Walking the Policy Tightrope

In policy work nothing is ever truly simply black and white. The means to achieve one outcome may well act to impair the work to achieve different outcomes, and the resultant effort often requires some difficult decisions to balance what appears to be some fundamental tensions between various policy objectives. Even a topic like online safety, which should be very straightforward, has some challenges.

Streamlining the User Experience for Accessing AKS Clusters

Lately I’ve been spending a little bit of time building Pulumi programs to assist with standing up Azure Kubernetes Service (AKS) clusters. I’ve learned a pretty fair amount about Azure and AKS along the way, as expected, but I was taken aback by the poor user experience (in my opinion) when it came to accessing the AKS clusters once they’d been established. In this post, I’ll share a small tweak you can make that will, in most cases, make accessing your AKS clusters a great deal smoother.

What do I mean by “poor user experience”? In the same vein as comparable offerings from AWS (EKS) and Google Cloud (GKE), AKS leverages Azure’s identity and access management (IAM) functionality, so that users have a single place to manage user and group entities. This makes perfect sense! What doesn’t make sense to me, though, is the requirement that users must perform a separate login process to gain access to the cluster, even if the user is already authenticated via the Azure CLI. This is very counter to both EKS and GKE, where—if you are already authenticated via their CLI tools—no additional steps are necessary to access appropriately-configured managed Kubernetes clusters on their Continue reading

Kyndryl, Microsoft tie mainframe to Azure cloud resources

Kyndryl and Microsoft have extended their existing partnership to include mainframe connectivity to cloud applications and workloads.The extension ties together Kyndryl’s zCloud mainframe service with Microsoft’s Power Platform, a low-code application and workflow-automation package that brings access to cloud services including  Microsoft Azure, Office 365 and Teams.The aim is making it easier for organizations to access and integrate mainframe-based data with cloud-based resources and combine that data with other information to build new applications.Available now, the service is a way to access decades of data sitting on  mainframes, said Harish Grama, Kyndryl’s global practice leader for cloud. “The idea is to unleash data sitting on the mainframe, mine it, modernize it, and write new business applications on it," he said. "That data shouldn’t be trapped in legacy backends.”To read this article in full, please click here

Total TLS: one-click TLS for every hostname you have

Total TLS: one-click TLS for every hostname you have
Total TLS: one-click TLS for every hostname you have

Today, we’re excited to announce Total TLS — a one-click feature that will issue individual TLS certificates for every subdomain in our customer’s domains.

By default, all Cloudflare customers get a free, TLS certificate that covers the apex and wildcard (example.com, *.example.com) of their domain. Now, with Total TLS, customers can get additional coverage for all of their subdomains with just one-click! Once enabled, customers will no longer have to worry about insecure connection errors to subdomains not covered by their default TLS certificate because Total TLS will keep all the traffic bound to the subdomains encrypted.

A primer on Cloudflare’s TLS certificate offerings

Universal SSL — the “easy” option

In 2014, we announced Universal SSL — a free TLS certificate for every Cloudflare customer. Universal SSL was built to be a simple “one-size-fits-all” solution. For customers that use Cloudflare as their authoritative DNS provider, this certificate covers the apex and a wildcard e.g. example.com and *.example.com. While a Universal SSL certificate provides sufficient coverage for most, some customers have deeper subdomains like a.b.example.com for which they’d like TLS coverage. For those customers, we built Advanced Certificate Manager — a Continue reading

IPv6 Buzz 111: IPv6 And The Public Cloud

What's the state of IPv6 in the public cloud? What support is available in which of the major providers? What are the cloud challenges of v6? How does v6 affect multi-cloud architectures? The latest episode of the IPv6 Buzz podcast examines these and other v6 questions for public cloud.

How to Reduce Varicose Veins from a Sedentary Lifestyle

Varicose veins are a common condition that occurs when the valves in the veins become damaged and allow blood to flow backwards. This can cause the veins to become enlarged and twisted. Although varicose veins can occur at any age, they are more common in people over the age of 50 and in women who have been pregnant. People who have a sedentary lifestyle are also at increased risk for developing varicose veins. The good news is that there are several things you can do to reduce your risk of developing varicose veins.

Ways to Reduce Varicose Veins from a Sedentary Lifestyle

Exercise regularly

Doing regular physical activity helps keep the blood flowing throughout your body. Aim for 30 minutes of aerobic exercise at least five days a week. Walking, jogging and swimming are all good activities to help reduce your risk of developing varicose veins.

Wear compression stockings

Compression stockings are tight-fitting stockings that help reduce the pressure in your veins, which can help prevent varicose veins from developing. Your doctor can recommend the best type of stocking for you.

Elevate your legs

Lying down and propping your legs up above your heart can help reduce the pressure in Continue reading

More Arista EOS BGP Route Reflector Woes

Most BGP implementations I’ve worked with split the neighbor BGP configuration into two parts:

  • Global configuration that creates the transport session
  • Address family configuration that activates the address family across a configured transport session and changes the parameters that affect BGP updates

AS numbers, source interfaces, peer IPv4/IPv6 addresses, and passwords clearly belong to the global neighbor configuration.

Starting with EOS release 4.29.0F, you can configure the neighbor next-hop-self option within IPv4 and IPv6 address families. Great job! Hopefully, we can consider this blog post a historical curiosity.
Read more …

More Arista EOS BGP Route Reflector Woes

Most BGP implementations I’ve worked with split the neighbor BGP configuration into two parts:

  • Global configuration that creates the transport session
  • Address family configuration that activates the address family across a configured transport session, and changes the parameters that affect BGP updates

AS numbers, source interfaces, peer IPv4/IPv6 addresses, and passwords clearly belong to the global neighbor configuration.

Read more …

Aryaka Adds Secure Web Gateway, Firewall Service To Its SD-WAN And Security Capabilities

Aryaka is introducing both a Secure Web Gateway (SWG) and a Firewall-as-a-Service (FWaaS) offering to complement its SD-WAN capabilities. Many vendors, including Aryaka, are extending their SD-WAN offering to include security functions delivered as-a-service via Points of Presence (PoPs) or public clouds. This as-a-service approach makes it easier for customers to consume security services because […]

The post Aryaka Adds Secure Web Gateway, Firewall Service To Its SD-WAN And Security Capabilities appeared first on Packet Pushers.

Report: Price of flash memory to drop faster, further in Q4

Back in August, TrendForce Research predicted that due to an oversupply in NAND flash memory, the price of SSDs could drop by 5% to 10% in the third quarter.Since then, the economy has only worsened and the oversupply has continued, and while TrendForce hasn't reported the Q3 actuals, it's now predicting 15% to 20% drop in NAND flash prices in the fourth quarter on top of the Q3 drop..TrendForce says buyers of NAND flash memory—vendors that make SSDs but don’t manufacture their own memory—have reduced their NAND inventory and cut back on new purchases in the second half of the year. Meanwhile makers of memory drastically reduced prices to boost sales. Now TrendForce predicts that before the end of the year, suppliers will be selling memory at a loss and reduce production.To read this article in full, please click here

Report: Price of flash memory to drop faster, further in Q4

Back in August, TrendForce Research predicted that due to an oversupply in NAND flash memory, the price of SSDs could drop by 5% to 10% in the third quarter.Since then, the economy has only worsened and the oversupply has continued, and while TrendForce hasn't reported the Q3 actuals, it's now predicting 15% to 20% drop in NAND flash prices in the fourth quarter on top of the Q3 drop..TrendForce says buyers of NAND flash memory—vendors that make SSDs but don’t manufacture their own memory—have reduced their NAND inventory and cut back on new purchases in the second half of the year. Meanwhile makers of memory drastically reduced prices to boost sales. Now TrendForce predicts that before the end of the year, suppliers will be selling memory at a loss and reduce production.To read this article in full, please click here

Using bash options to change the behavior of scripts

Bash provides a large number of options that can be used to control the behavior of bash scripts. This post examines some of the more useful ones and explains how to display which options are in use and which are not.Exiting when an error occurs If you want a bash script to exit soon as it encounters an error—any error at all—in your scripts, you can add the set -o errexit option. If your script contains a syntax error, tries to read a file that doesn’t exist, attempts to append to a file when you don’t have permission to do so, or misuses a command in some way, the script will end abruptly. Here is a simple example:#!/bin/bash set -o errexit tail NoSuchFile echo -n “Enter text to be appended> “ read txt echo $txt >> NoSuchFile Try to run this script, and you’ll see this:To read this article in full, please click here

Using bash options to change the behavior of scripts

Bash provides a large number of options that can be used to control the behavior of bash scripts. This post examines some of the more useful ones and explains how to display which options are in use and which are not.Exiting when an error occurs If you want a bash script to exit soon as it encounters an error—any error at all—in your scripts, you can add the set -o errexit option. If your script contains a syntax error, tries to read a file that doesn’t exist, attempts to append to a file when you don’t have permission to do so, or misuses a command in some way, the script will end abruptly. Here is a simple example:#!/bin/bash set -o errexit tail NoSuchFile echo -n “Enter text to be appended> “ read txt echo $txt >> NoSuchFile Try to run this script, and you’ll see this:To read this article in full, please click here

Join our upcoming live roadshow series: ‘Zero Trust, Zero Nonsense’

Join our upcoming live roadshow series: ‘Zero Trust, Zero Nonsense’
Join our upcoming live roadshow series: ‘Zero Trust, Zero Nonsense’

Many companies now believe that Zero Trust is the answer to common perimeter network infrastructure problems. But they sometimes struggle to make the progress they’d like, frequently pushing adoption timelines back.

The most common reason we hear from our customers is: “We aren’t sure how to get started.” There’s a lot of Zero Trust talk in the market, but comparatively little substance — leading to uncertainty about how to proceed.

Businesses need a strategy for tackling Zero Trust adoption and security modernization one step at a time. Cloudflare wants to help. So we’re hosting in-person discussions with security and IT leaders to do just that.

We’re hosting a series of Zero Trust Roadshows in various North American cities. These events will feature Cloudflare executives, industry experts, and other organizations like yours, and focus on ways of breaking the Zero Trust roadmap into manageable pieces, allowing organizations to make steps towards:

  • Augmenting (or replacing) a VPN: Provide simple, secure access to resources and maintain a great employee experience, while mitigating risk of lateral movement—a favorite hacker and ransomware tactic.
  • Streamlining SaaS security: Empower IT with the visibility and controls of SaaS apps and email they deserve to better care for Continue reading

Supporting next level IXP topologies

Netlab 1.4 sneak preview (unofficial)

Output of ‘fdp’ layout for ‘netlab create -o graph’

Imagine you are an IXP deploying technologies like RFC9161 EVPN with proxy ARP and MPLS over RSVP-TE, and you need to come up with a validated multi-vendor design. How would you go about that?

The Netlab team has got you covered. Check out this example — a sneak preview with upcoming Netlab 1.4 features (work in progress)

  • S1/S2 are data center routers doing EVPN/VXLAN with proxy ARP; iBGP control plane and ISIS IGP. Anycast gateways are available in the ‘red-hot’ vlan
  • C1/C2 are core nodes doing SRv6 over ISIS (one might call this BGP-Free :)
  • PE1/PE2 are MPLS core nodes doing MPLS EVPN over LDP, with OSPF
netlab up

…is all it takes to bring this topology to life!

Customer h1 can ping h4 across this ultimate feature fabric
Resulting interface configuration on s1 (SR Linux)
Sample ISIS/SRv6 configuration on c1 (SR OS)
1 … 377 378 379 380 381 … 3,793