot away from being reactive with our infrastructure and container problems and move to a more proactive state of operation using monitoring insights to keep us up and running. —The New Stack

The post Worth Reading: Monitoring in containers appeared first on 'net work.

Looking Back, Looking Forward

On this, the first “real” post of 2017, I thought it would be useful to reflect on the year that has passed, and consider the year that is coming. First off, 2016 in numbers—

• Read 58 Books (15333 pages)
• 115,739 blog visits (according to WordPress)
• Wrote 110,000 words for blogs, technical papers, etc.
• Wrote 25,000 words for PhD seminars, etc.
• Created 850 slides
• Recorded 14 hours of videos/webinars

These are all conservative numbers for the most part… I’ve not included journal and blog reading, nor have I tried to accurately count my writing output, as I often find it more frustrating than worthwhile. In the coming year, I plan to finish a book with Pearson, record at least one more video series (potentially more), and continue apace with blogging and other writing.

In 2016, I think we started to see the future of the networking market actually take shape. There seem to be three prongs developing; either companies will move their processing to the cloud, they will move to more hyperconverged/vertical solutions (essentially outsourcing design and architecture to vendors and consulting firms), or move to disaggregation. The day of the router as an appliance is done; we are moving to Continue reading

Worth Reading: Getting started with coding

If you work with computers in any aspect of your life, being able to code can be a very powerful tool. All too often however, I hear people say things like “it’s too difficult” or “I’m not a developer” and they never take more than their first few steps. This post, the first in a series on getting started with coding, addresses both the fears of taking your first steps and the benefits of starting that journey. The remaining posts then give you all the help you need to overcome those perceived obstacles and have some fun along the way. —vegaskid

The post Worth Reading: Getting started with coding appeared first on 'net work.

Merry Christmas!

‘net Work will be shut down next week so I can take a breather, spend some time with family, and get some of my todo list done…

The post Merry Christmas! appeared first on 'net work.

Worth Reading: Leaving it to the last second

Thanks to the moon, the earth’s rate of rotation is slowing down. It’s a subtle interaction and the modeling of planetary dynamics predicts that the earth’s rotation should be slowing down by an average of 2.3 milliseconds per century. But this is not quite so uniform, as the Economist reported in December on work of analyzing ancient records of solar eclipses… —CircleID

The post Worth Reading: Leaving it to the last second appeared first on 'net work.

Worth Reading: The year of silicon photonics

Computing historians may look back on 2016 as the Year of Silicon Photonics. Not because the technology has become ubiquitous – that may yet be years away – but because the long-awaited silicon photonics offerings are now commercially available in networking hardware. While the advancements in networking provided by silicon photonics are indisputable, the real game changer is in the CPU. —The Next Platform

The post Worth Reading: The year of silicon photonics appeared first on 'net work.

2016 Lessons Learned

The post 2016 Lessons Learned appeared first on 'net work.

Worth Reading: The coming era of edge computing

Edge computing is a natural next step from cloud computing. The computer industry shifts back and forth from centralized computing, which has lots of power but is far away from the person or device using it, to local computing, which is close to the action but messy and hard for a user to harness all of its capacity. For instance, mainframes (centralized computing) gave rise to PCs and client/server (decentralized), which gave rise to the cloud (centralized). So decentralized is due next. This is the breathing in and out of the computer industry. —Business Insider

The post Worth Reading: The coming era of edge computing appeared first on 'net work.

Worth Reading: Driverless infrastructure

It turns out machines can deploy software much better than humans can. Why? Because software deployment is a set of mechanical procedures that can be driven by a declarative language. It is a process primed for a systematic approach done right, and reproducibly. This is especially important as patches and security fixes are applied to software — a ritual that should be repeatable and seamless. —The New Stack

The post Worth Reading: Driverless infrastructure appeared first on 'net work.

Cell Phone

The post Cell Phone appeared first on 'net work.

Worth Reading: The spillover effect

At the same time that default and end-to-end encryption enables dissidents to communicate, it also enables terrorists and other criminals to plot and plan without fear of detection. It means that even when a judge signs off on a warrant based on probable cause to believe that a particular device or account contains evidence of a crime that has been or is about to be committed, law enforcement cannot unlock the smartphone or obtain the relevant data in readable form. The concern is that criminals may go free, and dangerous plots may be left undetected. Comey and other law enforcement officials want US-based companies to provide sought-after data in readable form and to maintain the technological capacity to do so. But the approach is controversial; a powerful coalition of companies, civil liberties groups, and many others decries such efforts at mandated access as undercutting security for us all. —The Hoover Institution

The post Worth Reading: The spillover effect appeared first on 'net work.

Worth Reading: Information paralysis

Modern Western man is suffering from an information overload. There are now over one million new books published each year in just the U.S., large newspapers publish anywhere from 1,000 to 5,000 pieces of content per week, and it’s now reported that 3 million blog posts are written every day. The exponential amount of information produced today is no doubt impressive. But it’s also paralyzing. And it’s also harmful for a culture. —Intellectual Takeout

The post Worth Reading: Information paralysis appeared first on 'net work.

Chalet Roof

The post Chalet Roof appeared first on 'net work.

Worth Reading: Ransom by spreading the infection

Researchers say they have uncovered ransomware still under development that comes with a novel and nasty twist. Infected victims of the ransomware known as Popcorn Time, have the option to either pay up, or they can opt to infect two others using a referral link. If the two new ransomware targets pay the ransom, the original target receives a free key to unlock files on their PC. —threatpost

The post Worth Reading: Ransom by spreading the infection appeared first on 'net work.

Worth Reading: The canary

Using a canary is no longer a nice-to-have capability for internet companies—it’s a necessity. The traditional operational models of software system development, qualification, deployment, and operation simply cannot keep up with the velocity of change required for an internet-based company to thrive. Put simply, when the minimum required velocity for change is high enough, you have no option but to take intelligent risks. —LinkedIn Engineering Blog

The post Worth Reading: The canary appeared first on 'net work.