Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your internet up to date?

en.conn.internet.nl

Post reply on HN
Print view View original

31–40 of 78 posts

Re: Is your internet up to date?

#31

Post by okket »

lmns wrote: post #27
phicoh wrote: post #17

Earlier quoted context omitted.

It's a different threat model. Classical DNS (i.e. without port randomization and a whole host of other tricks) is very easy to spoof from all over the internet. Inserting yourself between a client and a server is way more difficult. Note that from the point of traffic analysis, you still don't want your TLS traffic to go through a third party. So if your thread model mostly includes nation-state attackers then DNSSE…

> If you also want to secure a lookup of, for example, pool.ntp.org then DNSSEC for A and AAAA records also makes sense. The fun part begins when you realize you can't validate DNSSEC because your time drifts too much. So how do you get your initial sync from pool.ntp.org with DNSSEC validation enabled?

Also, at the moment you do not get much by checking their broken DNSSEC entries:

http://dnsviz.net/d/pool.ntp.org/dnssec/

Re: Is your internet up to date?

#32

Post by phicoh »

lmns wrote: post #27
phicoh wrote: post #17

Earlier quoted context omitted.

It's a different threat model. Classical DNS (i.e. without port randomization and a whole host of other tricks) is very easy to spoof from all over the internet. Inserting yourself between a client and a server is way more difficult. Note that from the point of traffic analysis, you still don't want your TLS traffic to go through a third party. So if your thread model mostly includes nation-state attackers then DNSSE…

> If you also want to secure a lookup of, for example, pool.ntp.org then DNSSEC for A and AAAA records also makes sense. The fun part begins when you realize you can't validate DNSSEC because your time drifts too much. So how do you get your initial sync from pool.ntp.org with DNSSEC validation enabled?

If the DNSSEC validating resolver is a server then it is usually not an issue. Most server hardware has battery backed real time clocks. In the odd case that you are bootstrapping a server you would have to set the time manually or make setting the time part of bootstrap process.

For embedded systems that don't have a battery backed real time clock and want to do local DNSSEC validation this is indeed an issue.

There are plenty of hacks to make it work, but no real standard.

Re: Is your internet up to date?

#33

Post by hannob »

ribasushi wrote: post #26
hannob wrote: post #23

Earlier quoted context omitted.

Congratulations, you've understood the main hole of dnssec. The thing is: you can verify dnssec on the client. In theory. It's just that 99,9% (rough estimate, may be higher) of people don't. You'd have to run your own resolver. Which might work, if your ISP isn't doing funny things with your DNS traffic. Which some ISPs do. Which means it can't be deployed widely. This thing was built in the 90s when people assumed…

( serious question - I might not know something ) If I run my own resolver, with a hardcoded [1] trust anchor, how could an ISP affect me regardless of what funny things it does with my DNS traffic...? [1] https://sources.debian.net/src/bind9/1:9.10.3.dfsg.P4-10.1/b...

Well, the traffic is not encrypted or otherwise protected, so a firewall trying to be "smart" could do all kinds of things. E.g. not letting you connect to other DNS servers at all or filtering all queries with unusual record types.

Re: Is your internet up to date?

#34

Post by stordoff »

DaiPlusPlus wrote: post #22
lucaspiller wrote: post #18

Earlier quoted context omitted.

My parents live in a Dorset village and have the same issues. I'm on Three and even in the nearest towns (Dorchester, pop. 20k and Weymouth, pop. 50k) there is usually no or a very weak signal. They finally rolled out BT Infinity last year, so at least that's something. I live in Lithuania now and it really shocks me how bad the UK is for these things. Here I have 600/600 FTTH for €20/month and LTE is basically unive…

It's cheap in Lithuania and other countries because they were was no significant prior investment in telecoms infrastructure, and the costs of deployment are generally lower too (cheaper labour, easier planning-permission) - so when it comes to deploying Internet access to a previously disconnected community it only makes sense to roll-out the bleeding-edge technology (e.g. FTTH). Whereas in the UK, BT was/is obsesse…

> Whereas in the UK, BT was/is obsessed with squeezing every last drop of bandwidth from POTS connections - because the cost of upgrading everyone's last-mile connections from copper (or even aluminium in some cases) to fibre is very cost-prohibitive

This is especially frustrating if you have a line that's directly connected to an exchange - you don't even benefit from the FTTC upgrades. Download-wise I can't complain too much - ~20Mbps is fine most of the time (though with family members that tend to leaving streaming video running constantly and various game consoles that auto-update almost constantly it's not ideal), but the sub-1Mbps upload speed is terrible. If I've anything large to upload, it's usually faster to take it to my grandparents' house - connected to the same exchange, but get a order of magnitude greater upload speeds because they are connected via a cabinet.

> (The only thing that is inexplicable is how even modern, brand-new housing developments still have unshielded copper last-mile connections instead of FTTH: they don't even lay conduits to make it easier for possible future FTTH... idiocy)

Reminds me a story my granddad told me from the 60s/70s (not sure exactly when it was). They'd just finished constructing a new road, laid all the conduits under the road for the various utilities, left them plainly labelled (IIRC it was also pre-planned with the companies, but not certain).... then came back two weeks later to find multiple utility companies had dug up parts of the road to lay their own and done a rough job of patching it back up. He was (understandably) less than impressed!

Re: Is your internet up to date?

#35

Post by bazzargh »

DaiPlusPlus wrote: post #22
lucaspiller wrote: post #18

Earlier quoted context omitted.

