不要再懶,起番個VPN 比自己手機在大陸番牆上 facebook, 雖然手提電腦可以用SSH + Proxy
Server, 始终都覺得不夠用.
2014/03/30
2014/03/22
home routers as open resolvers
A friendly note to home users with broadband routers : Quite a large number of home routers in use for years have open resolver fault. Please go to
http://www.thinkbroadband.com/tools/dnscheck.html
check your router status and upgrade the firmware to plug the hole.
By having your router as an open resolver, you are helping cybercriminals to launch DDoS attacks.
This is evidence of ASUS RT-N66U routers able to do DNS amplification attacks.
http://www.thinkbroadband.com/tools/dnscheck.html
check your router status and upgrade the firmware to plug the hole.
By having your router as an open resolver, you are helping cybercriminals to launch DDoS attacks.
This is evidence of ASUS RT-N66U routers able to do DNS amplification attacks.
2014/03/18
Open resolvers again
I repeat my statement again: Don’t compare
open resolvers with Google Public DNS (8.8.8.8 and 8.8.4.4) and OpenDNS, they
are not the same. Google and OpenDNS
have all sorts of security features that are beyond imaginations.
2014/03/16
No more Amplification Attack
For God's sake, please disable "monitor" if you operate publicly accessible NTP servers.
By the way, if monitor can be removed from the latest patches of NTP daemon, I see hope of disallowing "ANY" query in resolvers in coming patches. All name query should be specific. If you want to do mail exchange, ask for MX followed by A record. If you want to know the authoritative name server of a domain name, ask for NS. These days, "ANY" would not serve any purpose except network attacks.
By the way, if monitor can be removed from the latest patches of NTP daemon, I see hope of disallowing "ANY" query in resolvers in coming patches. All name query should be specific. If you want to do mail exchange, ask for MX followed by A record. If you want to know the authoritative name server of a domain name, ask for NS. These days, "ANY" would not serve any purpose except network attacks.
2014/03/10
ping 0.0.0.0
Another
interesting stuff. An IT guy try to ping 0.0.0.0 in an attempt to troubleshoot
connectivity problem. He should be fired immediately.
2014/03/08
MAC address intrusion
A complainant said his home PC was accessing by other people over the Internet through MAC address intrusion. The complainant sought help from his serving ISP. What should the ISP do? Just laugh and do nothing.
2014/03/06
Boosting WiFi signal strength by a Coke can
In today's Apple Daily News, there was a story about boosting WiFi receiving signal strength by means of placing a Coke can close to an antenna. A picture is given below.
The distance between the aluminium foil and the whip antenna should be carefully calculated in order to maximize the directivity which as a norm is λ/2. For this TP-LINK 2.4 GHz router, the distance is (3x10^8/(2.4x10^9x2) = 0.0625 meter or 2.5 inches.
The distance between the aluminium foil and the whip antenna should be carefully calculated in order to maximize the directivity which as a norm is λ/2. For this TP-LINK 2.4 GHz router, the distance is (3x10^8/(2.4x10^9x2) = 0.0625 meter or 2.5 inches.
2014/03/03
IPv4 turn-off day in 2014
In order to show the technical maturity of IPv6, some intelligent people have suggested to set aside one day in 2014 as the IPv4 turn-off day. I just want to ask if this idea really makes sense. If turning off IPv4 results in a large number of users have difficulty in accessing major websites, people will have a very bad idea about the quality of IPv6. I certainly agree there needs to be an IPv4 turn-off day to test where we are during the transition process and whether there will be broken applications if relying on IPv6 alone. The timing is not this year. It might be in the next 10 years. For the time being, just enable dual-stack and stay with dual-stack as much as possible.
2014/02/24
紅米的笑話
紅米的笑話：
原定於今日下午12 點進行網上搶購，但由於有幾萬用戶同時登入，引致伺服器故障，工程師花了一段時間搶修，於中午 12 點 30 分才恢復搶購活動。搶修其間，這幾萬用戶放下手頭上的工作，靜待從新登入，各行各業的生產力損失慘重。
紅米害人，一次就夠。
原定於今日下午12 點進行網上搶購，但由於有幾萬用戶同時登入，引致伺服器故障，工程師花了一段時間搶修，於中午 12 點 30 分才恢復搶購活動。搶修其間，這幾萬用戶放下手頭上的工作，靜待從新登入，各行各業的生產力損失慘重。
紅米害人，一次就夠。
2014/02/20
US leads the world in IPv6 deployment
US leads the world again in IPv6 deployment : Verizon - 45 %, Comcast - 28 %, Time Cable Warner - 5.3 %. Finally, the winner is Google Fibre achieving 76 %. These network operators are fantastic !
http://www.internetsociety.org/deploy360/blog/2014/02/new-ipv6-measurements-comcast-nearing-25-verizon-wireless-46-dt-at-18/
http://www.internetsociety.org/deploy360/blog/2014/02/new-ipv6-measurements-comcast-nearing-25-verizon-wireless-46-dt-at-18/
2014/02/04
IPv6 adoption reaches 10 % in 2014
Leslie Daigle mentioned in her blog that IPv6 traffic will be boosted to over 10 % by year end. True. This is what I believe from my continuous observation from Google measurement.
http://www.google.com/intl/en/ipv6/statistics.html
I note from Google's traffic measurement that there is a traffic increase of 25 % in every 2 months. Based on this exponential projection, by end 2014, the growth will be 1.25^6 equals to 3.81. Now that we have 2.75 % IPv6 traffic, by year end, the 2.75 % will be boosted to 2.75 x 3.81 equals to 10.49 %. IPv6 traffic reaching 10 % is an important milestone. I am eagerly waiting to witness this important moment.
http://www.google.com/intl/en/ipv6/statistics.html
I note from Google's traffic measurement that there is a traffic increase of 25 % in every 2 months. Based on this exponential projection, by end 2014, the growth will be 1.25^6 equals to 3.81. Now that we have 2.75 % IPv6 traffic, by year end, the 2.75 % will be boosted to 2.75 x 3.81 equals to 10.49 %. IPv6 traffic reaching 10 % is an important milestone. I am eagerly waiting to witness this important moment.
