Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Tore Anderson
* Cameron Byrne

 FYI http://www.dslreports.com/forum/r27324698-LTE-access-early-
 
 So much for next generation technology ...

Yesterday, Telenor launched LTE.

So. With a green-field deployment, in their home market (supposed to be
the first of their tree-digit million subscribers world-wide to get all
the cool new tech), built on 3GPP specs that fully supports IPv6,
already proven to work by other pioneers (^5 VzW), for which there
are plenty of compatible devices (again, ^5 VzW), and plenty of
compatible content (^5 ISOC, et al.), four months after World IPv6
Launch (in which they participated), and one month after their RIR ran
out of IPv4 addresses...launching without IPv6 support was a perfectly
natural and sensible thing for them to do, it seems.

*sigh*

-- 
Tore Anderson
Redpill Linpro AS - http://www.redpill-linpro.com/



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Mikael Abrahamsson

On Thu, 11 Oct 2012, Tore Anderson wrote:

So. With a green-field deployment, in their home market (supposed to be 
the first of their tree-digit million subscribers world-wide to get all 
the cool new tech), built on 3GPP specs that fully supports IPv6, 
already proven to work by other pioneers (^5 VzW), for which there are 
plenty of compatible devices (again, ^5 VzW), and plenty of compatible 
content (^5 ISOC, et al.), four months after World IPv6 Launch (in which 
they participated), and one month after their RIR ran out of IPv4 
addresses...launching without IPv6 support was a perfectly natural and 
sensible thing for them to do, it seems.


The problem I have seen is not to get IPv6/dual stack in LTE (this worked 
from day one), it's to get dual stack working in all the cases with bearer 
establishment and handover between 2G/3G and 4G.


2G/3G is fully integrated with each other, but LTE is still kind of 
separate, vendors are just now getting around to producing mobile core 
nodes that support all of them with a single node for each function.


Would you want to get IPv6 when you're in the LTE network but lose it when 
you were handed over to 2G/3G. My guess is not, so I believe providers 
will wait until that is really done.


--
Mikael Abrahamssonemail: swm...@swm.pp.se



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread bmanning

https://intelligence.businessinsider.com/facebook-is-adding-over-25000-mobile-users-an-hour-2012-10

dream big

/bill

On Thu, Oct 11, 2012 at 08:31:44AM +0200, Tore Anderson wrote:
 * Cameron Byrne
 
  FYI http://www.dslreports.com/forum/r27324698-LTE-access-early-
  
  So much for next generation technology ...
 
 Yesterday, Telenor launched LTE.
 
 So. With a green-field deployment, in their home market (supposed to be
 the first of their tree-digit million subscribers world-wide to get all
 the cool new tech), built on 3GPP specs that fully supports IPv6,
 already proven to work by other pioneers (^5 VzW), for which there
 are plenty of compatible devices (again, ^5 VzW), and plenty of
 compatible content (^5 ISOC, et al.), four months after World IPv6
 Launch (in which they participated), and one month after their RIR ran
 out of IPv4 addresses...launching without IPv6 support was a perfectly
 natural and sensible thing for them to do, it seems.
 
 *sigh*
 
 -- 
 Tore Anderson
 Redpill Linpro AS - http://www.redpill-linpro.com/



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Tore Anderson
* Mikael Abrahamsson

 Would you want to get IPv6 when you're in the LTE network but lose it
 when you were handed over to 2G/3G.

Absolutely.

That some features are available only on the most advanced access
technology is perfectly reasonable and to be expected, IMHO. If not,
what's the point of upgrading at all?

I lose my YouTube streams when I get handed over from 3G to 2G, too, for
example. I can live with that. I much prefer it to YouTube not working
3G as well, even though that might very well be considered a more
consistent user experience.

-- 
Tore Anderson
Redpill Linpro AS - http://www.redpill-linpro.com



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Mikael Abrahamsson

On Thu, 11 Oct 2012, Tore Anderson wrote:

That some features are available only on the most advanced access 
technology is perfectly reasonable and to be expected, IMHO. If not, 
what's the point of upgrading at all?


Uh, whut? I expect my ssh sessions to survive a 4G-3G handover, and if 
they happen to go over IPv6, I want them to survive.


The important reason to upgrade is to get higher speeds, not to get access 
to new L3 tech.


I lose my YouTube streams when I get handed over from 3G to 2G, too, for 
example. I can live with that. I much prefer it to YouTube not working 
3G as well, even though that might very well be considered a more 
consistent user experience.


I don't agree with you at all. I don't believe I would lose the stream 
when doing that handoff in our network, it might buffer some more (because 
EDGE is slower than HSDPA), but you wouldn't lose the stream.


Consistent behaviour (apart from speed) on all networks is really 
important for me, and I'd imagine it is for most users as well.


--
Mikael Abrahamssonemail: swm...@swm.pp.se



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Matthew Kaufman

On 10/11/2012 8:44 AM, Mikael Abrahamsson wrote:

On Thu, 11 Oct 2012, Tore Anderson wrote:

That some features are available only on the most advanced access 
technology is perfectly reasonable and to be expected, IMHO. If not, 
what's the point of upgrading at all?


Uh, whut? I expect my ssh sessions to survive a 4G-3G handover, and 
if they happen to go over IPv6, I want them to survive.


If your SSH sessions could survive a change in address assignment (which 
often happens in a handover), they could survive a change in address 
family assignment as well.


Unfortunately, TCP - upon which ssh is built - uses the routing 
identifiers as the host identifiers, and so this doesn't work.




