171–180 of 257 posts
Earlier quoted context omitted.
Thanks a lot, Appreciate. It is not I don't want to pay the washingtonpost.com. I just don't have time to read them.
Great point and totally off-topic, but I wonder if there is someone who reads the NY Times each and everyday in full.
Earlier quoted context omitted.
In our case, we were setting up VPN tunnels to a partner, who for some reason required that the addresses on our side should (appear to be) public IP addresses. So we couldn't use 10/8 or 192.168/16 in (that part of) our network. They didn't actually need the addresses to be routable from the public internet (that was the whole point of the VPN). I think the requirement was really a way of making sure they were uniqu…
There's also 172.16/12 :) But yeah I agree. If you're running a VPN for a large company it's kinda hard to avoid such conflicts. In my work we use 10.0.0.0/8 but of course some people use the same at home even though 192.168/16 is way more common. In general I find 172.16/12 the least common in the field.
Still gives you fun issues though.
Paywall-free link: https://archive.is/tKOOA
Thanks a lot, Appreciate. It is not I don't want to pay the washingtonpost.com. I just don't have time to read them.
curl https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/?outputType=amp |grep -o "" > 1.htm
firefox ./1.htmEarlier quoted context omitted.
There's also 172.16/12 :) But yeah I agree. If you're running a VPN for a large company it's kinda hard to avoid such conflicts. In my work we use 10.0.0.0/8 but of course some people use the same at home even though 192.168/16 is way more common. In general I find 172.16/12 the least common in the field.
I personally use a range towards the end of the 172.16/12 reservation for my home network for exactly this reason. Ever since I made the change five years ago I’ve never suffered any conflicts when running a VPN in or out.
And many are surprised to find that there are 172.* that are routable.
Earlier quoted context omitted.
These IP addresses were unused for a very long time, so using them on internal networks worked fine. Once the Floridian company in the article started announcing them, gateway routers on the Chinese internal networks may have started sending their traffic to Florida.
Why would you do that though when there are perfectly fine internal address ranges available?
Can someone explain how we know these “announcements” are real? What’s to stop me setting up a company and announcing random dormant address ranges that I don’t own?
rpki[0], but that doesn't mean fake bgp announcements, considered bgp hijacking[1], don't happen[2]. Once every t1 drops invalid prefixes, then rpki will effectively mean no T1 can turn off the internet for other ASNs, but everyone signing their prefixes is required to mean nobody can fake announce an IP. It looks like the DOD's routes are indeed signed[3]. 0: https://isbgpsafeyet.com/ 1: https://www.thousandeyes.com…
The prefixes are in the https://www.radb.net
Somebody (as everybody can do this with radb) said to RADB that 8003 is the correct origin for these prefixes.
Considering the DoD hasnt rained hell on the RADB, Id guess theyre good as well, but its not RPKI signed.
Earlier quoted context omitted.
It’s the principle for me. I won’t support any publication with obvious bias.
Everyone has bias of one kind or another.
personally I find outlets like NYT or NYPost to be too filled with the type of 'state-level bias' that I have a mental allergy to.
Earlier quoted context omitted.
DDS hires professional engineers at a special paygrade pegged to their civilian pay stubs for a 2 year tour of duty fixing pressing issues in DoD tech via pretty broad authority to sidestep A) the usual senior military slow-roll* in the way of these fixes B) the sh**y govt contractors who made the tech and usually get paid to fix their own bad tech. DDS Hires a lot of motivated engineers who would be in civil service…
> DDS hires professional engineers at a special paygrade pegged to their civilian pay stubs I wish USDS would do this as well; I feel like they'd attract a lot more talent. Although perhaps they want to attract exactly the kind of talent who would take a big pay cut out of a sense of service/duty. > Cool stuff and I’d work for them in a second For myself, while I recognize that military is a necessary evil in the wor…
90% (might be a bit generous) of the people so attracted will not be the kind.
Earlier quoted context omitted.
> If China or Russia would suddenly reroute a ton of traffic from outside their countries, to their respective government agencies It is their IP space. It is entirely on your incompetent network staff if you are stealing IPs that are 1) not yours, 2) in use, 3) not in your country for internal use and on top of that, not rejecting external routes to it. It is not "rerouting a ton of traffic", the traffic was destine…
You can debate semantics all you want, it doesn't change the reality of the situation and how the problem of IPv4 address exhaustion is very real and not just down to "incompetent network staff". The DoD sitting on all that unused address space actively contributed to that problem and now it's exploiting band-aid fixes around it to once again play data kranken of the world under the guise of "We are just fighting APT…
Earlier quoted context omitted.
Alibaba for example use DoD address ranges for their management servers running Alicloud services. They assumed since nothing in their cloud platform would connect to those addresses they can use these them to alleviate IPv4 shortage. In Alicloud, the customer have the right to use any RFC1918 addresses, so they had to be creative since they didn’t have sufficient IPv4 addresses.
but if they're not filtering BGP announcements for those ranges (however unlikely), and the GFW isn't blocking traffic out to those addresses (even more unlikely), and the internal metrics were high (super unlikely), I guess it'd slurp out all the traffic? maybe this was a weird smash-and-grab.