topranks

27 ms·

331.
by topranks 6y ago
My work PC with Office on it.
332.
by topranks 6y ago
You need v4 as well in the world today. Lots of users still have no v6, if your business wants to do business with them you need some v4.
333.
by topranks 6y ago
No there is basically no NAT with IPv6, apart from some very niche edge cases. NAT is expensive.
334.
by topranks 6y ago
While what you suggest is possible it’s amature and fraught with problems. Any halfway serious company that wanted to run a global application on their own infra is gonna need their own ASN and internet presence with their own IP space.
335.
by topranks 6y ago
T-Mobile did it in the US. And a lot of Indian providers as far as I know. Most still doing either v4 only with CG-NAT or dual stack.
336.
by topranks 6y ago
As far as I’m aware Deezer does just what you’re suggesting.
337.
by topranks 6y ago
Not with TLS1.3 and DoH and ENSI they can’t.
338.
by topranks 6y ago
DNScurve never got far in the IETF but I like it: https://tools.ietf.org/html/draft-dempsky-dnscurve-01 It’s being worked on again. The “client side” (from client to resolver) got all the attention in recent years. Ev
339.
by topranks 6y ago
Can you link to the results of your study?
340.
by topranks 6y ago
I think that’s a gross overstatement about ISP DNS. Certainly in Europe I’ve not seen anything even close to that. I’d love to see a good country-by-country survey on ISP DNS to see just how common this manipulation is.
341.
by topranks 6y ago
ifupdown2 ftw
342.
by topranks 6y ago
The current number of CAs does not prevent state-level attacks either. DNSSEC works I don’t really get that point. The “root of trust” problem is hard to solve. I kinda hear the DANE guys’ argument, I’d rather trust one authority than a th
343.
by topranks 6y ago
That sounds like a fun way to spend your life.
344.
by topranks 6y ago
The main thing I don’t want is to send all my browsing data to Cloudflare or similar “public” DNS operator outside my jurisdiction.
345.
by topranks 6y ago
Correct. Want to point out that certs are encrypted with TLS1.3, and DNSSEC+DoT/DoH makes ESNI/ECH possible by putting keys in the DNS. Ultimately maybe OSCP could do something similar, or fall back to DANE or some alternate valid
346.
by topranks 6y ago
Ok say we switch OSCP to HTTPS. How to we know the certificate presented by the OSCP server has not been revoked? We can’t ask the OSCP server cos that’s what we’re trying to handshake with! The loop is very real and non trivial to solve.
347.
by topranks 6y ago
Clear-text is the OSCP mechanics. This is nothing to do with Apple or MacOS. Potentially it could now be tackled with DNSSEC + DoH similar to the records ESNI/ECH puts in the DNS to encrypt initial HTTPS client hellos. But the loop is
348.
by topranks 6y ago
I'd love someone in the know to explain this to me. The "poster" they have on the site doesn't give me a real sense of how the OS ICMP-limit counter can be exploited to reveal open ports.
349.
by topranks 6y ago
Worry about the old, the frail, the immunosuppressed. Vaccines only work if a high enough proportion of the entire population get them. Obviously the vulnerable will get it first - but please don’t skip it just because you’re young and stro
350.
by topranks 6y ago
You should be able to read the IETF mailing lists for the working group, and watch videos of discussions at IETF meetings.
351.
by topranks 6y ago
That also gets tricky for them, when say IPs are from Cloudflare, AWS or other cloud-scalers and CDNs. Nations will struggle to block the IP ranges for big players like that without blocking a lot of stuff they don’t intend to.
352.
by topranks 6y ago
DoH client won’t stop SNI blocking, of which this report found a lot. ESNI, of the new trick of using ESNI plus a fake plaintext SNI, is definitely a more robust approach.
353.
by topranks 6y ago
It’s a bit much to throw all that at the PC/Windows side. Sure companies fill them with shit, that’s not really a flaw in the underlying hardware/OS though. Those same people have less scope for that on OSX/Linux sure, but a
354.
by topranks 6y ago
At very least it might cure them of that delusion, and prompt them to use a proper firewall.
355.
by topranks 6y ago
That explains its massive success I suppose?
356.
by topranks 6y ago
Only with ADSL right? It’s gone in newer DSL variants and not in DOCSIS? Or am I wrong?
357.
by topranks 6y ago
The weird thing is that course sounds way more interesting than studying boring old AES, Diffie Hellman or whatever. I guess people are different. For me the more background, anecdotes and stories the better when learning any field.
358.
by topranks 6y ago
Policy. Not sending my private browsing data/DNS history to a third party (Cloudflare, Google etc.)
359.
by topranks 6y ago
Not really. Malware could always use some proprietary wrapping in TLS to hide name resolution. Domain fronting through Azure is still a thing for instance.
360.
by topranks 6y ago
It’s basically the same minus the filtering. Cloudflare are getting all your browsing info from DNS. Your ISP from SNI.

More ›