Worth Reading: Password and security recommendations

Rather than just regurgitate the usual unworkable advice (make each password 14 different random characters, change them every week, and never write them down) we tried to look at the real threats on the current Internet and offer advice that makes sense today. The password advice does recommend strong passwords or pass phrases, but then mostly talks about operational issues: do encrypt channels where passwords are sent via HTTPS or the like, do use multiple factors where possible, do use federated authentication to minimize the number of passwords people have to use, do make users change default passwords before using a new account, and don’t do hard account lockouts after password failures (an easy way to harass your enemies.) While it does say to make it easy for users to change passwords when they want, it doesn’t recommend required password changes, since that is counterproductive–people use a pattern like password1, password2, password3, write them down, or most likely both. —CircleID

The post Worth Reading: Password and security recommendations appeared first on rule 11 reader.

MegaSwitch: an interesting new data center fabric

Data center fabrics are built today using spine and leaf fabrics, lots of fiber, and a lot of routers. There has been a lot of research in all-optical solutions to replace current designs with something different; MegaSwitch is a recent paper that illustrates the research, and potentially a future trend, in data center design. The basic idea is this: give every host its own fiber in a ring that reaches to every other host. Then use optical multiplexers to pull off the signal from each ring any particular host needs in order to provide a switchable set of connections in near real time. The figure below will be used to explain.

In the illustration, there are four hosts, each of which is connected to an electrical switch (EWS). The EWS, in turn, connects to an optical switch (OWS). The OWS channels the outbound (transmitted) traffic from each host onto a single ring, where it is carried to every other OWS in the network. The optical signal is terminated at the hop before the transmitter to prevent any loops from forming (so A’s optical signal is terminated at D, for instance, assuming the ring runs clockwise in the diagram).

The receive Continue reading

Worth Reading: AI driven networks

Few realize how little has changed in the way that carriers and operators build, utilize and manage their networks. Whether due to the fact that carrier-grade performance relies on stringent, rigid equipment, or because the industry is held captive by giants who enjoy the status quo, the sad fact is that the industry has stagnated over the years. With the advent of 5G, this ‘stability’ will likely soon to come to an end. The sheer amount of traffic, and the different types of traffic traversing the network, will require a different way of networking. Networking will need to evolve to a new level, one where more of today’s currently manual tasks will be handed off to automation. Networking will require the induction of artificial intelligence, machine learning and big data, leading to a more ‘cognitive, self-driven’ type of network. —ECI

The post Worth Reading: AI driven networks appeared first on rule 11 reader.

Worth Reading: Three characteristics

One of the first things a person on the leadership development journey should understand is that there is intrinsic value in developing character even if one never obtains external results from one’s endeavors. This is because who one becomes is much more important than what one accomplishes. —Chris Brady

The post Worth Reading: Three characteristics appeared first on rule 11 reader.

Flags and Flagpoles

The post Flags and Flagpoles appeared first on rule 11 reader.

Worth Reading: Will self driving cars be safe?

Analysts estimate that by 2030, self-driving cars and trucks (autonomous vehicles) could account for as much as 60 percent of US auto sales. That’s great! But autonomous vehicles are basically computers on wheels, and computers crash all the time. Besides that, computers get hacked every day. So you gotta ask, “Can self-driving cars ever really be safe?” No. Self-driving cars can never really be safe. They will be safer! So much safer that it’s worth a few minutes to understand why. —Shelly Palmer

The post Worth Reading: Will self driving cars be safe? appeared first on rule 11 reader.

Worth Reading: A usability approach to interdependent privacy in cloud apps

Given this state of affairs, the authors consider what practical steps can be taken to make users more aware of potential privacy loss, and perhaps change their decision making processes, when deciding which third-party apps should have access to files. Their elegant solution involves a privacy indicator (extra information shown to the user when deciding to grant a third-party app permissions) which a user study shows significantly increases the chances of a user making privacy-loss minimising decisions. Extrapolating the results of this study to simulations of larger Google Drive networks and an author collaboration network show that the indicator can help reduce privacy loss growth by 40% and 70% respectively. —the morning paper

The post Worth Reading: A usability approach to interdependent privacy in cloud apps appeared first on rule 11 reader.

Monkey on a Wire

The post Monkey on a Wire appeared first on rule 11 reader.

Worth Reading: An opaque alternative to oblivious cloud analytics

Even as encryption methods and security procedures have improved, the data is still at risk of being attacked through such vulnerabilities as access pattern leakage through memory or the network. It’s the threat of an attack via access pattern leakage that a group of researchers from UC Berkeley wanted to address when they developed an “oblivious” distributed data analytics platform that leverages the hardware enclave technology available in Intel’s Software Guard Extensions (SGX). The sensitive nature of much of the data that is being collected and analyzed in the cloud – from medical and financial data to user information like emails and shopping histories – makes it an attractive target for cyber-criminals, so the need to protect the data in such cloud environments is growing. —The Next Platform

The post Worth Reading: An opaque alternative to oblivious cloud analytics appeared first on rule 11 reader.

Worth Reading: Seven steps to successful IPv4 transfers

In the northern hemisphere, spring is arriving; the trees are blooming, the grass is greening, and the sun is shining. In the southern hemisphere, autumn is approaching and the long lazy summer is coming to an end. But in the IPv4 transfer market space, it is hot, steamy, and full of action! The transfer market is booming. Hundreds of millions of IPv4 addresses are being transferred between buyers and sellers. The market is a fast-moving place, and so it is important to square away a few key items before you start making enquiries.—APNIC

The post Worth Reading: Seven steps to successful IPv4 transfers appeared first on rule 11 reader.

Worth Reading: TIIME to pay attention to identity

The global Research and Education (R&E) community has led the way in developing and fine-tuning the technologies and associated policies that enable Federated IAM to work well, and the technology has become core infrastructure for R&E worldwide. Industries and governments around the world have adopted various aspects of Federated IAM around the world, with more certain to follow. Federations tend to be set up around logical constituencies, such as a local or federal government offering services to its constituents, or vertical industries such as automotive or pharmaceuticals. In the R&E sector federations tend to be national or built around particular fields of study, and in many cases they are run by or at least closely associated with National Research and Education Networks (NRENs). —Internet Society

The post Worth Reading: TIIME to pay attention to identity appeared first on rule 11 reader.

Administravia 20170420

A couple of minor items for this week. First, I’ve removed the series page, and started adding subcategories. I think the subcategories will be more helpful in finding the material you’re looking for among the 700’ish posts on this site. I need to work through the rest of the posts here to build more subcategoies, but what is there is a start. Second, I’ve changed the primary domain from rule11.us to rule11.tech, and started using the rule 11 reader name more than the ‘net Work name. rule11.us will still work to reach this site, eventually ntwrk.guru will time out and die. Finally, I’ve put it on my todo list to get a chronological post page up at some point.

Happy Reading!

The post Administravia 20170420 appeared first on rule 11 reader.

Worth Reading: Game of nodes

There’s a whirlwind of information on the topic of network commoditization. Seriously. Just search in your favorite search engine for “SDN,” “NFV,” or “telco cloud.” You will find dozens of open source projects, communities, forums, architectural definitions, standards, standard bodies, news articles, press releases, and blog sites dedicated to the aforementioned. With such a myriad of information, you’d think people out there would have a deep understanding of why these topics are creating so much noise. I make it a point to ask everyone I meet this simple question: “In a few sentences, what does telco cloud, NFV, or SDN mean to you?” In many cases, people generally just quote a bunch of buzz words — most of which I’m programmed to forget. Others jump into the “What” and “How” of these trends. Only a very few understand the “Why” and that there’s a fundamental challenge to the current business models in their industry. Something has to change. —New Stack

The post Worth Reading: Game of nodes appeared first on rule 11 reader.

Worth Reading: GraphQL

Practically speaking, the GraphQL layer lives between the client and one or more data sources, receiving client requests and fetching the necessary data according to your instructions. Confused? It’s metaphor time! The old REST model is like ordering pizza, then getting groceries delivered, then calling your dry cleaner to get your clothes. Three shops, three phone calls. GraphQL on the other hand is like having a personal assistant: once you’ve given them the addresses to all three places, you can simply ask for what you want (“get me my dry cleaning, a large pizza, and two dozen eggs”) and wait for them to return. —Free Code Camp

The post Worth Reading: GraphQL appeared first on rule 11 reader.