The important reason to upgrade is to get higher speeds, not to get 
access to new L3 tech.


I lose my YouTube streams when I get handed over from 3G to 2G, too, 
for example. I can live with that. I much prefer it to YouTube not 
working 3G as well, even though that might very well be considered a 
more consistent user experience.


I don't agree with you at all. I don't believe I would lose the stream 
when doing that handoff in our network, it might buffer some more 
(because EDGE is slower than HSDPA), but you wouldn't lose the stream.


But the stream would almost certainly be coming to a newly assigned IP 
address (and once you're doing that, who cares if the family changes too?)




Consistent behaviour (apart from speed) on all networks is really 
important for me, and I'd imagine it is for most users as well.




The *only* inconsistency would be when you're accessing the IPv6-only 
part of the Internet, of which there's currently none that consumers 
care about.


Matthew Kaufman




Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Mikael Abrahamsson

On Thu, 11 Oct 2012, Matthew Kaufman wrote:

If your SSH sessions could survive a change in address assignment (which 
often happens in a handover), they could survive a change in address 
family assignment as well.


Why would there be an address change in a handover? That is definitely not 
expected behaviour.


But the stream would almost certainly be coming to a newly assigned IP 
address?


Why do you believe that address changes in handover? It's an integral part 
of 3GPP standard that your existing bearer is used for handover, so your 
address shouldn't change. If it changes then it means the handover didn't 
work as designed, probably due to some radio related problem. If the 
address changed, then it means the bearer was torn down and a new bearer 
was initiated. This is definitely not expected behaviour. We have plenty 
of customers with bearers that are up for tens of days in a row.


The *only* inconsistency would be when you're accessing the IPv6-only 
part of the Internet, of which there's currently none that consumers 
care about.


If a user is accessing a stream from an IPv6 enabled CDN that stream 
shouldn't be reset just because a handover happened.


--
Mikael Abrahamssonemail: swm...@swm.pp.se



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Bryan Tong
 Why do you believe that address changes in handover? It's an integral part
 of 3GPP standard that your existing bearer is used for handover, so your
 address shouldn't change. If it changes then it means the handover didn't
 work as designed, probably due to some radio related problem. If the address
 changed, then it means the bearer was torn down and a new bearer was
 initiated. This is definitely not expected behaviour. We have plenty of
 customers with bearers that are up for tens of days in a row.

For that to be true wouldnt support for IPv6 need to be in all
generations of networks. With that standard in place there can not be
new protocols without retrofitting. For a user to switch from 6 to 4
would require and address change however that address change would be
reliant on DNS which would be out of the scope of network grade
support.

On Thu, Oct 11, 2012 at 2:41 AM, Mikael Abrahamsson swm...@swm.pp.se wrote:
 On Thu, 11 Oct 2012, Matthew Kaufman wrote:

 If your SSH sessions could survive a change in address assignment (which
 often happens in a handover), they could survive a change in address family
 assignment as well.


 Why would there be an address change in a handover? That is definitely not
 expected behaviour.

 But the stream would almost certainly be coming to a newly assigned IP
 address?


 Why do you believe that address changes in handover? It's an integral part
 of 3GPP standard that your existing bearer is used for handover, so your
 address shouldn't change. If it changes then it means the handover didn't
 work as designed, probably due to some radio related problem. If the address
 changed, then it means the bearer was torn down and a new bearer was
 initiated. This is definitely not expected behaviour. We have plenty of
 customers with bearers that are up for tens of days in a row.


 The *only* inconsistency would be when you're accessing the IPv6-only part
 of the Internet, of which there's currently none that consumers care about.


 If a user is accessing a stream from an IPv6 enabled CDN that stream
 shouldn't be reset just because a handover happened.


 --
 Mikael Abrahamssonemail: swm...@swm.pp.se




-- 

Bryan Tong
Nullivex LLC | eSited LLC
(507) 298-1624



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Tore Anderson
* Mikael Abrahamsson

 On Thu, 11 Oct 2012, Tore Anderson wrote:
 
 That some features are available only on the most advanced access
 technology is perfectly reasonable and to be expected, IMHO. If not,
 what's the point of upgrading at all?
 
 Uh, whut? I expect my ssh sessions to survive a 4G-3G handover, and if
 they happen to go over IPv6, I want them to survive.

In my experience, long-lived sessions are unreliable when you're on the
move anyway. Go into an elevator? Sessions drop. Subway heads into a
tunnel? Sessions drop. Get in range of a known WiFi network? Sessions
drop. If you want to make an app for mobile, you better be able to
recover. So for me, this is hardly a concern. Still, I'll grant you that
you that you and I might have different priorities here.

I think this is a really poor excuse for not supporting IPv6 and IPv4v6
in any case. Unless I'm gravely misinformed on how 3GPP mobile networks
work, there is absolutely no reason why you cannot on LTE simultaneously
support IPv4, IPv6, and IPv4v6. That the LTE network additionally
supports IPv6/IPv4v6 does not *in any way* prevent you from sticking to
IPv4 in all cases and enjoying the exact same session mobility between
2G/3G/4G as you can if the LTE network only supports IPv4.

The session mobility problem will not go away completely by upgrading
the 2G/3G part of the network, too. As I understand it, there's no
shortage of devices on the market that only supports IPv6 on LTE, but
not on 3G. Apple's iPhones and iPads, for example. So while it won't be
the network's fault, it doesn't really matter - from the end users's
point of view, the exact same thing will happen.

Besides, the LTE network is being touted as a potential replacement for
wired broadband. In that use case, the end user isn't likely to be
mobile at all - presumably he'll have some CPE sitting in his window
sill within LTE coverage 100% of the time. So no session mobility
issues, and all the potential to be provisioned with IPv6 access. But no.

 The important reason to upgrade is to get higher speeds, not to get
 access to new L3 tech.

Missed opportunity if you ask me. We could have had both.

 I lose my YouTube streams when I get handed over from 3G to 2G, too,
 for example. I can live with that. I much prefer it to YouTube not
 working 3G as well, even though that might very well be considered a
 more consistent user experience.
 
 I don't agree with you at all. I don't believe I would lose the stream
 when doing that handoff in our network, it might buffer some more
 (because EDGE is slower than HSDPA), but you wouldn't lose the stream.

I'm not watching a YouTube stream to see a still frame with a
buffering... animation on top, so if I roam into 2G while watching
something, I'll be putting my phone away anyway. Whether or not I
actually lose the TCP connection is besides the point, the application
is useless anyway.

-- 
Tore Anderson
Redpill Linpro AS - http://www.redpill-linpro.com



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Mikael Abrahamsson

On Thu, 11 Oct 2012, Bryan Tong wrote:


Why do you believe that address changes in handover? It's an integral part
of 3GPP standard that your existing bearer is used for handover, so your
address shouldn't change. If it changes then it means the handover didn't
work as designed, probably due to some radio related problem. If the address
changed, then it means the bearer was torn down and a new bearer was
initiated. This is definitely not expected behaviour. We have plenty of
customers with bearers that are up for tens of days in a row.


For that to be true wouldnt support for IPv6 need to be in all
generations of networks. With that standard in place there can not be
new protocols without retrofitting. For a user to switch from 6 to 4
would require and address change however that address change would be
reliant on DNS which would be out of the scope of network grade
support.


The goal is to have dual stack in all networks. Single stack IPv6 has 
worked for a long time in 2G/3G/4G (I did first trials 2 years ago, it's a 
non-brainer). It's the support for a dual stack bearer that is 
problematic.


--
Mikael Abrahamssonemail: swm...@swm.pp.se



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Mikael Abrahamsson

On Thu, 11 Oct 2012, Tore Anderson wrote:


* Mikael Abrahamsson


On Thu, 11 Oct 2012, Tore Anderson wrote:


That some features are available only on the most advanced access
technology is perfectly reasonable and to be expected, IMHO. If not,
what's the point of upgrading at all?


Uh, whut? I expect my ssh sessions to survive a 4G-3G handover, and if
they happen to go over IPv6, I want them to survive.


In my experience, long-lived sessions are unreliable when you're on the
move anyway. Go into an elevator? Sessions drop. Subway heads into a
tunnel? Sessions drop.


I guess you and me have radically different experience of mobile phone 
networks and how well they work.


I think this is a really poor excuse for not supporting IPv6 and IPv4v6 
in any case. Unless I'm gravely misinformed on how 3GPP mobile networks 
work, there is absolutely no reason why you cannot on LTE simultaneously 
support IPv4, IPv6, and IPv4v6. That the LTE network additionally 
supports IPv6/IPv4v6 does not *in any way* prevent you from sticking to 
IPv4 in all cases and enjoying the exact same session mobility between 
2G/3G/4G as you can if the LTE network only supports IPv4.


IPv4v6 on LTE is a no-brainer, I did first tests with that 1.5-2 years 
ago. IPv6 only on 2G/3G/4G also works well. Not that many devices with GA 
firmware supports this unfortunately.


The session mobility problem will not go away completely by upgrading 
the 2G/3G part of the network, too. As I understand it, there's no 
shortage of devices on the market that only supports IPv6 on LTE, but 
not on 3G. Apple's iPhones and iPads, for example. So while it won't be 
the network's fault, it doesn't really matter - from the end users's 
point of view, the exact same thing will happen.


Well, with the current end user device situation, focus is on usb dongles. 
They seem to support all combinations just fine.


Besides, the LTE network is being touted as a potential replacement for 
wired broadband. In that use case, the end user isn't likely to be 
mobile at all - presumably he'll have some CPE sitting in his window 
sill within LTE coverage 100% of the time. So no session mobility 
issues, and all the potential to be provisioned with IPv6 access. But 
no.


Sure. But now you will probably have a 4G router with NAT44, with no IPv6 
support at all. I'd gladly take hints of devices with proper IPv4v6 
support in this area.



The important reason to upgrade is to get higher speeds, not to get
access to new L3 tech.


Missed opportunity if you ask me. We could have had both.


Yes we could, and we will. Just because someone isn't doing it *now* 
doesn't mean it won't be done in the not so distant future.


--
Mikael Abrahamssonemail: swm...@swm.pp.se



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Tore Anderson
* Mikael Abrahamsson

 In my experience, long-lived sessions are unreliable when you're on the
 move anyway. Go into an elevator? Sessions drop. Subway heads into a
 tunnel? Sessions drop.
 
 I guess you and me have radically different experience of mobile phone
 networks and how well they work.

Maybe. Welcome to Oslo. :-)

 I think this is a really poor excuse for not supporting IPv6 and
 IPv4v6 in any case. Unless I'm gravely misinformed on how 3GPP mobile
 networks work, there is absolutely no reason why you cannot on LTE
 simultaneously support IPv4, IPv6, and IPv4v6. That the LTE network
 additionally supports IPv6/IPv4v6 does not *in any way* prevent you
 from sticking to IPv4 in all cases and enjoying the exact same session
 mobility between 2G/3G/4G as you can if the LTE network only supports
 IPv4.
 
