aexaey

> Scott McNealy said early on that retreating to the Data Center was where companies went to die.

That is a striking thought. I wonder how (if at all) does it apply to open source.

GNU/Linux for example always had strong aspirations for desktop [1], yet this never materialized. The only place where Linux (but not GNU) succeeded in a big way outside data-center is becoming a golden-standard hardware abstraction layer for CPEs, Android and to some extent other embedded computing devices.

Now with Linux ABI being embraced first by Joyent in SmartOS [2], and now by Microsoft [3], GNU/Linux is pretty much all-in data-center nowadays. Does that mean it too, is going the way of DEC and Sun in due course?

[1] See "Year of the Linux Desktop" motto from 1998 is pretty much every year thereafter.

[2] https://news.ycombinator.com/item?id=9257130

[3] https://news.ycombinator.com/item?id=11388418

Isn't this just plain old electrophoresis? [1]

https://en.wikipedia.org/wiki/Electrophoresis

> suggest how to do it only for outbound tcp6 handshakes too.

Here you go:

    ip6tables -A OUTPUT -t mangle -m multiport -o eth0 --protocol tcp \
              --tcp-flags ALL SYN --dports 80,8080,443 -j MARK --set-mark 6

    tc qdisc del dev eth0 root
    tc qdisc add dev eth0 root handle 1: htb default 1
    tc class add dev eth0 parent 1: classid 1:6 htb rate 10000Mbps
    tc qdisc add dev eth0 parent 1:6 handle 6: netem delay 100ms
    tc filter add dev eth0 protocol ipv6 prio 1 handle 6 fw flowid 1:6

Although, I would personally throw in an extra class to add 200ms delay to legacy IP protocol:

    iptables -A OUTPUT -t mangle -o eth0 -j MARK --set-mark 4
    ip6tables -A OUTPUT -t mangle -o eth0 -m multiport --protocol tcp \
              --tcp-flags ALL SYN --dports 80,8080,443 -j MARK --set-mark 6

    tc qdisc del dev eth0 root
    tc qdisc add dev eth0 root handle 1: htb default 1
    tc class add dev eth0 parent 1: classid 1:4 htb rate 10000Mbps
    tc class add dev eth0 parent 1: classid 1:6 htb rate 10000Mbps
    tc qdisc add dev eth0 parent 1:4 handle 4: netem delay 200ms
    tc qdisc add dev eth0 parent 1:6 handle 6: netem delay 100ms
    tc filter add dev eth0 protocol ip prio 4 handle 4 fw flowid 1:4
    tc filter add dev eth0 protocol ipv6 prio 6 handle 6 fw flowid 1:6

...just to be compliant with draft-howard-sunset4-v4historic-00 once it becomes RFC.

1mA/MIPS is a pretty generous power budget, with ESP8266 easily fitting the bill (56mA @80MHz + wifi rx; 10 uA in deep sleep [1]). Talking of which - here is Jeroen Domburg's project where he used exactly this chip to make a wireless battery-powered e-ink display:

[0] http://spritesmods.com/?art=einkdisplay

[1] http://bbs.espressif.com/viewtopic.php?t=133

Just having a dedicated port for TLS-wrapped version of the protocol wouldn't help here. HTTPS has 443, yet we still need HSTS to enforce it.

That said, dedicated SMTPS port would still be beneficial by cutting down at least 2 RTTs (HELO/EHLO + STARTTLS) from overall transaction time.

Not exactly a falsehood, but certainly a quirk:

In general, in Europe "0" is national dialing prefix, leading to numbers written in the format of:

+44(0)870123456, meaning dial 0870123456 from within the UK, and +44870123456 internationally to reach the same number (i.e. "0" goes away in international format).

However in Italy, leading "0" in the national dialing format is an integral part of the phone number itself (only for non-mobile numbers); for example:

(+39)051234567 meaning 051234567 when dialing from within IT, and +39051234567 internationally (i.e. "0" stays in international format).

EDIT: Mobile numbers in Italy don't have leading "0", and could only be dialed in full/international format either within the country, or internationally.

> not the most elegant solution but far better than brute force

Actually, brute force works just fine for such a small matrix:

https://gist.github.com/aexaey/3657fa39cc35c861f6d6

>AVR8 (and IIRC 16 and 32)

What's AVR16, may I ask?

16.3 megafarads, assuming typical cell voltage of 2.7v, and total energy of 33kWh:

http://www.wolframalpha.com/input/?i=33kWh%2F%282.7v%29**2

Is that really a legit website affiliated with LinkedIn? Smells fishy:

    $ whois workatlinkedin.com
    (...)
    Creation Date: 2015-12-28T20:13:00.00Z
    Reseller: NAMECHEAP.COM
    (...)
    Registrant Name: WHOISGUARD PROTECTED

    $ dig +short workatlinkedin.com \
    | xargs -L1 whois \
    | grep Organization: \
    | sort -u
    Organization:   CloudFlare, Inc. (CLOUD14)

Did STMicro got an advance notice of this proposal?

http://www.bloomberg.com/news/articles/2016-01-27/stmicro-to...

> The planet, known as 2MASS J2126-8140, is between 12 and 15 times the mass of Jupiter.

Wouldn't object on the higher end of this range be regarded as a brown dwarf, making this system a binary star rather than a planet system?

And this problem (high-speed rail failing to deliver on its promise of sustainable alternative to air travel) is not unique to Britain. Same is happening in mainland Europe too:

http://www.lowtechmagazine.com/2013/12/high-speed-trains-are...

