Posts by Amos

Re: So, IPv4 addresses are like petroleum

Your info is months out of date. It is now below 70% and continues dropping at a consistent rate.

Re: @SuccessCase

"the option to download the update is greyed out."

.. which in software actually means that you cannot turn it off if they want to download it anyway.

Having the option available to flick, but defaulting to _disabled_ is what one should expect to see.

Re: My Personal IPv6 Beef

You seem to have missed the fact that you are no longer tied to having 1 IP address per machine. It is expected to have both an ULA and a global prefix assigned to each LAN machine.

Use DNS views for .local domain to present the ULA for internal machines. That way your machines can use their ULA for LAN communications and whatever random value global-scope has that day for outbound WAN connections. Anything that needs to receive global connections should have fixed IPs so you can either setup a NAT66 to map those to the ULA or assign the appropriate global IP as a third address on the machine presenting that service.

What you end up with is static IPs for services provided to the world, an ephemeral global-scope range for outbound connections, and a static ULA range for internal traffic.

Re: Security Design - been there done that. Twice already.

RFC 7235 etc were redone just a few years ago. That is why the MUST exists on the 407 response status.

There is nothing actually new about this problem. It has been known about since sometime around 2002 when Microsoft found it and fixed similar behaviours in MSIE. The other browser vendors lagged a bit but got their fixes out in 2009. Lookup CVE-2009-1835 if you want a reference.

Re: But it's C++!

If only it was a complete re-write. Most of what you are mentioning is C memory and assertion behaviour that was left in amongst the C++ code for "backwards compatibility". The (few) actual C++ bits work rather well.

Including this lovely new vulnerability that I tracked back to Squid 1.1 before the mists of time got in the way.

Re: pacific islanders?

"I know about how coral islands are dynamic structures that track sea level - but I'd be interested in any verifiable evidence of scaryness."

The warmer sea waters are killing off the corals. Leading to the opposite effect due to erosion. Even so corals grow very, very slowly and it does so after the fact (coral does not grow out of water). Flooding the land with salt water for a century or so is not a great plan for keeping it habitable. Nor is making the volcano underneath the coral produce some more rock (for the smaller islands, Hawaii seems to be doing okay with that approach, but its not an option for the smaller islands.

The biggest issues are not even about water actively covering the land. The other effects that preceed it are worse - the islands water table is flooded with salt water as the rise in sea level adds external pressure and pushes the clean potable water out. The vegetation that can cope with this salty situation are not sufficient to sustain the inhabitants or most local wildlifes food requirements. Loss of vegetation also opens up land to storms (which have higher storm surges and faster wind speeds now) and erosion dragging it down closer to the sea level where the flooding and water table changes have more effects. Its a vicious cycle from lovely tropical island to sandy desert island.

Tuvalu started their planning 2001. A decade later the situation appears not to have changed much, but note the context of 0 population growth as residents are migrating away as fast as they can get approved.

http://www.earth-policy.org/plan_b_updates/2001/update2

Catarets reached tipping point in 2009 with a forced total evacuation of one island. The others are following with only slightly less urgency:

http://www.treehugger.com/corporate-responsibility/first-official-climate-change-refugees-evacuate-their-island-homes-for-good.html

In other words all the small startups and split-offs from larger university-type organisations research groups. I'm seeing a bit of a trend in these past few weeks data theft articles.

"As someone a bit dumb but interested, would this be possible if HTTP2 was being used?"

Yes it would still be possible. HTTP/2 only changes the wire format of the HTTP layer messages and makes TLSv1.2 the minimal version. The SSL/TLS encryption protocol is where the attack is happening. They can use all the trusted CA trickery to intercept connections of any type (email, ssh, even VPN, ... whatever uses SSL/TLS). The downgrade to SSLv2/v3 on the server connection would not be possible in HTTP/2, but that is not a necessary part of the hijack anyway.

Re: Don't do it, Torvalds.

"Care to explain how 3.0 was a major shift from later 2.6?"

Rumour has it 3.0 was in part a celebration of getting rid of The Big Kernel Lock. That make true multi-core support a reality.

Re: Whose modems were they anyway

The NZ consumer market suffered for many years from a bit of a monopoly ("absence of competition"?) on low-cost device types being sold which would also connect to the certain major ISP without something approximating sysadmin skills. ISP provided ones were from the same range of vendors.

Those of us clueful enough to buy quality rather than cheap hardware tend to prefer other ISP services as well. So most of the populace served by said ISP has a range of crap hardware even today.