 IPv4v6 on LTE is a no-brainer,

...and that is *precisely* why it's so disappointing to see Telenor not
supporting it from day one.

 Besides, the LTE network is being touted as a potential replacement
 for wired broadband. In that use case, the end user isn't likely to be
 mobile at all - presumably he'll have some CPE sitting in his window
 sill within LTE coverage 100% of the time. So no session mobility
 issues, and all the potential to be provisioned with IPv6 access. But no.
 
 Sure. But now you will probably have a 4G router with NAT44, with no
 IPv6 support at all. I'd gladly take hints of devices with proper IPv4v6
 support in this area.

I don't know of any 4G routers at all, but what I do know is that any 4G
router with NAT44 and no IPv6 support would work just fine in an LTE
network that also supported IPv6/IPv4v6.

What I also do know is that if you do manage to get your hands on a
dual-stack capable router (or any other mobile device really), its IPv6
capabilities will *not* work on an LTE network with no IPv6/IPv4v6
bearer support.

 The important reason to upgrade is to get higher speeds, not to get
 access to new L3 tech.

 Missed opportunity if you ask me. We could have had both.
 
 Yes we could, and we will. Just because someone isn't doing it *now*
 doesn't mean it won't be done in the not so distant future.

We could have had it available on LTE *now* and in a not so distant
future on 2G/3G. Doing it incrementally like that would not break any
current IPv4-only stuff, so I don't understand how it's problematic.

-- 
Tore Anderson
Redpill Linpro AS - http://www.redpill-linpro.com



Re: Wired access to SMS?

2012-10-11 Thread jamie rishaw
On Tue, Oct 9, 2012 at 7:15 PM, Aaron Toponce aaron.topo...@gmail.com
wrote:

 Instead, purchase a cellular USB modem with a standard plan. All 4 major
 carriers provide APIs to interact with the modems, and you get everything
 you need*. They aren't cheap (something in the neighborhood of $30/month),
*
 but they work, they are reliable, and you have a committed telecom corp
 dedicated to keeping uptime high, and the API up-to-date.


.. Just my $0.03,

If his need is mission critical, and $30/mo breaks the bank .. I'd
respectfully submit that there wasn't much of a mission.. :-p

I do agree, tho, that an external / serial / aybe-usb gsm device is
the route to pursue.

I also '+1' / 'bump' the earlier suggestion that the OP (bill) look
into Twilio.  Their level of support/interaction/help/you-name-it sets
standards I wish everyone lived by, and Twilio ease of use  reliability is
second to none, or, at the least, one of a very few.


-- 
jamie rishaw // .com.arpa@j - reverse it. ish.


Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Robert E. Seastrom

Subscription only, $199/year (special introductory offer, normally $499!).

Try it free for two weeks but only if you cough up info.

How about a summary for those of us who are disinclined to do either?

-r

bmann...@vacation.karoshi.com writes:

 https://intelligence.businessinsider.com/facebook-is-adding-over-25000-mobile-users-an-hour-2012-10

 dream big

 /bill

 On Thu, Oct 11, 2012 at 08:31:44AM +0200, Tore Anderson wrote:
 * Cameron Byrne
 
  FYI http://www.dslreports.com/forum/r27324698-LTE-access-early-
  
  So much for next generation technology ...
 
 Yesterday, Telenor launched LTE.
 
 So. With a green-field deployment, in their home market (supposed to be
 the first of their tree-digit million subscribers world-wide to get all
 the cool new tech), built on 3GPP specs that fully supports IPv6,
 already proven to work by other pioneers (^5 VzW), for which there
 are plenty of compatible devices (again, ^5 VzW), and plenty of
 compatible content (^5 ISOC, et al.), four months after World IPv6
 Launch (in which they participated), and one month after their RIR ran
 out of IPv4 addresses...launching without IPv6 support was a perfectly
 natural and sensible thing for them to do, it seems.
 
 *sigh*
 
 -- 
 Tore Anderson
 Redpill Linpro AS - http://www.redpill-linpro.com/



Re: Another LTE network turns up as IPv4-only

2012-10-11 Thread Joakim Aronius
* Tore Anderson (tore.ander...@redpill-linpro.com) wrote:
 * Mikael Abrahamsson
 
  In my experience, long-lived sessions are unreliable when you're on the
  move anyway. Go into an elevator? Sessions drop. Subway heads into a
  tunnel? Sessions drop.
  
  I guess you and me have radically different experience of mobile phone
  networks and how well they work.
 
 Maybe. Welcome to Oslo. :-)

But then, if I remember correctly, Telenor choose to go all-in with one of the 
Chinese vendors.. I am really interested to see how that plays out.

/Joakim



[NANOG-announce] Seeking NANOG Communications Committee candidates for upcoming elections and my farewell

2012-10-11 Thread Randy Epstein
Greetings NANOG friends and colleagues!

This month, elections will take place at NANOG 56 in Dallas, TX.  There are
currently two open positions available on the NANOG Communications Committee
for the upcoming 
term.

Some brief information about the Committee and what we are seeking:

The Communications Committee will consist of at least three members selected
by the Board of Directors. Members of the Communications Committee may not
serve concurrently 
on the Board of Directors. The chairperson of the Communications Committee
will serve ex officio in a non-voting role on the Board of Directors, in
order to facilitate
communication between the two groups. One of the primary functions of
Communications Committee is the maintenance of a community mailing list (the
NANOG operators list).
The Communications Committee will be responsible for the administration and
minimal moderation of the list.