Discussion thread of above article: https://news.ycombinator.com/item?id=6920871

It is really exciting to see AMD opening up, especially in GPU driver area - arguably the weakest point for the free software. I hope this will go further than "1 step forward, 2 steps backward" approach same AMD showed with libreboot involvement:

https://libreboot.org/faq/#amdbastards

https://news.ycombinator.com/item?id=10895021

> I have one using a CDC ether USB gadget to inject rickrolls into web pages.

Interesting. Did you do much hardware-wise for that - like rewire USB D+/D- signals and add/remove some obscure resistor that enables USB gadget mode?

If you don't need sdcard reader, but want RJ45 for wired Ethernet and USB host port connectors out-of-the-box (as opposed to soldering to test-points on Zsun), ~ $7 will get you this:

http://wiki.openwrt.org/toh/unbranded/a5-v11

Reusing unix user ids as application ids is an excellent idea, and it has worked reasonably well in android so far. Good to see this being applied to X/desktop.

There is an article[1] about finding out what location at google maps user is looking at, based on observing TLS packets and nothing else.

If task at hand is to match encrypted connection to a smaller number of alternative (say identify accesses to popular place, like gmail/facebook login page, etc), same technique of observing packet size distribution over time should probably work quite reliably, and cgiproxy will do nothing to hide it.

[1] http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps....

Fair enough. Makes perfect sense, thanks!

If you have clean network path from your terminal to the dev vm, why need for either ProxyCommand or ForwardAgent - just ssh to the vm directly, no?

Of course local, not forwarded ssh-agent on the terminal would be super-handy to avoid typing pass-phrase time and again; but that's different and independent from ForwardAgent.

Not sure which exact scenario do you have in mind with ssh+git. ProxyCommand method works just fine for me with my private jumphost in the middle and github on the far end.

Note that for ProxyCommand to work, you don't need a full shell on a jumphost, just "AllowTcpForwarding yes" is enough. On the other hand, with AgentForwarding method you do need a full shell on a jumphost.

Does anybody else find this eerily reminiscent of heartbleed?

Obscure broken feature that nobody uses (or needs) is enabled by default and allow private keys to leak.

CVE-2016-0777 doesn't interact with ProxyCommand in any special way. That said, after connecting to hostB with your example config above you will have 2 ssh sessions:

1) from your client to hostA

2) from your client to hostB

So to answer your question - no, vulnerable client on hostA is not a problem (or at least not in this particular use-case).

This is client-only vulnerability:

   The matching server code has never been shipped, but the client
   code was enabled by default and could be tricked by a malicious
   server into leaking client memory to the server, including private
   client user keys.[1]

[1] https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-Ja...

Don't use SSH agent forwarding.

https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-con...

In the context of hosting/cloud network what would probably be load balancer / reverse proxy which has the most state/sessions. And incidentally, LBs are probably the piece of dedicated network iron most ripe to be replaced with a bunch of commodity servers and some software.

Regardless, statefulness is bad of course, and less of it you have, the better you are off - we've seen this time and again: share nothing arch[1], Amdahl's law[2], locks-vs-RCU[3], memorizing tcp flows-vs-IP header hash[4,5], etc... Being able to make decision on current packet/memory access here and now, independently, without having to keep track of other flows/connections/sessions/threads beats alternative approaches every time [6].

[1] https://en.wikipedia.org/wiki/Shared_nothing_architecture

[2] https://en.wikipedia.org/wiki/Amdahl's_law

[3] http://www.rdrop.com/users/paulmck/RCU/hart_ipdps06.pdf

[4] https://tools.ietf.org/html/rfc2992

[5] http://www.juniper.net/techpubs/en_US/junos13.2/topics/conce...

[6] Intel's heroic effort to maintain cache coherency at all cost is a notable exception, although opinions vary wildly on whether this is actually the best thing to do, and how long they will be able to sustain it.

Regarding first paragraph of the story (redundant pair or routers crashing at once), it worth mentioning one possible neat trick to avoid this: When having a redundant pair of devices (routers, etc.), make sure such pair is comprised of devices made by different vendors - thinking here being that if there is a bug that triggers router crash, it's unlikely that two different vendors would be vulnerable to the same one.

Or with a generous budget, you can do what BT have done with their 21CN project: For each macro-block (access, aggregation, core), have two redundant networks each one built by a different set of vendors.

The whole tower of Hanoi in pubkeygrab.sh script, complete with two greps and a sed could be replaced with just sed:

  unbound-host -v -D -t TXT ${USER}_pubkey.example.com \
   | sed 's/.*has TXT record "\(ssh-.*\)" (secure)/\1/p;d'

Or, even without sed, reducing to one-liner:

  dig +short +dnssec +sigchase txt $1_pubkey.example.com

EDIT: to address "wtf" concern by ryanlol, we can use a custom trust anchor:

  dig +short +dnssec +sigchase +trusted-key=/etc/my.key txt $1_pubkey.example.com

On ARM side, RK3288* looks promising:

https://libreboot.org/docs/hcl/c201.html

* Yes, that is the very same RK3288 that has an embarrassing calendar bug discussed here a month ago: https://news.ycombinator.com/item?id=10768140

Alas, CPU. Namely ME[1] and FSP/SMM blob [2].

If you are wondering what's wrong with either of them, I would recommend Joanna Rutkowska's research as a starting point [3,4].

[1] https://libreboot.org/faq/#intelme

[2] https://libreboot.org/faq/#fsp

[3] http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf

[4] https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor...