Slashdot Mirror


User: Zocalo

Zocalo's activity in the archive.

Stories
0
Comments
2,447
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,447

  1. Re:Public TFTP server ? on 600,000 TFTP Servers Can Be Abused For Reflection DDoS Attacks · · Score: 1

    Sigh. That you think L2 is irrelevant to PONs or that PONs use routers is telling; you don't understand the technology, do you? A PON is inherently L2-only between the end user's ONT (the CPE) and the core network hardware - the clue is in the name; "Passive Optical Network". IP traffic from each PON will typically be connected to an L3 core at 10Gb/s or more (40Gb/s and 100Gb/s are not at all uncommon in large ISPs), with dozens, or even hundreds, of PONs being terminated onto a single L3 core device. ONTs are not routers; they are essentially modems - it's not at all uncommon for them not provide any packet filtering capability, although some newer ONTs also have a very capable IP/WLAN router in the same box, far too many are just fairly dumb devices that rely on a customer provided router (which almost certainly won't be configured for BCP38) to be plugged into them.

    Also, if you seriously suggesting implementing BCP38 on the core switches of an ISP as a viable generic approach, then you might want to have a think about how you expect them to manage connections (via any presentation) coming into the core from customers that have their own IP space, let alone customers of customers with their own IP space.

  2. Re:Public TFTP server ? on 600,000 TFTP Servers Can Be Abused For Reflection DDoS Attacks · · Score: 1

    Yes, they well, albeit quite a large cost at the traffic and port-count scales we're talking about here. You're still missing the point though; the device already in situ doing the traffic aggregation for the ON networks I'm talking about works at layers 1 and 2 and simply *can't do it* - in many cases they only start to talk IP when they are ready to hand the aggregated data off to the ISP's IP core. That means the ISP has to either try filtering already aggregated traffic flows coming off what is essentially a core IP router, replace their legacy ON core hardware or replace all their CPE to fully implement BCP38, all of which entail a significant cost to be passed on to their end users - because it's sure as hell not going to be coming off the bottom line, is it? Convert that price into a per-enduser cost and dealing with the resulting price increases in a cutthroat market vs. ignoring BCP38 and dealing with (AKA "ignoring") the few people who can be bothered complaining ABOUT your customers being involved in DDoS attacks and it's a no brainer.

    What you *can* do, if you are trying to be a decent ON network based consumer ISP, is make new and replacement installs use more up to date hardware that does enable you to support BCP38, and over time you'll end up fully compliant - once you've sweated all your assets long enough to satisfy the beancounters and, by implication, the shareholders. You can, however, only do so if your chosen ON hardware vendor(s) can actually provide updated hardware that supports BCP38, which even now not all of them do. Hence my original closing point; we need to be bitching to the ON hardware vendors as well as the ISPs about supporting BCP38.

  3. Re:Public TFTP server ? on 600,000 TFTP Servers Can Be Abused For Reflection DDoS Attacks · · Score: 1

    No, it's really not. A typical AON/PON in that non-IP aware hardware scenario could have up to 512 customers on each optical segment (although 32-64 is more common) all of which will typically be connected at speeds in the tens of Mb/s or higher - all the way up to Gbit, with the right hardware. Each segment will consist of an OLT that hands the traffic off to the ISP's core IP network, so you will typically have multiple OLTs connected to a single IP router, which will mostly be optimised for BGP based routing and not packet filtering. Even assuming you need to do very crude source IP filtering on a single known subnet (which is usually going to be the case) and allowing for typical contention ratios you are still looking at tens, if not hundreds, of Gbit/s of data flowing through the first available device that can do IP level packet filtering, far in excess of what all but the highest end packet filters can handle, let alone when they are trying to run a full BGP stack as well.

