topranks

29 ms·

361.
by topranks 6y ago
So you’re using hardware offload of the crypto now? And that wouldn’t be available if you switch to QUIC? It seems a bad reason to knock the protocol cos people haven’t implemented something unrelated (hardware acceleration) for it. I appr
362.
by topranks 6y ago
Also if it doesn’t appeal to “Joe Public” then it will remain niche and most people will be stuck using other things to reach friends and family.
363.
by topranks 6y ago
Often won’t work running something like FRR in a container (and therefore it’s own netns,) because it has to update kernel tables etc. You can do it in a privaledged container afaik though.
364.
by topranks 6y ago
Dönerstuben What a word.
365.
by topranks 7y ago
With media streams the provider typically wants to be able to recode the data to lower quality to fit the bandwidth available to clients with lower bandwidth / congestion etc. There are ways around this but they are quite complex and p
366.
by topranks 7y ago
IRR is too messy and too many conflicts. RPKI is a lot saner thing to be using.
367.
by topranks 7y ago
The problem is the number of updates / changes that happen all the time in BGP, and having each router cryptographically validate each one / sign every update it sends.... it doesn’t scale well. The BGPSEC theory is there but not
368.
by topranks 7y ago
Nothing. It’s relatively new and is getting more adoption all the time. There are like 70,000 ASNs out there, so a lot of orgs need to implement. But you’re right, if all the Tier 1’s do it we’ll be in a good place. The “problem” with it
369.
by topranks 7y ago
I’m not so sure. The internet community (I.e. routing guys/Nanog/ietf etc) is fairly open. I’ve not heard much of such approaches being used. It is a very interesting idea.... I guess you gotta weight delaying inserting an upda
370.
by topranks 7y ago
While RPKI is great, saying BGP will be “secure” once it’s deployed is not true. It’ll be more secure, sure. But RPKI only addresses origin validation, not path validation. It won’t stop me announcing your space spuriously provided it has
371.
by topranks 7y ago
I love the way they basically say they are gonna do their own assessment and won’t roll in behind the consensus on RPKI. Like the trend-setting industry leaders they are. They deserve to be called out for this. It’s not hard to implement
372.
by topranks 7y ago
Who does 40Gbps per wavelength? 10/25/50/100 are the common rates in real-world Ethernet PHY standards.
373.
by topranks 7y ago
That’s not necessarily true though. I was thought through Java but it was all command-line and jacvac. I did once sort a much better programmers final year project for him though - years later that I worked with - cos he had a CLASSPATH iss
374.
by topranks 7y ago
Yes absolutely. Some of the people involved in the early QUIC development in Google had been heavily involved in the SCTP work and blamed its lack of success on the difficulty in getting firewalls, middleboxes (and the teams that manage the
375.
by topranks 7y ago
I always figured Cannonical made a lot of money for including that. Can’t believe the most annoying feature was part of the ‘vision.’
376.
by topranks 7y ago
TDMA usually means old legacy time-division based communications standards such as E1/T1 (G.704) or SONET/SDH. Emulating such services in a packet-switched network requires very precise timing hence the reference to it in terms of
377.
by topranks 7y ago
The DoH protocol is not designed to run “at each stage of the path.” Same things like DNScurve do that but somehow nobody got excited about that.
378.
by topranks 7y ago
DoH doesn’t even attempt to address DNS tree validation, which is what DNSSEC does. The two are complimentary.
379.
by topranks 7y ago
I’ve worked for a few, in Europe mind you, but I can say with certainty we did not do this. It would be naive to think none do of course.
380.
by topranks 7y ago
Yes you will. If using Firefox you’ll need to manually change the DNS settings, as it will by default bypass your local DNS and send it to Cloudflare using DoH. You can easily disable that though.
381.
by topranks 7y ago
It does show QUIC falling apart with _out of order delivery_, however that is not something that latency or slow networks will produce. There is no reason to think that slow / third world countries have significantly more out of order
382.
by topranks 7y ago
I would love to see the evidence for this as well. Instead of providing any you just attacked the person who questioned you? What specifically about the transport layer in QUIC makes it perform poorly on high latency links? It’s going thro
383.
by topranks 7y ago
Why would you fear ISPs offering an encrypted service? It’s hardly a step backwards? DoT would be preferable to DoH (no additional metadata / cookies,) but either way ISPs should adopt encrypted DNS. You are correct it boils down to
384.
by topranks 7y ago
Even with DOH, as things stand right now the ISP can see with SNI what sites your visiting, or certificate name for sites still using TLS 1.2 or lower. So moving the DNS to Cloudflare only means “now Cloudflare have my entire browsing histo
385.
by topranks 7y ago
Yes, as Google plan you implement it, which is fine. Most of the hulaboo is about Mozilla who are moving customers DNS queries to Cloudflare en mass, regardless of what DNS server they have already configured.
386.
by topranks 7y ago
The problem is it’s just a banner with “ok” at the top, which clearly says “we’ve increased your privacy by (insert technical jumbo jumbo here).” As Bert Hubert pointed out, to most users it ends up looking like this: https://twi
387.
by topranks 7y ago
I think the missing piece here is the constant focus on the US. In Europe ISPs are under much stricter rules about data privacy and generally cannot do things like the above. Having worked for several ISPs here I’ve never found them misusi
388.
by topranks 7y ago
Not attacking Google - their approach here is fine. But Mozilla switching people is a worry for me. Sure people “have a choice” but in reality expecting the average Joe who doesn’t even know what DNS is to make an informed decision about i
389.
by topranks 7y ago
You can install a modified OS which can capture the Pin. 100%. You cannot install a modified OS and brute force the PIN or access the encrypted user data though. You have to get the user to type it in. So you need access to the device and
390.
by topranks 7y ago
I think there is a lot of sense in your argument. Also worth remembering Apple have added so many features we once Jailbroke for, which makes the usefulness less for the average person. Still though I think this will help the JB scene. It

More ›