No more Amplification Attack

For God's sake, please disable "monitor" if you operate publicly accessible NTP servers.

By the way, if monitor can be removed from the latest patches of NTP daemon, I see hope of disallowing "ANY" query in resolvers in coming patches.  All name query should be specific.   If you want to do mail exchange, ask for MX followed by A record.  If you want to know the authoritative name server of a domain name, ask for NS.  These days, "ANY" would not serve any purpose except network attacks.

ping 0.0.0.0

Another interesting stuff. An IT guy try to ping 0.0.0.0 in an attempt to troubleshoot connectivity problem. He should be fired immediately.

MAC address intrusion

A complainant said his home PC was accessing by other people over the Internet through MAC address intrusion.  The complainant sought help from his serving ISP.  What should the ISP do?  Just laugh and do nothing. 

Boosting WiFi signal strength by a Coke can

In today's Apple Daily News, there was a story about boosting WiFi receiving signal strength by means of placing a Coke can close to an antenna.  A picture is given below.

The distance between the aluminium foil and the whip antenna should be carefully calculated in order to maximize the directivity which as a norm is λ/2. For this TP-LINK 2.4 GHz router, the distance is (3x10^8/(2.4x10^9x2) = 0.0625 meter or 2.5 inches.

IPv4 turn-off day in 2014

In order to show the technical maturity of IPv6, some intelligent people have suggested to set aside one day in 2014 as the IPv4 turn-off day.  I just want to ask if this idea really makes sense.  If turning off IPv4 results in a large number of users have difficulty  in accessing major websites, people will have a very bad idea about the quality of IPv6. I certainly agree there needs to be an IPv4 turn-off day to test where we are during the transition process and whether there will be broken applications if relying on IPv6 alone. The timing is not this year. It might be in the next 10 years.  For the time being, just enable dual-stack and stay with dual-stack as much as possible. 

紅米的笑話

紅米的笑話：

原定於今日下午12 點進行網上搶購，但由於有幾萬用戶同時登入，引致伺服器故障，工程師花了一段時間搶修，於中午 12 點 30 分才恢復搶購活動。搶修其間，這幾萬用戶放下手頭上的工作，靜待從新登入，各行各業的生產力損失慘重。

紅米害人，一次就夠。

US leads the world in IPv6 deployment

US leads the world again in IPv6 deployment : Verizon - 45 %, Comcast - 28 %, Time Cable Warner - 5.3 %. Finally, the winner is Google Fibre achieving 76 %. These network operators are fantastic !

http://www.internetsociety.org/deploy360/blog/2014/02/new-ipv6-measurements-comcast-nearing-25-verizon-wireless-46-dt-at-18/

IPv6 adoption reaches 10 % in 2014

Leslie Daigle mentioned in her blog that IPv6 traffic will be boosted to over 10 % by year end.   True. This is what I believe from my continuous observation from Google measurement.

http://www.google.com/intl/en/ipv6/statistics.html

I note from Google's traffic measurement that there is a traffic increase of 25 % in every 2 months. Based on this exponential projection, by end 2014, the growth will be 1.25^6 equals to 3.81. Now that we have 2.75 % IPv6 traffic, by year end, the 2.75 % will be boosted to 2.75 x 3.81 equals to 10.49 %. IPv6 traffic reaching 10 % is an important milestone. I am eagerly waiting to witness this important moment.

About NULL

NULL represents an unknown value, and strictly speaking NULL is never equal to NULL.  To say NULL means “does not exist” might not be lexically correct.  Confusing about what I said about, then put me to “/dev/null”. 

流動電視

給自己一個選擇 ：既然家中的電視機只能播粗制濫造的TVB 節目，我已準備好用智能電話和平扳電腦收看其它台。

802.11ac DIY router

小米 802.11ac DIY 路由器，卓頭多於實際！

reformgovernmentsurveillance.com

This site has the worst web server configuration in the world.

reformgovernmentsurveillance.com


It listens on an IP address instead of a fully qualified domain name. Digital certificate and https can not be applied. Lack of "robots.txt", no 404 Error page and I believe there are many other apparent flaws.

Digital Certificates

I want to develop an e-certificate for my own use in the coming 50 years. No way, stuck in the Year2038 epoch issue. What shalI I do then? I am still alive after 2038 !!!

