pjf

I'm pushing the https://bgpipe.org/ project, bringing one of the first BGP ASPA route path validators to the open source world - see:

- https://bgpipe.org/stages/aspa/

- https://www.ripe.net/manage-ips-and-asns/resource-management...

There are situations [1] where you could reliably BGP-hijack the IP prefix of the target domain authoritative nameserver, and obtain your own domain-validated cert for the target (by effectively controlling the zone file contents). And yeah, CAs do have their BGP protections, but still there's at least partial assumption BGP is secure enough to run DNS-based validation for new SSL certs, in our world where DNSSEC is still rare.

  [1] https://www.ietf.org/proceedings/104/slides/slides-104-maprg-dns-observatory-monitoring-global-dns-for-performance-and-security-pawel-foremski-and-oliver-gasser-00.pdf (see slide 15; yeah, it's already a bit old, yet still the case from my practice)

On the other front (Chrome), their crlset-tools [1] just fetched me 64k (~1.1MiB) of revoked certs just fine, contrary to the article (quote: "After retrieving and running this tool, I was surprised to see a total of 1,081 revoked certificate serial numbers in this list. This seems oddly low.")

[1] https://github.com/agl/crlset-tools

Good that at least BGP is secure.

NB: this is not "IPv6 traffic crosses the 50% mark" but "availability of IPv6 connectivity among Google users", which is a very important difference. This means roughly half of Google users have IPv6 capability, which does not 1:1 correspond how much traffic is actually transferred over IPv6, which is what this submission says in the title.

great post! key points for me:

1. 100 IXes alone would get 56% IPv4 and 61% IPv6 prefixes, but ~14% reachability

2. little uniqueness between exchanges: not many new prefixes after the top 5

3. for outbound-heavy networks IXes are great, but to attract traffic they are not (edit: applies to automatic peering via route servers)

Kind of "funny" affected service is BGP RouteViews CLI access, still running over telnet: https://archive.routeviews.org/ (scroll to bottom of the page)

Isn't this one of the remaining, "legit" uses of the Telnet protocol on TCP/23 port over the public Internet?

One reason is there already was exabgp, written in Python, which in my experience is slow and resource hungry. Golang is much faster, easily portable, and produces static binaries (easy to deploy).

Another thing is bgpipe speaks JSON to background (or even remote) packet processors, so basically you can use whatever language you want with it to drive your BGP routers.

I'd advise to first compare with:

- https://bgp.tools/ - https://bgproutes.io/ - https://bgp.he.net/ - https://radar.qrator.net/ - https://github.com/nttgin/BGPalerter

...all of which are (usually) free. IMHO you should have a competing product + money strategy before you continue. Many people have tried (and failed) to make money off BGP.

BTW, author of https://bgpipe.org/ here, an open-source BGP data tool

https://bgpipe.org/

I'm working on a man in the middle proxy for BGP, which can fix and inspect routing sessions on the fly. Like a firewall for the BGP control plane.

...prepare your pagers for an April 1st "experiment"

Do you know - and can share - how this compares vs the Onyx Boox Tab Ultra C Pro?

I guess it might be a very competitive alternative to your product, yet it can't reach 60+fps and is sketchy in terms of security, imho.

Related posts by the author:

* https://lcamtuf.substack.com/p/afternoon-project-jpeg-dct-te...

* https://lcamtuf.substack.com/p/not-so-fast-mr-fourier

What are the limits on the number of databases (say sqlite files) one can have attached (and queried through a UNION) at a single time?

Small world : - ) Great work, Larry!

Quote:

  - math/rand
  The math/rand package now automatically seeds the global 
  random number generator (used by top-level functions like 
  Float64 and Int) with a random value, and the top-level 
  Seed function has been deprecated. Programs that need a 
  reproducible sequence of random numbers should prefer to 
  allocate their own random source, using 
  rand.New(rand.NewSource(seed)).
  (...)

Full story: https://www.wsj.com/articles/the-owner-of-this-iphone-was-in...

Kentik data on the outage: https://twitter.com/DougMadory/status/1471162450649223173

Come on, who in 2021 actively drops routes because of an entry in the Level3 IRR? I mean, IMHO, it's not close to impacting the whole Internet.

Cloudflare’s unique advantages in a world where the Internet is increasingly fragmented

Wait, it's the opposite, at least on the infrastructure side. The Internet is increasingly centralized, due to Cloudflare and other big players.

https://www.entropy-ip.com/ https://arxiv.org/abs/1606.04327

https://ipv6hitlist.github.io/

First time to be called shady, though ;)

Great improvement over the ROT13 encryption.

Can someone please explain the implications in layman terms?

...and you think the sequence and timing of IP addresses your machine connects to alone can't be used to easily infer the website you're browsing? Neither DoH nor ESNI will make you more secure/private, but DoH will definitely make some companies more powerful. That's not the Internet as we knew it until now.

In practice I found new certs being available for download from CT logs hours after they've been issued. This is more than enough to perform an attack.

Another point is that CTs alone won't prevent the attacks nor inform you about a problem - they need a monitoring system.

(yes I know that's not the problem with CT - it's great, just trying to justify a strong opinion of "it doesn't work")

Farsight Security, Inc. | Sr Software Engineer | C, Python, Golang, more | US, Worldwide | Full-Time, REMOTE

Farsight Security, lead by Paul Vixie, is all about DNS and security. We provide the world’s largest real-time actionable threat intelligence information on how the Internet is changing, seeing more than 200,000 DNS-related observations per second.

We are looking for a Senior Distributed Systems Engineer to join our development team distributed around the world.

Details at https://www.farsightsecurity.com/about-farsight-security/job...

Quote: "But the bank had not protected the server with a password, allowing anyone who knew where to look to access the data on millions of customers’ information."

...a lens biased towards countryside, and that would require captions to better understand the meaning of photos, IMHO.

Full paper: https://dl.acm.org/citation.cfm?id=3281433