The Board of Directors will select the new Communications Committee members
after the election in October. Two positions are to be filled.

The main NANOG mailing list serves an important role in the community by
providing a day-to-day forum for network operators. Participating as a
member of the 
Communications Committee gives you the opportunity to make a noticeable
contribution.

All candidates will be asked to complete a questionnaire about their
qualifications, and to submit a Declaration of Candidacy (DoC), which is
available at 
https://www.nanog.org/governance/elections/2012elections/2012_Declaration_of
_Candidacy.docx.

Communications Committee Member Responsibilities may be viewed at
http://www.nanog.org/governance/CC_Member.pdf.

If you have any further questions, please feel free to reach out to me
directly as well.

Personally, I will not be able to run again as I have now served two terms
(four years) on the Committee and will be termed out.  It has been a
pleasure serving the
members of NANOG and the Board of Directors during these last four years,
from when I first started on the Mailing List Committee and watched over the
transformation into
what is now the Communications Committee.

I'd like to thank the NANOG community for giving me this opportunity as it
has certainly been an enjoyable experience.  I hope to serve the community
again in the future.

Regards,

Randy Epstein
Chair, NANOG Communications Committee



___
NANOG-announce mailing list
nanog-annou...@mailman.nanog.org
http://mailman.nanog.org/mailman/listinfo/nanog-announce

logistics ml?

2012-10-11 Thread Randy Bush
so is there a meeting logistics ml for attendees (as there is for ietf)?
i was asked when i registered, but have seen nothing.  e.g. i am
scheduled to land dfw on sunday 14:00ish and want to ride share into
town.

randy



Roy Bates, Prince Roy of Sealand, dies at 90.

2012-10-11 Thread jamie rishaw
+++
ATH0

http://goo.gl/EdN3C  [SealandGov.org]
also,
http://www.guardian.co.uk/uk/2012/oct/10/prince-sealand-dies

-j
--
sharp, dry wit and brash in his dealings with contestants. - Forbes
/* - teh jamie. ; uri - http://about.me/jgr */

California Voter?  Vote YES on Prop 34.   http://YesOn34.org/


Re: Roy Bates, Prince Roy of Sealand, dies at 90.

2012-10-11 Thread chris
Last I heard sealand was defunct I remember the hosting havenco went dark I
thought sealand shutdown too
On Oct 11, 2012 10:59 AM, jamie rishaw j...@arpa.com wrote:

 +++
 ATH0

 http://goo.gl/EdN3C  [SealandGov.org]
 also,
 http://www.guardian.co.uk/uk/2012/oct/10/prince-sealand-dies

 -j
 --
 sharp, dry wit and brash in his dealings with contestants. - Forbes
 /* - teh jamie. ; uri - http://about.me/jgr */

 California Voter?  Vote YES on Prop 34.   http://YesOn34.org/



Re: Roy Bates, Prince Roy of Sealand, dies at 90.

2012-10-11 Thread Randy Epstein
As a Lord of Sealand, I can assure you Sealand is not defunct.  :)

Randy

On 10/11/12 11:12 AM, chris tknch...@gmail.com wrote:

Last I heard sealand was defunct I remember the hosting havenco went dark
I
thought sealand shutdown too
On Oct 11, 2012 10:59 AM, jamie rishaw j...@arpa.com wrote:

 +++
 ATH0

 http://goo.gl/EdN3C  [SealandGov.org]
 also,
 http://www.guardian.co.uk/uk/2012/oct/10/prince-sealand-dies

 -j
 --
 sharp, dry wit and brash in his dealings with contestants. - Forbes
 /* - teh jamie. ; uri - http://about.me/jgr */

 California Voter?  Vote YES on Prop 34.   http://YesOn34.org/






Re: Verizon's New Repair Method: Plastic Garbage Bags

2012-10-11 Thread Ryan Rawdon

On Aug 20, 2012, at 2:09 PM, Eric Wieling wrote:

 For a while we have had a customer with some lines which go down every time 
 it rains.   We put in the trouble ticket, a couple of days later Verizon says 
 the issue is resolved...until the next time it rains. 
 
 The customer sent us some pictures today of the pole outside their office.   
 The repair appears to be wrapping some plastic bags around something up on 
 the pole.  Here is link to the pictures the customer sent us, in case anyone 
 in the mood for a good scare.
 
 http://rock.nyigc.net/verizon/
 
 
 


I was just walking home to see similar craftsmanship (garbage bags and all) on 
two poles behind our new apartment.  I believe this is ATT territory in Chicago

Pole 1 - there is literally a rat/squirrel/bird nest behind the wiring:
https://lh6.googleusercontent.com/-KqNM2R3MOnQ/UHb7Sk3FPmI/G84/XVDEXZTdCWo/s1126/IMG_20121011_114845.jpg
https://lh5.googleusercontent.com/-Nwe3xErIU4o/UHb7Su66QLI/G84/fOl6fzEy1lM/s1126/IMG_20121011_114848.jpg
https://lh5.googleusercontent.com/-sDjLkDdDt9w/UHb7SuQq-jI/G84/RAUtBJUeENE/s1126/IMG_20121011_114855.jpg

Pole 2 (not quite as bad):
https://lh6.googleusercontent.com/-wONWhhi4q9c/UHb7SrnX0ZI/G84/XcgxT9hDvvw/s1126/IMG_20121011_114926.jpg


Re: Roy Bates, Prince Roy of Sealand, dies at 90.

2012-10-11 Thread Joly MacFie
James Grimmelmann's recent write up is worth reading

http://works.bepress.com/cgi/viewcontent.cgi?article=1035context=james_grimmelmann

j

On Thu, Oct 11, 2012 at 11:16 AM, Randy Epstein na...@hostleasing.netwrote:

 As a Lord of Sealand, I can assure you Sealand is not defunct.  :)

 Randy

 On 10/11/12 11:12 AM, chris tknch...@gmail.com wrote:

 Last I heard sealand was defunct I remember the hosting havenco went dark
 I
 thought sealand shutdown too
 On Oct 11, 2012 10:59 AM, jamie rishaw j...@arpa.com wrote:
 
  +++
  ATH0
 
  http://goo.gl/EdN3C  [SealandGov.org]
  also,
  http://www.guardian.co.uk/uk/2012/oct/10/prince-sealand-dies
 
  -j
  --
  sharp, dry wit and brash in his dealings with contestants. - Forbes
  /* - teh jamie. ; uri - http://about.me/jgr */
 
  California Voter?  Vote YES on Prop 34.   http://YesOn34.org/
 






-- 
---
Joly MacFie  218 565 9365 Skype:punkcast
WWWhatsup NYC - http://wwwhatsup.com
 http://pinstand.com - http://punkcast.com
 VP (Admin) - ISOC-NY - http://isoc-ny.org
--
-


Re: Verizon's New Repair Method: Plastic Garbage Bags

2012-10-11 Thread Jay Ashworth
- Original Message -
 From: Ryan Rawdon r...@u13.net

 On Aug 20, 2012, at 2:09 PM, Eric Wieling wrote:
  For a while we have had a customer with some lines which go down
  every time it rains. We put in the trouble ticket, a couple of days
  later Verizon says the issue is resolved...until the next time it
  rains.
 
  The customer sent us some pictures today of the pole outside their
  office. The repair appears to be wrapping some plastic bags around
  something up on the pole. Here is link to the pictures the customer
  sent us, in case anyone in the mood for a good scare.
 
  http://rock.nyigc.net/verizon/
 
 I was just walking home to see similar craftsmanship (garbage bags and
 all) on two poles behind our new apartment. I believe this is ATT
 territory in Chicago

This isn't news in GTE territory, at least; I've seen them use contractor
garbage bags -- or something akin to them -- and tie-wraps, to close 
broken pedestals, and occasionally aerial closures, for at least 30 years;
GTE was Cut-To-Clear all the way back to the 80s, and maybe into the 70s.

Cheers,
-- jra
-- 
Jay R. Ashworth  Baylink   j...@baylink.com
Designer The Things I Think   RFC 2100
Ashworth  Associates http://baylink.pitas.com 2000 Land Rover DII
St Petersburg FL USA   #natog  +1 727 647 1274



Re: Roy Bates, Prince Roy of Sealand, dies at 90.

2012-10-11 Thread telmnstr

James Grimmelmann's recent write up is worth reading
http://works.bepress.com/cgi/viewcontent.cgi?article=1035context=james_grimmelmann
j


Octal gave a talk at Defcon or HOPE a few years in a row about Sealand. 
The last one he spilled the beans on how bad Sealand did. Managerial and 
customer base wise. IIRC for months the entire internet connection was 
done over a cell phone at 9600bps or some such. He went into some details 
about difficulties of the idea (banks won't accept you.) One of the most 
memorable talks I've seen.


- Ethan O'Toole



Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Jo Rhett
I've finally convinced $DAYJOB to deploy IPv6.  Justification for the IP space 
is easy, however the truth is that a /64 is more than we need in all locations. 
However the last I heard was that you can't effectively announce anything 
smaller than a /48.  Is this still true?

Is this likely to change in the immediate future, or do I need to ask for a /44?

-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.





Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Jeroen Massar
On 2012-10-11 23:02 , Jo Rhett wrote:
 I've finally convinced $DAYJOB to deploy IPv6.  Justification for the
 IP space is easy, however the truth is that a /64 is more than we
 need in all locations. However the last I heard was that you can't
 effectively announce anything smaller than a /48.  Is this still
 true?
 
 Is this likely to change in the immediate future, or do I need to ask
 for a /44?

A /64 is for a single link (broadcast domain, though with IPv6 multicast
domain is more appropriate).

A /48 (or /56 for end-users for some of the RIRs) is for a single
end-site (a different administrative domain and/or a different physical
location).

If you thus have 5 end-sites, you should have room for 5 /48s and thus a
/47 is what you can justify.

If you though are not able to do transit / routing between those sites
as they are not connected one might want to get separate PI /48s for
them. But likely if you are in that camp, just asking for address space,
that you can use stably for a long time, from your network provider who
provides you connectivity is a better way to go.

Greets,
 Jeroen



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Scott Weeks


--- jrh...@netconsonance.com wrote:
From: Jo Rhett jrh...@netconsonance.com

I've finally convinced $DAYJOB to deploy IPv6.  Justification for the IP space 
is easy, however the truth is that a /64 is more than we need in all locations. 
However the last I heard was that you can't effectively announce anything 
smaller than a /48.  Is this still true?

Is this likely to change in the immediate future, or do I need to ask for a /44?



A /48 is 65536 /64s and a /44 is 16x65536 /64s.  If you 
only need one subnet (1 subnet = 1 /64), why would you 
try to get 16x65536 subnets, rather than the 65536 you
have in the /48?

scott



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Randy Carpenter

 --- jrh...@netconsonance.com wrote:
 From: Jo Rhett jrh...@netconsonance.com
 
 I've finally convinced $DAYJOB to deploy IPv6.  Justification for the
 IP space is easy, however the truth is that a /64 is more than we
 need in all locations. However the last I heard was that you can't
 effectively announce anything smaller than a /48.  Is this still
 true?
 
 Is this likely to change in the immediate future, or do I need to ask
 for a /44?
 
 
 
 A /48 is 65536 /64s and a /44 is 16x65536 /64s.  If you
 only need one subnet (1 subnet = 1 /64), why would you
 try to get 16x65536 subnets, rather than the 65536 you
 have in the /48?
 
 scott


He said it was for multiple sites. Per ARIN policy, the next biggest chunk from 
a /48 is a /44, so a /44 is what should be asked for. It is perfectly 
justifiable if you have more than 1 site.

I would not expect anything smaller than a /48 to be allowed in BGP.

A bonus would be that a /44 currently costs the same as a /48 for an enduser, 
so there really is no drawback from getting the /44, and having enough space to 
not have to worry about it in the future.

-Randy



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Jo Rhett
First:
 But likely if you are in that camp, just asking for address space,
 that you can use stably for a long time, from your network provider who
 provides you connectivity is a better way to go.

Um, sorry I figured by the fact that I was posting on Nanog the context was 
clear, but I've forgotten how Nanog is now a go-to source for home network too 
:(  The context was for what Nanog was originally intended for: We are 
provider-independent and peering around the world.

On Oct 11, 2012, at 2:17 PM, Jeroen Massar wrote:
 A /64 is for a single link …(snip)... A /48 (or /56 for end-users for some of 
 the RIRs) is for a single end-site

Sorry, I wasn't looking for the breakdown of expected usage. I know those maps. 
What I was asking was whether you can PI-route a /56 or anything less than a 
/48 today.  It's nice to have a few dozen of the entire Internet for each 
site, but totally unnecessary.

 If you thus have 5 end-sites, you should have room for 5 /48s and thus a
 /47 is what you can justify.

Really? One bit can flip that many ways? ;-)  I assume you mean /45, and 
apparently ARIN's recommended size is /44 anyway.

-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.





Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Jo Rhett
On Oct 11, 2012, at 2:28 PM, Randy Carpenter wrote:
 so there really is no drawback from getting the /44, and having enough space 
 to not have to worry about it in the future.


It's only a worry if you can only route /48s, which was my question. And 
seriously, we're going to be banging around in the emptiness as compared to our 
IPv4 allocations. :)

-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.





Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread William Herrin
On Thu, Oct 11, 2012 at 5:02 PM, Jo Rhett jrh...@netconsonance.com wrote:
 I've finally convinced $DAYJOB to deploy IPv6.  Justification for
 the IP space is easy, however the truth is that a /64 is more
 than we need in all locations. However the last I heard was that
 you can't effectively announce anything smaller than a /48.
 Is this still true?

Hi Jo,

The short answer to your question is:

/48 is the longest prefix from a direct RIR assignment that everyone
currently accepts via BGP.
/32 is the longest prefix from an ISP allocation that everyone
currently accepts via BGP.

As with IPv4 /24's, some folks accept longer prefixes. Not everyone.


 Is this likely to change in the immediate future, or do I need to ask for a 
 /44?

You need to ask for a /44.

Regards,
Bill Herrin


-- 
William D. Herrin  her...@dirtside.com  b...@herrin.us
3005 Crane Dr. .. Web: http://bill.herrin.us/
Falls Church, VA 22042-3004



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread bmanning

one of the downsides to v6 is the huge amnt of space the folks expect you to 
announce.
lots of space to do nefarious things.  that said. if you select your peers 
carefully and don't mind 
a bit of hand crafting, you can /96 and even /112 

that said, get a /32 and assign/announce /48s...

/bill



On Thu, Oct 11, 2012 at 02:02:17PM -0700, Jo Rhett wrote:
 I've finally convinced $DAYJOB to deploy IPv6.  Justification for the IP 
 space is easy, however the truth is that a /64 is more than we need in all 
 locations. However the last I heard was that you can't effectively announce 
 anything smaller than a /48.  Is this still true?
 
 Is this likely to change in the immediate future, or do I need to ask for a 
 /44?
 
 -- 
 Jo Rhett
 Net Consonance : net philanthropy to improve open source and internet 
 projects.
 
 
 



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Scott Weeks
--- rcar...@network1.net wrote:
From: Randy Carpenter rcar...@network1.net
 --- jrh...@netconsonance.com wrote:
 From: Jo Rhett jrh...@netconsonance.com

 I've finally convinced $DAYJOB to deploy IPv6.  Justification for the
 IP space is easy, however the truth is that a /64 is more than we
 need in all locations. However the last I heard was that you can't
 effectively announce anything smaller than a /48.  Is this still
 true?
 
 Is this likely to change in the immediate future, or do I need to ask
 for a /44?
 

 A /48 is 65536 /64s and a /44 is 16x65536 /64s.  If you
 only need one subnet (1 subnet = 1 /64), why would you
 try to get 16x65536 subnets, rather than the 65536 you
 have in the /48?
---

He said it was for multiple sites. 
---

DOH!  
Note to self: focus on the outage and don't respond to NANOG 
while troubleshooting.  ;-)


scott



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Randy Carpenter

- Original Message -
 
 
 On Oct 11, 2012, at 2:28 PM, Randy Carpenter wrote:
 
 
 so there really is no drawback from getting the /44, and having
 enough space to not have to worry about it in the future.
 