Worth Reading: Networking in Azure

Hybrid networking is a nice thing, but the question then is how do we define hybrid networking? For me, in the context of the connectivity to virtual networks, ExpressRoute’s private peering or VPN connectivity, it is the ability to connect cross-premises resources to one or more Virtual Networks (VNets). While this all works nicely, and we know how to connect to the cloud, how do we network within the cloud? There are at least 3 Azure built-in ways of doing this. In this series of 3 blog posts, my intent is to briefly explain… —Azure

The post Worth Reading: Networking in Azure appeared first on rule 11 reader.

Too Busy

The post Too Busy appeared first on rule 11 reader.

Worth Reading: IPv6 data exfiltration

The transition to internet protocol version 6 has opened up a whole new range of threat vectors that allow attackers to set up undetectable communications channels across networks, researchers have found. A paper has been published by researchers at the NATO defence alliance’s Cooperative Cyber Defence Centre of Excellence and Estonia’s Tallinn University of Technology. It outlines how attackers can create covert data exfiltration channels and system remote control, using IPv6 transition mechanisms. IPv6 aims to remove the technical drawbacks of the older IPv4 addressing scheme but brings its own fresh set of dangers, the researchers warned. Since IPv6 implementations and security solutions are relatively new and untested, and systems engineers aren’t fully aware of them, the new protocol can become a network backdoor attackers can exploit undetected. —itnews

The post Worth Reading: IPv6 data exfiltration appeared first on rule 11 reader.

Worth Reading: A new YANG module catalogue

From a high level point of this YANG catalog goal is to become a reference for all YANG modules available in the industry, for both YANG developers (to search on what exists already) and for operators (to discover the more mature YANG models to automate services). This YANG catalog should not only contain pointers to the YANG modules themselves, but also contains metadata related to those YANG modules: What is the module type (service model or not?) What is the maturity level? (for the IETF: is this a RFC, a working group document or an individual draft?), Is this module implemented? Who is the contact? Is there open-source code available? And we expect much more in the future. —Benoît Claise

The post Worth Reading: A new YANG module catalogue appeared first on rule 11 reader.

Optimal Route Reflection

There are—in theory—three ways BGP can be deployed within a single AS. You can deploy a full mesh of iBGP peers; this might be practical for a small’ish deployment (say less than 10), but it quickly becomes a management problem in larger, or constantly changing, deployments. You can deploy multiple BGP confederations; creating internal autonomous systems that are invisible to the world because the internal AS numbers are stripped at the real eBGP edge.

The third solution is (probably) the only solution anyone reading this has deployed in a production network: route reflectors. A quick review might be useful to set the stage.

In this diagram, B and E are connected to eBGP peers, each of which is advertising a different destination; F is advertising the 100::64 prefix, and G is advertising the 101::/64 prefix. Assume A is the route reflector, and B,C, D, and E are route reflector clients. What happens when F advertises 100::/64 to B?

• B receives the route and advertises it through iBGP to A
• A adds its router ID to the cluster list, and reflect the route to C, D, and E
• E receives this route and advertises it through its eBGP session towards G
• Continue reading

Worth Reading: PDoS attacks

Imagine a fast moving bot attack designed to render the victim’s hardware from functioning. Called Permanent Denial of Service attacks (PDoS attacks), this form of cyber-attack is becoming increasingly popular in 2017 as more incidents involving this hardware-damaging assault occur. Also known loosely as “phlashing” in some circles, PDoS is an attack that damages a system so badly that it requires replacement or reinstallation of hardware. By exploiting security flaws or misconfigurations, this type of cyber attack can destroy the firmware and/or basic functions of system. It is a contrast to its well-known cousin, DDoS attacks, which overloads systems with requests meant to saturate resources through unintended usage. —radware

The post Worth Reading: PDoS attacks appeared first on rule 11 reader.