  4. Re:Public TFTP server ? on 600,000 TFTP Servers Can Be Abused For Reflection DDoS Attacks · · Score: 1

    Not all ISP edge technologies allow access to customer traffic for the necessary source IP filtering before it has already been aggregated with traffic from a large number of other customers - typically several hundreds. That can either be down to the initial customer facing devices understanding IP, but not being able to do the necessary traffic inspection and filtering, or the initial traffic aggregation devices not even working at the IP layer, as the case with many active or passive optical network (AON/PON) deployments. The only way to do BCP38 in that case is to put a high throughput (read "highly expensive" on typical consumer ISP scales) packet filter in front of the aggregation device and do BCP38 there - passing the cost onto the end users - or mandate customers use an ISP supplied CPE that performs the BCP38 role, neither of which are very popular with customers, funnily enough.

    It's just not the ISPs we need to be bitching at about BCP38; it's also the manufacturers the ONTs used in AONs/PONs that don't allow for BCP38 before they fire the customer's IP traffic off towards the ISP.

  5. Re:Public TFTP server ? on 600,000 TFTP Servers Can Be Abused For Reflection DDoS Attacks · · Score: 4, Informative

    I think you and others are missing the significance of that extra "T". TFTP is designed for things like Thin Clients, desktop VoIP phones, and similar devices, to load configurations/firmware off the network quickly so that they can boot off them right there and then. It's not designed for stuff that you would typically download on a PC, validate the checksum of, then load onto a target device as you would device drivers, a software ISO or other application package like you might with FTP, without the initial "T". TFTP is horribly insecure by design because its primary use is to shove data across a local network as fast as possible, typically with a bare minimum of validation to ensure the image isn't corrupt, so that the remote device can be running the code as fast as possible; a valid image is going to mean the code it contains getting executed, regardless of whether or not it was what was expected to be on the server or something a black hat had placed there.

  6. Re:That oughta hold the little SMBs on Google Is Testing Self-Promotion Ads On Search Results (pulseheadlines.com) · · Score: 1

    Small- and Medium-sized Business, an alternate version of SME - Small- and Medium-sized Enterprise.

  7. Re:Does this happen often? on Scuba Diver Survives Being Sucked Into Nuclear Plant (nydailynews.com) · · Score: 2
    From the bottom of TFA:

    While Le Cun’s terrifying experience may seem one-of-a-kind, a similar event actually happened at the same power plant in 1989, according to UPI

    Hardly "often", but judging by the description of the buoy and foreign matter filter in the older UPI article, probably something that Florida Power and Light needs to beef up a bit more - it's clearly insufficiently tamper/idiot proof.

  8. Re:Cherchez le cash on UK Gov't Launches Anti-Adblocking Initiative, Compares It To Piracy (thestack.com) · · Score: 1

    True, but that is actually more the way it's been pitched by those opposed to the idea - both those that use ad blockers that feel it's somehow unethical or against the spirit of ad blocking and those that oppose the whole concept of ad blocking in general. Pitch it as some form of administration fee to ensure that the advertisers comply with the guidelines set down to meet the standards of the whitelist (such as these criteria for ABP) and don't pull a fast one by switching formats once on the whitelist then it seems a lot fairer and more legitimate. The "protection racket" notion is definitely hyperbole though; if the advertiser chooses not to pay up the fee then they don't get the "protection" of the whitelist, so that part of the analogy is right, but they are perfectly free to explore other means of raising revenue and marketing their products (including trying to circumvent ad blockers) without any fear of deliberate malice along the lines of someone from the ad blocking company coming around and burning their offices to the ground.

  9. Re:Cherchez le cash on UK Gov't Launches Anti-Adblocking Initiative, Compares It To Piracy (thestack.com) · · Score: 2

    He probably wasn't paid anything to shill for them. He was probably paid to speak at their conference though - in case you missed it the Oxford Media Convention is a convention for media companies, many of which use advertising, so he was probably doing that other thing politicians do apart from shill and just telling potential voters what they want to hear. He was also picking out the specific practice of charging for whitelists (looking at you ABP) as a protection racket (a sentiment that many Slashdotters share given the number of "Nice advertising network you have there, be a shame if anything happened to it..." comments that pop-up in stories about ad-blocking.

