Should Firewalls Track TCP Sequence Numbers?

It all started with a tweet by Stephane Clavel:

Trying to fit my response into the huge Twitter reply field I wrote “Tracking Seq# on FW should be mostly irrelevant with modern TCP stacks” and when Gal Sagie asked for more elaboration, I decided it’s time to write a blog post.

Read more ...

Some notes on the Norse collapse

Recently, cybersec company "Norse Security" imploded. Their leaders and most the employees were fired, and their website is no longer available. I thought I'd write up some notes on this.

All VC-funded startups are a scam

Here's how VCs think. They see that there is a lot of industry buzz around "threat intel". They'll therefore fund a company in that space. This company will spend a 5% of that money to create a cool prototype, and 95% in marketing and sales. They'll have fancy booths at trade shows. They'll have a PR blitz to all the reporters who cover the industry. They'll bribe Gartner to be named a Cool Vendor or Magic Quadrant Leader. They'll win industry kudos. They have some early sales 'wins' with some major customers. These customers will give glowing reviews of the product they bought -- even before turning it on.

In other words, it's a perfect "Emperor Has No Clothes" story, where neither customers, nor Gartner, nor the press is competent to realize the Emperor is not wearing clothes.

VCs know it's a scam, but they are hoping it'll become real. As a well-known leader in this space, employees with the needed expertise will flock Continue reading

FireEye acquires Invotas for faster incident response

FireEye said Monday it has acquired Invotas, a company that develops a platform that helps administrators respond faster to security incidents.The deal closed on Monday, but terms were not disclosed.FireEye, which started out with an end-point protection product, has been seeking to expand the range of security products and services it offers as cybersecurity has become a growing concern for companies.Invotas, based in Alexandria, Virginia, has a single product, its Security Orchestrator. The platform is designed to take in information from a range of security products from different vendors and automate responses when an incident is detected.To read this article in full or to leave a comment, please click here

Data Center Networking – Openstack Neutron networking terms demystified!

Coming from a networking background I am used to the various TLAs (ironically: Three Letter Acronyms) and terms that sometime mean the same but completely different otherwise. Networking in the data-center is no different. People have now slowly moved away from a leaf-spine topology where an advanced pricey piece of equipment sits in the spine and relatively cheaper leaf devices connect the hosts and servers. We now have an old architecture that was used during telephony in a new form with new terms. Terms such as "Clos topology" where the the leaf-spine architecture is replaced by layers or levels of similar cheaper hardware allowing flexibility in its configuration forming a sort of mesh making it both scalable and reliable; and special protocols such as DCTCP (Data Center TCP) being interspersed in technical papers and company technology presentations. An outlook of these technologies is big enough to be a completely separate read and so I will not venture into it here.

Google's datacenter - Clos Topology research & implementation
Facebooks' datacenter  architecture - 5 stage clos topology

With all these changes in the data center we now also see administrators isolating a complete data center/s or carving them Continue reading

This bird could be a drone’s worst enemy

When it comes to the problem of stopping errant drones, there's been a number of high-tech solutions -- from radio jamming to laser beams to nets launched by other drones  --  but a group in The Netherlands is proposing a low-tech solution that's much more elegant.Guard From Above says it is training birds of prey to attack drones, taking advantage of their natural predatory instincts and precision in the sky.A video posted by the company on YouTube shows a bird attacking a DJI Phantom drone as it hovers, grabbing the drone with its feet and flying away with it.To read this article in full or to leave a comment, please click here

This bird could be a drone’s worst enemy

When it comes to the problem of stopping errant drones, there's been a number of high-tech solutions -- from radio jamming to laser beams to nets launched by other drones  --  but a group in The Netherlands is proposing a low-tech solution that's much more elegant. Guard From Above says it is training birds of prey to attack drones, taking advantage of their natural predatory instincts and precision in the sky. A video posted by the company on YouTube shows a bird attacking a DJI Phantom drone as it hovers, grabbing the drone with its feet and flying away with it.To read this article in full or to leave a comment, please click here

Microsoft Edge InPrivate browsing mode is full of fail and not private

Microsoft’s InPrivate browsing is supposed to help you “surf the web without leaving a trail” and InPrivate browsing mode can be used in Edge. Microsoft says, “When you use Microsoft Edge in InPrivate mode, your browsing information, such as cookies, history, or temporary files, aren’t saved on your device after your browsing session has ended. Microsoft Edge clears all temporary data from your device.” Yet InPrivate browsing with Edge is a fail as it is not private and instead keeps browsing history.To read this article in full or to leave a comment, please click here

8 hot technologies the CIA wants

Of interest to the CIAThe CIA has been investing in startups since 1999 through its not-for-profit arm called In-Q-Tel, hoping to accelerate development of technologies the agency might find useful. It currently lists about 100 firms in its portfolio. The agency doesn’t say why it might be interested in the technologies these companies represent, but with a little imagination it’s not that hard to figure out possibilities. Here is a sample of what they’ve been interested in lately.To read this article in full or to leave a comment, please click here

Your Docker Agenda for February

This month is packed with plenty of great events to learn about all things Docker! From webinars to workshops, meetups to conference talks, check out our list of events that are coming up in February.   Official Docker Training Courses … Continued

Law professor: T-Mobile’s Binge On program violates Net neutrality

A T-Mobile service called Binge On that allows subscribers to consume as much data as they want while streaming video from selected providers violates Net neutrality rules, according to a published analysis from Stanford University legal scholar Barbara van Schewick.Net neutrality’s core tenet is that service providers shouldn’t be allowed to discriminate between different types of traffic they’re asked to carry. By offering some video services – including Netflix, Hulu and HBO – and not others as “free” streaming options, and not counting mobile data consumed from those services toward a user’s monthly cap, T-Mobile is essentially favoring some kinds of video content over others, van Schewick wrote.To read this article in full or to leave a comment, please click here

Another Good Year for Ansible Users

Jan16-Community-blog-header.png

It seems like just yesterday that we were putting together the recap of Ansible's community growth in 2014. That was a very good year.