2014/01/29
About NULL
NULL represents
an unknown value, and strictly speaking NULL is never equal to NULL. To say NULL means “does not exist”
might not be lexically correct. Confusing about what I said about, then put me
to “/dev/null”.
2013/12/22
2013/12/10
reformgovernmentsurveillance.com
This site has the worst web server configuration in the world.
reformgovernmentsurveillance.com
It listens on an IP address instead of a fully qualified domain name. Digital certificate and https can not be applied. Lack of "robots.txt", no 404 Error page and I believe there are many other apparent flaws.
reformgovernmentsurveillance.com
It listens on an IP address instead of a fully qualified domain name. Digital certificate and https can not be applied. Lack of "robots.txt", no 404 Error page and I believe there are many other apparent flaws.
2013/11/29
Digital Certificates
I want to
develop an e-certificate for my own use in the coming 50 years. No way, stuck
in the Year2038 epoch issue. What shalI I do then? I am still alive after 2038
!!!
2013/11/28
SMTP over TLS, do it or not
After careful deliberation, I propose to my department not to do SMTP over TLS. I am sure I make the right decision. The considerations are as follows:
2. There is no standard or recommended practices if self-signed certificates can be allowed in server or client sides.
3. Equally, there is no standard or recommended practice whether servers should request clients to present their certificates for authentication.
4. In the lack of industry practice, network administrators just arbitrarily make their SMTP TLS settings or using the defaults provided by commercial off-the-shelf packages of security gateways/appliances.
5. A lot of mail servers which might have operated for many years have outdated CA list. 5. In case of mail delivery failure, it is nearly impossible to conduct trouble-shooting nor request the other side to amend their settings.
Opportunistic TLS encryption could only be achieved if there is supporting recommended industry practice
1. There might be less than 1 % of mail servers globally supporting this function.
2. There is no standard or recommended practices if self-signed certificates can be allowed in server or client sides.
3. Equally, there is no standard or recommended practice whether servers should request clients to present their certificates for authentication.
4. In the lack of industry practice, network administrators just arbitrarily make their SMTP TLS settings or using the defaults provided by commercial off-the-shelf packages of security gateways/appliances.
5. A lot of mail servers which might have operated for many years have outdated CA list. 5. In case of mail delivery failure, it is nearly impossible to conduct trouble-shooting nor request the other side to amend their settings.
Opportunistic TLS encryption could only be achieved if there is supporting recommended industry practice
2013/11/27
6to4 address connectivity problem
Port25.com is a renowned world leader on enterprise-grade email solutions. How can port25.com has this crazy setting in MX:
port25.com. 3600 IN MX 100 mail.port25.com.
mail.port25.com. 3600 IN AAAA 2002:453f:951e::1
This leads me to issue my last serious warning to all network administrators: 6to4 addresses should not be used to set up web and email servers, whether in test mode or production mode. They cause a lot of troubles. Please use 6in4 tunneling.
port25.com. 3600 IN MX 100 mail.port25.com.
mail.port25.com. 3600 IN AAAA 2002:453f:951e::1
This leads me to issue my last serious warning to all network administrators: 6to4 addresses should not be used to set up web and email servers, whether in test mode or production mode. They cause a lot of troubles. Please use 6in4 tunneling.
2013/11/25
Generate CA cert and sign server cert
Many IT bloggers have written down the steps for making self-signed certificates. I should jotted down my own notes on how to generate my own CA cert and use the CA cert to sign my own server cert. The procedures, if I can recall correctly, should more or less be as follows:
**** Generate my own CA cert/key and sign
my own server cert ****
#openssl genrsa -des3 -out myca.key 4096
[Generate a key for self-signed CA, require
to generate a passphrase to protect the key]
#openssl req -new -x509 -days 3650 -key
myca.key -out myca.crt
[Use the key to create a X.509 certificate
with the name myca.crt]
#openssl genrsa -des3 -out v6-mail.com.key
2048
[Generate a key for my server]
#openssl req -new -key v6-mail.com.key -out
v6-mail.com.csr
[Generate certificate signing request from
the server key]
#openssl x509 -req -days 3650 -in
v6-mail.com.csr -CA myca.crt -CAkey myca.key -set_serial 01 -out
v6-mail.com.crt
[Sign the csr with my CA cert and CA key,
set the serial number to 01 and generate a signed public key in crt format]
#openssl rsa -in v6-mail.com.key -out
new.v6-mail.com.key
(remove passphrase of in a new server keyfile)
#openssl rsa -in myca.key -out
new.my-ca.key
(remove passphrase in a new CA keyfile)
rm v6-mail.com.key,
mv new.v6-mail.com.key v6-mai.com.key
rm myca.key
mv new.my-ca.key myca.key
**** End of Processs *****
2013/11/23
SMTP over TLS for Gmail
Great, just found out that Gmail performs SMTP over SSL/TLS without caring whether the server or client cert in the other side is signed by a CA. This ensures 100 % support for encryption. That’s says, we can use a self-signed certificate. A million thanks to Gmail.
Subscribe to:
Posts (Atom)