    Of course, since media companies have much deeper pockets than ad-blocking companies and the UK government's track record in this area I wouldn't be at all surprised if the payments are going to start PDQ once this "round table" gets underway, and some truly awful legislation is going to get proposed as a result. Good luck enforcing it though; I suspect it'll be about as effective as banning piracy sites or encryption. They'll pry my ad-blocker (which doesn't support whitelisting) out of my cold dead hands.

  10. Re: What data did they want? on Brazil Facebook Head Arrested For Refusing To Share WhatsApp Data (bbc.com) · · Score: 1

    So what? If Facebook doesn't agree with that aspect of Brazilian society then they could always choose not to do business in the country. Ultimately this is a presumably valid court order, targetted against a specific individual that is being investigated for a crime in an on-going criminal case. That's about as good as it's going to get in terms of personal data requests, and it's certainly not even close to the kind of wholesale data grabs that are becoming the norm (and really ought to be challenged). If Facebook thinks that it's an over-reaching request or there is some other issue then there are almost certainly legal avenues to challenge the ruling that would put a stay on handing over the data, or at the very least place it in escrow until the matter is resolved / render the data inadmissable later. Simply ignoring it is contempt of court and that generally involves the court instructing law enforcement to go and arrest someone, Diego Dzodan presumably being the person they determined was where the buck stopped and the person to arrest. Arrest usually results in some form of incarceration, at least until suitable terms/bail can be arranged, which (big surprise) is what happened here.

    Based on the evidence at hand, I'd say that yes, there's a time and place to oppose such data requests for user/customer data, but this sure as hell isn't one of them. If anything, doing so in instances like this just adds weight in the public eye to the line that tech companies are protecting criminals and terrorists and is more than likely going to result in the bar for demanding data being lowered even further that it already is.

  11. Re:I offered quite a lot of feedback from Windows on Microsoft Unhappy With Beta Testers, Demands Answers (computerworld.com) · · Score: 2

    True, but like OP I tested Windows 10 and gave feedback. No replies or acknowledgments were ever provided. Amongst the many bug and feedback reports I sent were for issues that were absolutely an issue for lots of people because lots of people starting bitching about them once the product actually shipped; stuff like the inconsistent UI, many of the on-going stability issues, and other issues that made it through to release. I'm sure that I reported many things that were specific to me and maybe a handful of others, for which it's fair enough that they should be lost in the morass of minor issues "for later resolution, maybe", but Microsoft has no excuse on the big ticket items. They asked for feedback, got it, and appear to have done nothing with it - people were writing articles about the issues in MSM for $deity's sake - how much more obvious feedback do they want? In that light is it any wonder people might give up and stop providing feedback, especially when it appears that Microsoft is taking it all anyway via telemetry.

    Like the intelligence agencies, it seems they might be drowning in too much data, can't find the bits that they need, and figure the solution to the problem is to try and acquire even more data. Good luck with that!

  12. Re:where were you? on Alleged Kalamazoo Shooter Picked Up Uber Fares During, After Killing Spree · · Score: 4, Interesting

    I think you missed the sarcasm in the OP's post. One of the NRA's arguments against gun control is that if everyone had guns this kind of thing wouldn't happen because the good guys with the guns would either bring down the shooter almost immediately, or the knowledge of this would deter the shooter from drawing their gun(s) in the first place. The counter argument by those pro-gun control is that this never actually happens, even in states like Michigan where the gun laws are loose enough to make it possible that it might. The counter-counter argument is that shooters in such states tend to target places with restrictions on carrying guns... and round and round it goes with no progress in any direction.

  13. Re:Uber does not seem to be involved... on Alleged Kalamazoo Shooter Picked Up Uber Fares During, After Killing Spree · · Score: 4, Funny

    systemd uber alles?

  14. Re:Needs REAL system bus expansion on LG G5 Unveiled: 5.3" QHD Display, Snapdragon 820, Modular Magic Slot Expansion (hothardware.com) · · Score: 1

    All true, but a SoC bus is going to be vendor specific at best, and quite likely would need to be changed every couple of SoC generations; more than likely your peripherals will be vendor specific and probably only good for couple of phone generations, three at best. While technically it ought to be possible to come up with a standardised SoC bus socket that could be SoC agnostic, the chances of that happening any time soon are probably zero, so we would essentially have the proprietary solution I proposed for how the vendors might do it. USB3 isn't perfect either, but it can double up as a charging/dock/sync port saving space, could support any number of existing USB3 compatible peripherals, and would more readily open up the development of add-ons to the maker community using things like the Raspberry Pi and similar boards to make home-brew peripherals.

  15. Re:Needs REAL system bus expansion on LG G5 Unveiled: 5.3" QHD Display, Snapdragon 820, Modular Magic Slot Expansion (hothardware.com) · · Score: 1

    How would I do it? A bog standard USB3 port on the base of the phone combined with an easy to manufacture locking mechanism (e.g. modules can be made on a decent 3D printer) and an interface in the OS to support the necessary drivers to make whatever hardware gizmo you just crowdfunded actually work, if any. How would/will the phone manufacturers do it? Almost certainly something completely proprietary and tied up in IP patents/licenssing fees... which will then be reverse engineered anyway leading to cheap knock-off hardware and far from cheap lawsuits.

  16. Re:Why give them 3 months? on French Gov't Gives Facebook 3 Months To Stop Tracking Non-User Browsers · · Score: 5, Insightful

    You are assuming they are only tracking people based on Cookies. That's a rather naive view, I'm afraid. You'd be better to assume that they are using everything they can get their mitts on to try and track and identify people; IP address, which browser, which headers the browser supplies, any OS details they can get... Just installing extensions to protect your privacy can in itself make you more readily identifiable for tracking purposes. Have a play with the EFF's Panopticlick tool and although you need to enable scripting to make it work the results from the fingerprinting should be an eye opener if you've not seen them before.

  17. Re:2009 time frame is bogus on Congress Gives Federal Agencies Two Weeks To Tally Backdoored Juniper Kit (csoonline.com) · · Score: 3, Interesting

    Maybe because they read between the lines a bit? If you put the part of the letter that reads "Documents sufficient to identify whether your agency, or any component agency, used the affected Juniper ScreenOS platforms" (note the tense) with the timeframe that Juniper when started shipping products with a vulnerable version of ScreenOS (e.g. from 2009), then they are indeed asking for data that could potentially go back to 2009. Just because a company might be using an alternative product now, doesn't mean that they didn't have vulnerable products in the past, so they are indeed asking for agencies to review their equipment purchasing records going back to 2009.

    Still, it's a pretty incompetent company that won't have at least some form of records of CapEx purchases going back six years, let alone a government agency, just because of financial and tax legislation requirements, albeit possibly not entirely digital and searchable. At my previous employer I could get a report with a complete list of assets from a given vendor complete with every logged change made to those assets from our ITIL CMDB system in a couple of minutes that would easily cover that timescale, although I suspect for many government agencies this is likely to involve some hapless interns digging through dusty paper boxes in a warehouse rather than someone running a report.

  18. Re: Yeah, sure on SaxoBank Predicts Universal Basic Income For Europe · · Score: 2

    It's not just the wealth, that's also offset by the cost of living. People in Country A might earn more Euros per week than those in Country B, but if the cost of living is sufficiently high in Country A then you might still be better off in Country B - assuming similar (or at least acceptable) levels of social services, security and other basics you might want in return for your taxes. Establishing a EU-wide minimum wage would most likely entail those in the higher salaried western EU nations (e.g. those that essentially get to decide whether to do this or not) being far worse off while those in the lower salaried nations might appear to get a good deal at first, but will get slammed with rising inflation until the system stabilises.

    SaxoBank might be right when they claim "the EU will consider the introduction of a universal basic income", but I think you have the response to that nailed with "No way!"; the Eurozone is too unstable financially and fraught with conflict over how to deal with immigration vs. the right of free movement to even contemplate actually doing something like this. Then again, this is the EU we are talking about. It wouldn't be the first time they've tried to come up with some kind of mostly arbitrary and incredibly complicated "one size fits all" formula (that everyone will mostly ignore anyway) to enable them to level the playing field by attempting to factor in the cost of living on a nation-by-nation basis.