SMTP over TLS, do it or not

After careful deliberation, I propose to my department not to do SMTP over TLS. I am sure I make the right decision. The considerations are as follows:

1. There might be less than 1 % of mail servers globally supporting this function. 

2. There is no standard or recommended practices if self-signed certificates can be allowed in server or client sides. 

3. Equally, there is no standard or recommended practice whether servers should request  clients to present their certificates for authentication. 

4. In the lack of industry practice, network administrators just arbitrarily make their SMTP TLS settings or using the defaults provided by commercial off-the-shelf packages of  security gateways/appliances.   

5. A lot of mail servers which might have operated for many years have outdated CA list. 5. In case of mail delivery failure, it is nearly impossible to conduct trouble-shooting  nor request the other side to amend their settings. 

Opportunistic TLS encryption could only be achieved if there is supporting recommended industry practice

6to4 address connectivity problem

Port25.com is a renowned world leader on enterprise-grade email solutions. How can port25.com has this crazy setting in MX:

port25.com.        3600 IN MX    100   mail.port25.com.

mail.port25.com. 3600 IN AAAA          2002:453f:951e::1

This leads me to issue my last serious warning to all network administrators: 6to4 addresses should not be used to set up web and email servers, whether in test mode or production mode. They cause a lot of troubles. Please use 6in4 tunneling.

Generate CA cert and sign server cert

Many IT bloggers have written down the steps for making self-signed certificates.  I should jotted down my own notes on how to generate my own CA cert and use the CA cert to sign my own server cert.  The procedures, if I can recall correctly, should more or less be as follows:

**** Generate my own CA cert/key and sign my own server cert ****

#openssl genrsa -des3 -out myca.key 4096

[Generate a key for self-signed CA, require to generate a passphrase to protect the key]

#openssl req -new -x509 -days 3650 -key myca.key -out myca.crt

[Use the key to create a X.509 certificate with the name myca.crt]

#openssl genrsa -des3 -out v6-mail.com.key 2048

[Generate a key for my server]

#openssl req -new -key v6-mail.com.key -out v6-mail.com.csr

[Generate certificate signing request from the server key]

#openssl x509 -req -days 3650 -in v6-mail.com.csr -CA myca.crt -CAkey myca.key -set_serial 01 -out v6-mail.com.crt

[Sign the csr with my CA cert and CA key, set the serial number to 01 and generate a signed public key in crt format]

#openssl rsa -in v6-mail.com.key -out new.v6-mail.com.key

(remove passphrase of in a new server keyfile)

#openssl rsa -in myca.key -out new.my-ca.key

(remove passphrase in a new CA keyfile)

rm v6-mail.com.key,

mv new.v6-mail.com.key v6-mai.com.key

rm myca.key

mv new.my-ca.key myca.key

**** End of Processs *****

SMTP over TLS for Gmail

Great, just found out that Gmail performs SMTP over SSL/TLS without caring whether the server or client cert in the other side is signed by a CA. This ensures 100 % support for encryption. That’s says, we can use a self-signed certificate. A million thanks to Gmail.

HSBC email server settings

What the hell is that in my maillog, hsbc attempting to send as Hang Seng Bank? That's why I always say HSBC ignores security. 

Nov 21 01:31:18 i3way sendmail[2228]: STARTTLS=server, relay=psmtp9.hsbc.com.hk [203.112.90.17], version=TLSv1/SSLv3, verify=OK, cipher=DHE-RSA-AES256-SHA, bits=256/256
Nov 21 01:31:19 i3way dkim-filter[5266]: rAKHVI5N002228 external host psmtp9.hsbc.com.hk attempted to send as hangseng.com

免費電視發牌顧問報告

早前立法局欲引用權力及特權法，取得四份顧問報告內容。現在不用了，顧問報告的主要內容已暴光，行會黑箱作業，689自把自為已是無可抵賴的事實，七百萬人現在都知整件事完全沒有公義，你條 689 民望還有排跌呀。

空降政務官做署長

絕不能空降政務官做署長，一旦空降，專業工程師的晉升機會被閹割，共有五個職級同事無得升，包括副署長、助理署長、總工程師、高級工程師及工程師，連帶畢業生都少個機會入職做政府工程師 !

http://news.mingpao.com/20131101/gaa1h.htm

屋宇署長有權處理及清拆危險建築物，這涉及保障市民生命財產，此等任務必須由受過訓練的專業工程師才可勝任。