Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment Attacker is your Peer (Score 4, Insightful) 85

Except "Attacker" in this case is the administrator at the peer, and the peers are entire companies, multinationals, and governments. We're not talking about your average basement-dweller script kiddie.

If your peers are messing with you, or their peers are messing with them, how do you defend against an attack where the whole system is based on trust?

You could go to a no-trust solution, but then that would need a central authority that would need to pre-calculate all the routes from every single AS. If a route breaks, that'll be slow to adjust to a backup route. If a new route needs to be added, the ISP would need to apply to a central authority with bureaucracy and red tape.

If a route needed to be blackholed because of a DDOS, and that action had to be approved of by a central authority, which could take days to weeks for a ruling, nothing could be done because routers would not accept changes to any route until then.

Essentially, the answer to security is to effectively lock out the AS ISPs from their own routers.

You either trust the AS administrators or you don't. And since they're humans, they'll make mistakes, be malicious, or be affected by politics. This won't be solved by (trusting) a central bureaucracy similar to the UN, at least not in a manner you'll prefer.

Comment Slashdot Propaganda Machine (Score 2) 218

10 years ago, there were regularly 800-1000 comments on articles. Now, a highly commented article gets around 200.

It's a shame that the editors have stopped doing their jobs and post anything without checking it (at best!). But this isn't the first time I've seen it.

This submission is obviously false, and it needs to be pulled down or with the inflammatory and false sentence deleted. Since it's been up for hours, and there are numerous posts above that debunk the submission, it leads me to believe that Slashdot wants the clickbait and is leaving it up on purpose.

Do the right thing. Pull the article. Save what's left of your reputation, Slashdot.

Comment Re:Locator/Identifier Separation Protocol (LISP) (Score 1) 248

Thanks for replying to my post instead of keeping the non-brilliance of my ideas to yourself. My biggest concern when writing that post was that I was talking to myself. I'll attempt to address your concerns one by one.

You're... welcome?

Just about all ISPs and backbone carriers carry full tables and many large organisations do as well for multihoming purposes.

Then I misunderstood you. I thought you were repeating what others have said earlier, claiming each router carries a complete copy of all the routes on the Internet, which of course isn't true.

Now that we have that cleared up, I'll snip out parts I don't need to reply to.

Your bitcoinesque solution for IPv6 allocation would make things worse.

It seemed like a technical solution to avoid the politics of Internet governance. I admit it wasn't well thought out, however I am curious how it would make things worse by allowing a small block of IPv6 addresses to be allocated in a decentralized way and adding cryptographic integrity along the way.

Plus, networks transit other networks all the time, meaning one network can advertise a prefix they don't own, legitimately.

I should have been more specific; I was suggesting originating advertisements would be signed as opposed to transient advertisements.

You are asking for DomainKeys but with routes. That is too computationally expensive right now and would require too many lookups and time. Perhaps somewhere down the line when the big iron routers catch up with CPU resources vs line speed.

Routers that speak BGP are on the ISP and backbone level,

Medium to large organisations also use BGP to advertise their address space to their ISP(s).

Not to your home router.

and are physically secured.

Originating BGP route advertisement signing is not intended to supplant physical security measures.

I'm aware of the difference between remote access, console access, and physical access, and hardware vs software.

Your home router doesn't speak BGP, and if it did, your ISP's router would ignore it.

None of this would really be necessary for a home user as their ISP would be doing all of this on their behalf.

That's what I just said...

To announce rogue routes, one needs to hack into the ISP and backbone peering routers -- which happened recently, but is rare.

To announce rogue routes, one only needs an ISP that doesn't filter incoming BGP advertisements properly. It seems apparent as the Internet grows there will be more and more BGP peerings and as a consequence of that not all of them will be competent or aboveboard with their implementations.

You're just restating what I said. I guess I wasn't clear, but I'm also assuming a best practice (or as near as possible) implementation, because there's no use talking about security if people are going to leave the front door open, right? It's not even a discussion at that point.

The Resource Public Key Infrastructure (RPKI) is a step in the right direction, however seems to be mainly for preventing mis-configurations from causing outages. Someone with malicious intent need only use AS path prepending to bypass this protection.

Again, anyone with access to the routers can do this right now. Any organization that doesn't shut its front door can have this happen. This can be solved through best practices. This isn't e-mail. Even if you got people on board for this, it would take a protocol revision AND all new hardware for everyone. It's not going to happen anytime soon.

Don't take it personally. Your offered solution for route signing (whether you wrote them or not) just isn't feasible right now.

Comment Re:Locator/Identifier Separation Protocol (LISP) (Score 1) 248

No one router has a "full table" of all the routes. The routing protocols and the engineers work to make sure the tables are as close to lean as possible.

Your offered solution isn't necessary.

Your bitcoinesque solution for IPv6 allocation would make things worse. Plus, networks transit other networks all the time, meaning one network can advertise a prefix they don't own, legitimately.

Routers that speak BGP are on the ISP and backbone level, and are physically secured. Your home router doesn't speak BGP, and if it did, your ISP's router would ignore it. To announce rogue routes, one needs to hack into the ISP and backbone peering routers -- which happened recently, but is rare.

Comment Re:Let's get one thing straight: (Score 1) 342

You're incorrect on calling me incorrect.

"The Speaker is responsible for ensuring that the House passes legislation supported by the majority party. In pursuing this goal, the Speaker may use his or her power to determine when each bill reaches the floor."
http://en.wikipedia.org/wiki/S...

Please, people. Learn your civics.

Comment Re:Let's get one thing straight: (Score 3, Informative) 342

Your link says:

218 Republicans voted for, 159 Democrats voted against.

So a few Democrats and Republicans breaking ranks does not make this bipartisan. Clearly this is a deeply partisan issue.

You also forget to mention that not one single bill can be voted on unless the Speaker of the House, Republican John Boehner, says it can be voted on.

So, how is this bipartisan again? It was a Republican bill, passed with a Republican majority. Welcome to politics.

Slashdot Top Deals

In Nature there are neither rewards nor punishments, there are consequences. -- R.G. Ingersoll

Working...