  19. Re:Talk to Bill Gates? on Donald Trump: America Should Consider "Closing the Internet Up In Some Way" (dailydot.com) · · Score: 2

    Possibly because the kind of "person" that might actually agree that Trump's policies make sense will have some vague notion of Bill Gates as having something to do with computers and, by inference, the Internet? Somehow I doubt the current captains of the industry, even those with a lot of mainstream media coverage, are going to achieve the same level of name recognition - let alone the people that head up the companies that you'd *really* need to be talking to try and make something like this actually happen. Pop quiz: how many of the following CEOs do you recognise: Lowell C. McAdam? Chuck Robbins? Brian L. Roberts? Randall L. Stephenson?

  20. Re:Probably too strong on Graphene Shows Promise For Super Strong Dental Fillings (elsevier.com) · · Score: 1

    The temperature inside your mouth doesn't swing that significantly with outside temperature, unless you're dead.

    True, but as I was doing quite a bit of physical exertion and would have been breathing pretty hard orally the assumption was that the air passing around my teeth would have pushed the temperature much closer to the external ambient rather than normal body temp for a prolonged period of time - and that "prolonged" is probably the key regarding the ice cream scenario. I got the same theory from both the local dentist that did an emergency repair on the molar and my own dentist when I got back to the UK; most likely a significant change in temperature combined with the expansion of the original amalgam. My dental insurance presumably agreed with it too, since they didn't contest the claim for the replacement of two otherwise perfectly good fillings.

    Are you sure that was due to thermal expansion and not having an air pocket that expanded due to pressure differences?

    That was quite possibly a contributing factor, but hard to tell since most of the tooth and filling were in pieces. :) As an additional data point, since I had the amalgam in all my fillings replaced with the more expensive formulation all of the sensitivity issues I was having with very cold foods like ice cream, have simply stopped. I'm inclined to think that sensitivity might be caused by the expansion difference, but for it to actually crack the tooth is almost certainly going to take some combination of circumstances like an air pocket or a prolonged period of expansion/contraction.

  21. Re:Probably too strong on Graphene Shows Promise For Super Strong Dental Fillings (elsevier.com) · · Score: 1

    From painful experience it's not just about the tensile strength, the difference in thermal expansion/contraction rate matters as well. Going from snow covered mountain peaks at -10C to a desert with +40C temperatures in just a few hours was sufficient to cause a large filling in one of my molars to expand sufficiently faster than the tooth it was in to cause the tooth to shatter. Net result: one crown, two other fillings of the same amalgam replaced just in case, and quite a large bill.

  22. Re:Wildly expensive on MST3K Kickstarter Poised To Break Kickstarter Record (kickstarter.com) · · Score: 1

    How much of the episode money needs to go to the studio who produced the film being reviewed though? I'm guessing that would be the bulk of the expense of producing each show and is something Joel would probably have a good handle on.

  23. Unless the wallet was shielded (you can already get such things because of a similar scenario with contactless credit/debit cards), then absolutely. There are certainly reasons why this could be a good idea, but also lots of opportunities for it to be abused unless suitable precautions are taken - nothing new there, really.

  24. Because someone can point a very portable RFID reader at a pile of tagged notes and get all the serial numbers, number of notes of each type and total value of the notes in a few seconds vs. having to put them into fairly neat bundles and then drop them into a hopper of a fairly bulky machine that then runs them through a scanner one at a time, albeit at high speed, to read the serial numbers. It would also be very easy to have RFID readers in cash registers and other places that could automatically provide notification if someone was trying to use a known stolen note to pay for something, not to mention feeding more data into the panopticon of course...

  25. Re:dear national security personnel: on NYT Quietly Pulls Article Blaming Encryption In Paris Attacks · · Score: 2

    Meh, they can't even keep their own house in order and prevent all these employees disclosing confidential information to the media - which, as they keep reminding us, was treason of the highest order when Snowden did it. Given that level of sheer incompetence, what hope have they got of actually tracking down any external suspects? Or could it be that it's all bullcrap and the press are just blindly swallowing the agenda pushing propaganda being peddled by people that have been fully briefed on what to say and authorised to lie to the press?