My parents live in a Dorset village and have the same issues. I'm on Three and even in the nearest towns (Dorchester, pop. 20k and Weymouth, pop. 50k) there is usually no or a very weak signal. They finally rolled out BT Infinity last year, so at least that's something. I live in Lithuania now and it really shocks me how bad the UK is for these things. Here I have 600/600 FTTH for €20/month and LTE is basically unive…

It's cheap in Lithuania and other countries because they were was no significant prior investment in telecoms infrastructure, and the costs of deployment are generally lower too (cheaper labour, easier planning-permission) - so when it comes to deploying Internet access to a previously disconnected community it only makes sense to roll-out the bleeding-edge technology (e.g. FTTH). Whereas in the UK, BT was/is obsesse…

BT was/is obsessed with squeezing every last drop of bandwidth from POTS connections ... that wasn't what they wanted to do at all.

BT were preparing to do FTTH when I joined them in 1994 (I left in 2001). This was as you say going to be eye-wateringly expensive because BT have a universal provision requirement - they couldn't upgrade the network in the cities and not do it in the countryside. The idea was to pay for this by providing television services, but OfTel (now OfCom) said this would be unfair competition with the cable providers - who were cherry picking cities to make rollout cheaper. They would also have been in competition with Sky, which meant the Murdoch press lobbying against BT (among others; the media market is always a tangle of interests)

Additionally, local-loop unbundling (ie ADSL) was being proposed; BT were required to allow access to the last-mile network from in-exchange equipment, and do this at line rental prices that undercut themselves, in order to break their monopoly. OfTel were very likely to make the same requirement for FTTH/FTTC.

Of course, you pays your money you makes your choice - if BT had been allowed to go ahead with their TV services back then, we might've had FTTH way sooner, but BT probably still would have had a monopoly.

Source: I met the engineers doing FTTH on my first visit to Ipswich, I was part of the team working on the local-loop unbundling ordering systems (where other providers booked engineering time at exchanges) and gave presentations to them at OfTel's offices.

Re: Is your internet up to date?

#36

Post by alexdumitru »

alicewales wrote: post #2

> Is Your Internet Up-To-date? Of course it isn't. I live in the UK.

Come to Romania. We have IPv6, 1Gbps for just ~6 pounds. And as a bonus I got two 3G SIM cards + usb modems with unlimited traffic entirely free.

http://www.speedtest.net/result/5951144497.png

Re: Is your internet up to date?

#37

Post by ribasushi »

hannob wrote: post #33
ribasushi wrote: post #26

Earlier quoted context omitted.

( serious question - I might not know something ) If I run my own resolver, with a hardcoded [1] trust anchor, how could an ISP affect me regardless of what funny things it does with my DNS traffic...? [1] https://sources.debian.net/src/bind9/1:9.10.3.dfsg.P4-10.1/b...

Well, the traffic is not encrypted or otherwise protected, so a firewall trying to be "smart" could do all kinds of things. E.g. not letting you connect to other DNS servers at all or filtering all queries with unusual record types.

But the point of DNSSEC isn't to protect your ability to contact another server, just like the point of SSL isn't to be a substitute for TOR.

Are we on the same page that with DNSSEC activated on a local resolver one would either get an authentic answer, or nothing at all?

Re: Is your internet up to date?

#38

Post by eumoria »

alexdumitru wrote: post #36
alicewales wrote: post #2

> Is Your Internet Up-To-date? Of course it isn't. I live in the UK.

Come to Romania. We have IPv6, 1Gbps for just ~6 pounds. And as a bonus I got two 3G SIM cards + usb modems with unlimited traffic entirely free. http://www.speedtest.net/result/5951144497.png

O.o I'm in New York City which for America has pretty decent fiber service and 100mbit costs ~61 pounds ($75). Very jealous!

Re: Is your internet up to date?

#39

Post by hannob »

ribasushi wrote: post #37
hannob wrote: post #33

Earlier quoted context omitted.

Well, the traffic is not encrypted or otherwise protected, so a firewall trying to be "smart" could do all kinds of things. E.g. not letting you connect to other DNS servers at all or filtering all queries with unusual record types.

But the point of DNSSEC isn't to protect your ability to contact another server, just like the point of SSL isn't to be a substitute for TOR. Are we on the same page that with DNSSEC activated on a local resolver one would either get an authentic answer, or nothing at all?

> Are we on the same page that with DNSSEC activated on a local resolver one would either get an authentic answer, or nothing at all?

Sure. But it's not very relevant, because almost nobody does that. And that's unlikely to change, because getting nothing at all isn't a very desirable state of affairs.

And given that forcing local DNSSEC resolvers in an OS or a browser would likely mean that a large share of your userbase will get nothing at all this is pretty much impractial.

Re: Is your internet up to date?

#40

Post by phicoh »

janvha wrote: post #29

The number of websites unreachable for not having IPv6 equals 0, so saying your internet is not "up to date" because you don't have IPv6 doesn't mean much

Two things. First, it is nice if you don't have to allocate ports on a NAT box to make a test system available. These days you can't really count on all non-production systems having public IPv4 addresses anymore.

Obviously that only works if all systems that need access have IPv6.

However, the main killer app for IPv6 is your ISP running out of IPv4 addresses. Carrier grade NAT boxes are expensive and introduce all kinds of issues. Better to move as much traffic to IPv6 as possible.

Finally, IPv6 seems to be catching on: https://www.google.com/intl/en/ipv6/statistics.html

If at some point IPv6 traffic is the vast majority of the traffic for a website, then IPv4 traffic engineering may start to suffer. So technically the site will be reachable over IPv4 for a very long time. But it may be that at some point performance will be a lot worse then over IPv6.

Post reply on HN