Here we are at the start of 2016 already -- and looking back on 2015, it was an even better year than 2014 was.

First, let's take a look at the numbers. For consistency's sake, we'll mostly compare to 2014 numbers, which can be found in last year's analysis.  Note that the same caveats from last year's analysis also apply this year.

Debian Popcon

popcon-png

Debian’s Popularity Contest is an opt-in way for Debian users to share information about the software they’re running on their systems.  Although it represents only a small sample of the Linux distro world, it’s useful because it’s one of the few places where we can really see an apples-to-apples comparison of install bases of the various tools. Because Ansible is agentless, we compare the Ansible package to the server packages of other configuration management tools.

For the first time in 2015, Ansible installations on this chart outnumbered Puppetmaster installations. Ansible shows continued strong growth, and appears to remain on an upward trend into 2016.

Caveats abound with this chart, but it does Continue reading

Another Good Year for Ansible Users

Jan16-Community-blog-header.png

It seems like just yesterday that we were putting together the recap of Ansible's community growth in 2014. That was a very good year.

Here we are at the start of 2016 already -- and looking back on 2015, it was an even better year than 2014 was.

First, let's take a look at the numbers. For consistency's sake, we'll mostly compare to 2014 numbers, which can be found in last year's analysis.  Note that the same caveats from last year's analysis also apply this year.

Debian Popcon

popcon-png

Debian’s Popularity Contest is an opt-in way for Debian users to share information about the software they’re running on their systems.  Although it represents only a small sample of the Linux distro world, it’s useful because it’s one of the few places where we can really see an apples-to-apples comparison of install bases of the various tools. Because Ansible is agentless, we compare the Ansible package to the server packages of other configuration management tools.

For the first time in 2015, Ansible installations on this chart outnumbered Puppetmaster installations. Ansible shows continued strong growth, and appears to remain on an upward trend into 2016.

Caveats abound with this chart, but it does Continue reading

The Endpoint Security Continuum

My colleague Doug Cahill and I are knee deep into a research project on next-generation endpoint security.  As part of this project, we are relying on real-world experience so we’ve interviewed dozens of cybersecurity professionals working at enterprise organizations (i.e. more than 1,000 employees) who have already deployed new types of endpoint security software.Now all of the organizations we interviewed are already running antivirus tools but day-to-day responsibilities are often delegated to an IT operations team rather than the infosec staff.  So organizations are at somewhat of a disadvantage because they delegated it to an IT generalist team.  Still, many of the organizations we’ve interviewed have turned on all of their AV’s advanced features and are still being compromised.To read this article in full or to leave a comment, please click here

Worth Reading: Standardized Models For Networking

From an operator’s perspective, one challenge with network automation is the lack of standard interfaces. In other words, it’s hard to configure a network programmatically if the details vary from device to device. Today, most operators know these differences in the form of CLI syntax. For example, the commands required to configure BGP on a Cisco device running IOS differ from the commands required to accomplish the same task on a Juniper device running Junos. -via packet pushers

The post Worth Reading: Standardized Models For Networking appeared first on 'net work.

A Patreon Architecture Short

Patreon recently snagged $30 Million in funding. It seems the model of pledging $1 for individual feature releases or code changes won't support fast enough growth. CEO Jack Conte says: We need to bring in so many people so fast. We need to keep up with hiring and keep up with making all of the things.

Since HighScalability is giving Patreon a try I've naturally wondered how it's built. Modulo some serious security issues Patreon has always worked well. So I was interested to dig up this nugget in a thread on the funding round where the Director of Engineering at Patreon shares a little about how Patreon works:

  • Server is in Python using Flask and SQLAlchemy, 
  • Runs on AWS (EC2, RDS (MySQL), and some Redis, Celery, SQS, etc. to boot). 
  • A few microservices here and there in other languages too (e.g. real time chat server with Node & Firebase)
  • Web code is written in React (with some legacy code in Angular). We tend to use Redux for the non-component pieces, but are still trying out new React-compatible libraries here and there.
  • iOS and Android code are written in Objective-C and Java, respectively. 
  • We use Realm on both platforms for Continue reading

Trojanized Android games hide malicious code inside images

Over 60 Android games hosted on Google Play had Trojan-like functionality that allowed them to download and execute malicious code hidden inside images.The rogue apps were discovered by researchers from Russian antivirus vendor Doctor Web and were reported to Google last week. The researchers dubbed the new threat Android.Xiny.19.origin.Malicious Android apps were a common occurrence on Google Play until a few years ago when Google implemented more rigorous checks. This included an automated scanner called Bouncer that used emulation and behavior-based detection.Bypassing Bouncer detection is not impossible, but is hard enough to keep most malware creators away. Most Android Trojans these days are distributed through third-party app stores, targeting users who have enabled the installation of apps from "unknown sources."To read this article in full or to leave a comment, please click here

1 … 3,090 3,091 3,092 3,093 3,094 … 3,773