Borderware has more than one said things along these lines then pointed out they sell a product that solves all the problems. The little thing they forget to mention, SIP can run over TLS or not. When it is running over TLS, SIPtap and others like it don't work. This is the same as imap, pop, and http. If you don't run them over TLS (or SSL as it used to be known), well someone with a sniffer can read it. I'd like to point out that Cox would like to take credit for this but there has been a program that does exactly this for many years called vomit. (See http://vomit.xtdnet.nl/). Now the media can also be encrypted or not encrypted - SRTP is used to encrypt the media. There are open source implementation of all of this.
It also points out that 50% of the population is South Asian and that only 19% of the population is Emirati. I think it is relatively clear what is going on here has a lot more to do with a large group of foreign workers and the statistics don't provide much support one way or the other for anything to do with honor killings.
I 100% agree this is really scary. If I was a school teacher, I wold refuse to be in a classroom with computers or have anything to do with them. This is just nuts.
We need a clear safe harbor provisions for teachers and others. Every expert agrees it is impossible to 100% guarantee that no spyware or "bad" things will happen on a computer. Yet we take reasonable precautions and decide that the benefits of computers and the internet is more that the risk of the harm. We need to teach computing to kids - I don't even care about if what images are porn and what or not or what is good or bad - regardless of all that we need to be able to have teachers and kinds use the internet.
A 911 center typically has a handful of human operators - so what is needed to DOS a typical PSAP is a handful of cell phones and you just have a few people phone in and the 911 center is totally full. You don't need a bot net of voip systems. The reason this does not happen is because there is very little incentive to DOS a 911 center.
The SIP specification is pretty clear about TLS is needed to protect from many attacks. Do either of them use it? SRTP provides encrypted voice but do either of them use that? I really doubt it. It seems to me that the security they have deployed protects from only one thing - their customers making calls that they can't bill their customers for. I don't see them doing anything to protect the security concerns of their customers even thought there are standards based solutions available to do exactly that.
It seems to me that the inevitable outcome of this is that someone will fork Asterisk and Digium will have one stream and the open source people will have another.
Cisco has helped many universities experiment with open source call control such as the sipexchange PBX at sipfoundry.org and SER at iptel.org. They bought Vovida and open-sourced all the software including a very large PBX system at vovida.org.
There is some irony to this story - the expensive part of any phone system is (hold your breath) the phones. I will point out that the SHSU could pick an open standard protocol and move the phones from one system to another. Try that with Microsoft Office Communicator some time - you can't. I noticed that this story is under the Linux category and - I will point out that Cisco Call Manager 5.0 runs on linux and can run SIP to phones (as well as many other protocols).
Now, I know Asterix fairly well, Cisco fairly well, open source VoIP fairly well (as the joke goes I wrote the O'Reilly book), and SIP really really well. As was pointed out in Mark Spencer's Keynote at VON last week, the SIP stack in Asterix certainly has some room for improvement. And given SHSU does not seem to have any intention to support the development of Asterix by buying a support contract from Digium, I sure hope they are doing something to make sure that Asterix get the support that they will need it to have to stay relevant.
I ntoe that every month I send my DLS provider a ton of money while I send nothing to google that provides me with valuable services. I think that SBC might find that if Google disabled all search from SBC customers that SBC customers might be very upset. Perhaps SCB should be paying google.
You might consider how you want to "own" the code. If you just want to be able to use it, modify, take to your next job, etc. the easiest thing to do is for the company to open source the code and not worry about the contracts. Consider it a form of shared ownership. This allows you to use it, them to use, and helps everyone. If you plan to make money off of it, well then then often the company wants a slice of the pie since it was done on company time.
Re:Killer Crypto Application - secure SIP
on
VoIP Security
·
· Score: 1
not to mention open source (wiht BSD not GPL like license) for open source, proxies, SRTP, etc.
I'm never sure what a small business is but I doubt 23% of the ones in Canada use VoIP. My impression is that more large companies have the IT staff that has spend the time to deploy it than small companies. I'm sure it will take over at all companies. Already, all the major PBX manufactures are pretty much only selling VoIP if you want a new system.
I do find the quality arguments on slashdot very strange and lacking much real information. Enterprises run VoIP over LAN, usually 100 Mbps LANs - the quality is very good. Whatever quality you get from a dialup from china with Free World Dialup has nothing in common with what happens in enterprise VoIP. My only business phone since 1999 has been a VoIP phone. Not once has someone been able to tell the difference from a traditional phone. With wideband codecs, the quality is better than anything on the PSTN. Now, I know there are VoIP deployments that have voice quality problems but if you are on a LAN it is really easy to avoid them. If you are on a WAN, you probably need to do a little basic traffic engineering but nothing that complex. For many users, Vonage ends up with PSTN quality voice and that has basically no traffic engineering running over a random low grade broadband connection. I imagine some peoples broadband has turned out not to work well with things like Vonage but for the vast majority, it works out well. But my points is, voice quality on a small business LAN has nothing to do with the problems of VoIP over broadband and the public internet.
Silicon valley produces things where you spend most your time developing them before you sell the first one, then a little time supporting and improving them. Right now they are supporting and improving stuff and selling what they already created long ago. The number of totally new things being developed is lower and thus the lower cost of running the company is lower - pretending this is because of increased productivity is totally bogus. In the long term, companies are trading off "productivity" now for loss of innovation and products in the future. No one is doing cool long term stuff, if an project can't make money in 3 quarters, it's not being done. The VC are investing in things with a short time to return (about 2 years). Start ups are not doing ideas that might take 10 years but could change the world if they worked. And the big companies are doing small incremental changes to existing products.
I am a distinguished engineer in voice at cisco and would be glad to help you get going if you are serious about doing this. I helped deploy another voip sat based system to Nepal over vsat and 802.11. You can see some photos about it at http://www.linkingeverest.com/gallery/albums.php It's not all that hard and you can do it for close to free other than the sat bandwidth and terminal cost. You can use free softphones like xten.com or cheap analog adapters such as the linksys PAP2. You can connect up to some free services like FWD or iptel.org or connect to things like Vonage depending on if the loved ones back in the US have Broadband or not. The iLBC codec has been one of the best but G.729 has also worked fine. The problem is not packet loss or QoS so much on these links as it is the latency. The latency will suck but it beats not being able to talk to people at all and people will learn how to have conversation over it. (I lived on a fish boat for a long time and have some clue what it's like not to be able to talk to your family for months at a time).
I have been using the sip softphone from xten.com on a Mac - also on windows. They had some claims about linux support some time soon. Tell them to do linux - no one will do it if no one asks for it.
I agree there are some issues for the VoIP folks to figure out here but for comparisons sake....
the first question you get asked when you phone 911 on a traditional land line is "where are you?" This is because the traditional location information is wrong a surprising amount of the time.
Slashdot Mirror
Borderware has more than one said things along these lines then pointed out they sell a product that solves all the problems. The little thing they forget to mention, SIP can run over TLS or not. When it is running over TLS, SIPtap and others like it don't work. This is the same as imap, pop, and http. If you don't run them over TLS (or SSL as it used to be known), well someone with a sniffer can read it. I'd like to point out that Cox would like to take credit for this but there has been a program that does exactly this for many years called vomit. (See http://vomit.xtdnet.nl/). Now the media can also be encrypted or not encrypted - SRTP is used to encrypt the media. There are open source implementation of all of this.
Most services like this use G.729. You can find code at www.vovida.org
Good post - someone should mod up the parent.
oh yah, and on the 10 years, lol
Thank you for adding some sanity to the conversation.
1 052_people.html has the Male to Female ratio at birth as 1.05 in the UAE and that the life expectancy at birth of males is 73 years while it is 78 for females.
I note that http://www.intute.ac.uk/sciences/worldguide/html/
It also points out that 50% of the population is South Asian and that only 19% of the population is Emirati. I think it is relatively clear what is going on here has a lot more to do with a large group of foreign workers and the statistics don't provide much support one way or the other for anything to do with honor killings.
32 bits of IP address space + 16 bits of port space provided by NAT = 2^48 active connections
I 100% agree this is really scary. If I was a school teacher, I wold refuse to be in a classroom with computers or have anything to do with them. This is just nuts.
We need a clear safe harbor provisions for teachers and others. Every expert agrees it is impossible to 100% guarantee that no spyware or "bad" things will happen on a computer. Yet we take reasonable precautions and decide that the benefits of computers and the internet is more that the risk of the harm. We need to teach computing to kids - I don't even care about if what images are porn and what or not or what is good or bad - regardless of all that we need to be able to have teachers and kinds use the internet.
A 911 center typically has a handful of human operators - so what is needed to DOS a typical PSAP is a handful of cell phones and you just have a few people phone in and the 911 center is totally full. You don't need a bot net of voip systems. The reason this does not happen is because there is very little incentive to DOS a 911 center.
The SIP specification is pretty clear about TLS is needed to protect from many attacks. Do either of them use it? SRTP provides encrypted voice but do either of them use that? I really doubt it. It seems to me that the security they have deployed protects from only one thing - their customers making calls that they can't bill their customers for. I don't see them doing anything to protect the security concerns of their customers even thought there are standards based solutions available to do exactly that.
Oops - what a typo, how could I have confused them - you are, of course, correct.
SCCP is skinny - don't ask why
Skippy is what you get when you cross SIP and SCCP.
It seems to me that the inevitable outcome of this is that someone will fork Asterisk and Digium will have one stream and the open source people will have another.
Cisco has helped many universities experiment with open source call control such as the sipexchange PBX at sipfoundry.org and SER at iptel.org. They bought Vovida and open-sourced all the software including a very large PBX system at vovida.org.
There is some irony to this story - the expensive part of any phone system is (hold your breath) the phones. I will point out that the SHSU could pick an open standard protocol and move the phones from one system to another. Try that with Microsoft Office Communicator some time - you can't. I noticed that this story is under the Linux category and - I will point out that Cisco Call Manager 5.0 runs on linux and can run SIP to phones (as well as many other protocols).
Now, I know Asterix fairly well, Cisco fairly well, open source VoIP fairly well (as the joke goes I wrote the O'Reilly book), and SIP really really well. As was pointed out in Mark Spencer's Keynote at VON last week, the SIP stack in Asterix certainly has some room for improvement. And given SHSU does not seem to have any intention to support the development of Asterix by buying a support contract from Digium, I sure hope they are doing something to make sure that Asterix get the support that they will need it to have to stay relevant.
There is not information content here - it's not like this is the first computer to have dual core. I have no idea why slashdot bothered to post this.
I ntoe that every month I send my DLS provider a ton of money while I send nothing to google that provides me with valuable services. I think that SBC might find that if Google disabled all search from SBC customers that SBC customers might be very upset. Perhaps SCB should be paying google.
You might consider how you want to "own" the code. If you just want to be able to use it, modify, take to your next job, etc. the easiest thing to do is for the company to open source the code and not worry about the contracts. Consider it a form of shared ownership. This allows you to use it, them to use, and helps everyone. If you plan to make money off of it, well then then often the company wants a slice of the pie since it was done on company time.
not to mention open source (wiht BSD not GPL like license) for open source, proxies, SRTP, etc.
Some code is pretty, some code is ugly. What more can one say?
I'm never sure what a small business is but I doubt 23% of the ones in Canada use VoIP. My impression is that more large companies have the IT staff that has spend the time to deploy it than small companies. I'm sure it will take over at all companies. Already, all the major PBX manufactures are pretty much only selling VoIP if you want a new system.
I do find the quality arguments on slashdot very strange and lacking much real information. Enterprises run VoIP over LAN, usually 100 Mbps LANs - the quality is very good. Whatever quality you get from a dialup from china with Free World Dialup has nothing in common with what happens in enterprise VoIP. My only business phone since 1999 has been a VoIP phone. Not once has someone been able to tell the difference from a traditional phone. With wideband codecs, the quality is better than anything on the PSTN. Now, I know there are VoIP deployments that have voice quality problems but if you are on a LAN it is really easy to avoid them. If you are on a WAN, you probably need to do a little basic traffic engineering but nothing that complex. For many users, Vonage ends up with PSTN quality voice and that has basically no traffic engineering running over a random low grade broadband connection. I imagine some peoples broadband has turned out not to work well with things like Vonage but for the vast majority, it works out well. But my points is, voice quality on a small business LAN has nothing to do with the problems of VoIP over broadband and the public internet.
Silicon valley produces things where you spend most your time developing them before you sell the first one, then a little time supporting and improving them. Right now they are supporting and improving stuff and selling what they already created long ago. The number of totally new things being developed is lower and thus the lower cost of running the company is lower - pretending this is because of increased productivity is totally bogus. In the long term, companies are trading off "productivity" now for loss of innovation and products in the future. No one is doing cool long term stuff, if an project can't make money in 3 quarters, it's not being done. The VC are investing in things with a short time to return (about 2 years). Start ups are not doing ideas that might take 10 years but could change the world if they worked. And the big companies are doing small incremental changes to existing products.
Hi Rick,
It's not all that hard and you can do it for close to free other than the sat bandwidth and terminal cost. You can use free softphones like xten.com or cheap analog adapters such as the linksys PAP2. You can connect up to some free services like FWD or iptel.org or connect to things like Vonage depending on if the loved ones back in the US have Broadband or not. The iLBC codec has been one of the best but G.729 has also worked fine. The problem is not packet loss or QoS so much on these links as it is the latency. The latency will suck but it beats not being able to talk to people at all and people will learn how to have conversation over it. (I lived on a fish boat for a long time and have some clue what it's like not to be able to talk to your family for months at a time).
I am a distinguished engineer in voice at cisco and would be glad to help you get going if you are serious about doing this. I helped deploy another voip sat based system to Nepal over vsat and 802.11. You can see some photos about it at http://www.linkingeverest.com/gallery/albums.php
Cullen
I have been using the sip softphone from xten.com on a Mac - also on windows. They had some claims about linux support some time soon. Tell them to do linux - no one will do it if no one asks for it.
Does SIP and STUN, and oh yah, how could I forget, SCCP.
I agree there are some issues for the VoIP folks to figure out here but for comparisons sake ....
the first question you get asked when you phone 911 on a traditional land line is "where are you?" This is because the traditional location information is wrong a surprising amount of the time.
When we we learn - this technology does not yet work to recognize people. In fact, it can not even tell a cat from a dog.