iscoelho

10 ms·

91.
by iscoelho 2y ago
The largest DDoS attacks recorded are un-amplified and un-spoofed. The sources are malware (see Mirai and its variants) via legitimate internet connections. Even the largest ISPs generally do not have enough spare capacity to just "blo
92.
by iscoelho 2y ago
That is almost impossible pricing these days at any bandwidth level unless you are either a) renewing an existing contract without negotiation b) are negligently bad at negotiation and are being taken advantage of c) are self dealing /
93.
by iscoelho 2y ago
This article appears to be written from a solid Linux networking background, but not from an ISP networking background. ISPs at scale do not use software routers. They use ASIC routers (Juniper/Arista/Cisco/etc.), for many re
94.
by iscoelho 2y ago
100% on the business implications. Although a lot of engineers never have to touch it, DMA (& zero-copy) implementations are foundational to the performance of modern day computers that we sometimes take for granted.
95.
by iscoelho 2y ago
The performance would be absolutely horrendous if network drivers were programmed this way. DMA (Direct Memory Access) is all about avoiding deserialization and copies of the data.
96.
by iscoelho 2y ago
Haha, it's zero-copy! I never said it was "faster-copy" (-:
97.
by iscoelho 2y ago
The purpose of zero-copy can be to avoid deserialization at all. All you do to deserialize is: uint8_t *buf = ...; struct example_payload *payload = (struct example_payload *) buf; That's why when you access the variables you need to b
98.
by iscoelho 2y ago
memcpy is extremely slow. On any high-load Linux webserver, you can type "perf top" and see 20%~ of the CPU usage consumed by memcpy/syscalls/virtual memory. This article is a good demonstration of the performance impr
99.
by iscoelho 2y ago
If you are using C/C++ for any new app, there is a possibility you are writing code that has a performance requirement. - mmap/io_uring/drivers and additional "zero-copy" code implementations require consideration a
100.
by iscoelho 2y ago
See my post above about BGP hijacks: https://news.ycombinator.com/item?id=41511582 - They're way easier than you think.
101.
by iscoelho 2y ago
Do you use tabs or spaces? Just joking, but: The point is that our industry has a lot of opinionated individuals that tend to disagree on fundamentals, implementations, designs, etc., for good reasons! That's why we have thousands of f
102.
by iscoelho 2y ago
100% - another for the BGP hijack!
103.
by iscoelho 2y ago
BGP hijacks unfortunately completely destroy that. RPKI is still extremely immature (despite what companies say) and it is still trivial to BGP hijack if you know what you're doing. If you are able to announce a more specific prefix (h
104.
by iscoelho 2y ago
The point is that, ironically, new standards may have been a better option. Bolting on extensions to existing protocols not designed to be secure, while improving the situation, has been so far unable to address all of the security concerns
105.
by iscoelho 2y ago
The comic is about re-inventing the wheel. What you propose "standards evolving" would be the opposite in spirit (and is what has happened with DNSSEC, RPKI, etc)
106.
by iscoelho 2y ago
As long as TLS/SSL depends on Internet PKI as it is, it is flawed. I guess there's always Private PKI, but that's if you're not interested in the internet (^:
107.
by iscoelho 2y ago
Let's not fool ourselves by saying we're purely profit driven. Our industry argues about code style (:
108.
by iscoelho 2y ago
I agree that DNSSEC is not the answer and has not lived up to expectations whatsoever, but what else is there to verify ownership of a domain? Email- broken. WHOIS- broken. Let's convince all registrars to implement a new standard? ouc
109.
by iscoelho 2y ago
If my DNS can be MITM'd, and is thus insecure, it is not trustworthy.
110.
by iscoelho 2y ago
Certificate Transparency exists to catch abuse like this. [1] Additionally, Google has pinned their certificates in Chrome and will alert via Certificate Transparency if unexpected certificates are found. [2] It is unlikely this has been ab
111.
by iscoelho 2y ago
Considering we have 3 major tech companies (Microsoft/Apple/Google) controlling 90+% of user devices and browsers, I believe this is more solvable than we'd like to admit.
112.
by iscoelho 2y ago
obligatory https://xkcd.com/927/ Honestly: we're in this situation because we keep trying to band-aid solutions onto ancient protocols that were never designed to be secure. (I'm talking about you DNS.) Given
113.
by iscoelho 2y ago
You're correct - noting that Lets Encrypt supports DNSSEC/NSEC fully. Unfortunately though, the entire PKI ecosystem is tainted if other CAs do not share the same security posture.
114.
by iscoelho 2y ago
Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absen
115.
by iscoelho 2y ago
It definitely takes effort to stay that fit. Nothing wrong with being proud of the way you look (:
116.
by iscoelho 2y ago
1) Updates/general makes sense as you say. 2) "Praising countries" aka focusing on increasing the reach of Telegram, similar to Zuckerberg with Facebook. 3) "biological father of "over 100" kids" is quite
117.
by iscoelho 2y ago
"lack of enterprise adoption" - That you know of! Most organizations don't blog when they start using a software (: "wrong tool for the job" - What is the right tool? If it checks all the boxes compared to Minio, an
118.
by iscoelho 2y ago
What you are proposing is more complicated than it seems. For example, the Digital Markets Act in the EU is in direct contradiction to your proposition. There is a lot of people that believe locking down devices, even in the interest of sec
119.
by iscoelho 2y ago
You don't need to be in kernel space to brick a computer- you can easily do it from user space! You also don't need to be using Windows. Linux has kernel modules with no restrictions whatsoever (not even signing!), yet we run mana
120.
by iscoelho 2y ago
Microsoft allows kernel modules freely [1]. Microsoft does have a process for signing kernel modules, but it is aimed against malware and does not discriminate on the nature of the module [2]. Apple removed support for kernel extensions in

More ›