 
 It's only a worry if you can only route /48s, which was my question.
 And seriously, we're going to be banging around in the emptiness as
 compared to our IPv4 allocations. :)

You can route /48 or shorter (larger)

How many sites do you have? If less than 192, /44 is perfect, unless some of 
those sites require more than a /48. Then, it gets more complicated :-)

-Randy



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread William Herrin
On Thu, Oct 11, 2012 at 6:06 PM, Randy Carpenter rcar...@network1.net wrote:
 How many sites do you have? If less than 192, /44 is
 perfect, unless some of those sites require more than
 a /48. Then, it gets more complicated :-)

We're having a general math breakdown today. First Jeroen wants to fit
5 /48's in a /47 and now you want to fit 192 /48's in a /44.

48-44=4. 2^4=16.

-Bill




-- 
William D. Herrin  her...@dirtside.com  b...@herrin.us
3005 Crane Dr. .. Web: http://bill.herrin.us/
Falls Church, VA 22042-3004



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Owen DeLong
Wow and I thought nibble boundaries would make the math easier than HD ratios.

Here's the breakdown for those who are mathematically challenged:

n sites prefix
0   Nothing.
1   /48
2-12/44
13-191  /40
192-3071/36
3072-49,151 /32
49,152-786,431  /28

If you're managing more than 786,431 sites, then you should be able to afford
to hire someone who can properly handle the math.

Owen




Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Randy Carpenter

- Original Message -
 On Thu, Oct 11, 2012 at 6:06 PM, Randy Carpenter
 rcar...@network1.net wrote:
  How many sites do you have? If less than 192, /44 is
  perfect, unless some of those sites require more than
  a /48. Then, it gets more complicated :-)
 
 We're having a general math breakdown today. First Jeroen wants to
 fit
 5 /48's in a /47 and now you want to fit 192 /48's in a /44.
 
 48-44=4. 2^4=16.
 
 -Bill

Yep... I don't know why, but I was thinking /40.

So,

1 site = /48
2-12 sites = /44
13-192 sites = /40, and so on.

NRPM 6.5.8.2 for details.

/40 bumps you into the next price category, but it is a 1-time expense for 
endusers.

-Randy



Re: Roy Bates, Prince Roy of Sealand, dies at 90.

2012-10-11 Thread Michael Painter

Joly MacFie wrote:

James Grimmelmann's recent write up is worth reading

http://works.bepress.com/cgi/viewcontent.cgi?article=1035context=james_grimmelmann


So many incredible stories in there...thanks for posting that link.



Re: Is a /48 still the smallest thing you can route independently?

2012-10-11 Thread Jimmy Hess
On 10/11/12, William Herrin b...@herrin.us wrote:
 On Thu, Oct 11, 2012 at 6:06 PM, Randy Carpenter rcar...@network1.net
 wrote:  How many sites do you have? If less than 192, /44 is
 perfect, unless some of those sites require more than
 a /48. Then, it gets more complicated :-)

 We're having a general math breakdown today. First Jeroen wants to fit
 5 /48's in a /47 and now you want to fit 192 /48's in a /44.
 48-44=4. 2^4=16.

Right,   last I checked  the smallest integer  =   Log base 2 of  5
is  not less than or equal to 1,  therefore, you will never fit  5
/48s  in the network  just by  subtracting  1  from the prefix length.

 if  you  want a  prefix /yy  that will accommodate a certain number
N  of   /xx

Then  you must ensure that
 2^(xx - yy)   =  N

not
  5^(xx -yy )   =  N



 -Bill
--
-J



Re: best way to create entropy?

2012-10-11 Thread Jonathan Lassoff
On Thu, Oct 11, 2012 at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:
 in the past, i've done many different things to create entropy -
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
 kernel. but, what is best? just whatever gets your cpu to peak or are
 some tasks better than others?

Personally, I've used and recommend this USB stick: http://www.entropykey.co.uk/

Internally, it uses diodes that are reverse-biased just ever so close
to the breakdown voltage such that they randomly flip state back and
forth.

Cheers,
jof



Re: best way to create entropy?

2012-10-11 Thread Tim Edwards
Nature, via radio active decay!  http://www.fourmilab.ch/hotbits/

-- 
Tim Edwards
c: 206-604-5776


On Thursday, October 11, 2012 at 5:01 PM, shawn wilson wrote:

 in the past, i've done many different things to create entropy -
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
 kernel. but, what is best? just whatever gets your cpu to peak or are
 some tasks better than others?
 
 




Re: best way to create entropy?

2012-10-11 Thread Jimmy Hess
On 10/11/12, shawn wilson ag4ve...@gmail.com wrote:
 in the past, i've done many different things to create entropy -
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
 kernel. but, what is best? just whatever gets your cpu to peak or are

You are referring to  the entropy pool used for  /dev/random  and
crypto operations ?


You could  setup a  video capture card  or radio tuner card,  tune it into
a good noise source,  and arrange for   the bit stream to get  written
 to  /dev/random

Because anything written to  /dev/random  gets  mixed in /  XOR'ed
into the entropy pool



 some tasks better than others?

--
-JH



Re: best way to create entropy?

2012-10-11 Thread Jonathan Lassoff
On Thu, Oct 11, 2012 at 5:20 PM, Jimmy Hess mysi...@gmail.com wrote:
 On 10/11/12, shawn wilson ag4ve...@gmail.com wrote:
 in the past, i've done many different things to create entropy -
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
 kernel. but, what is best? just whatever gets your cpu to peak or are

 You are referring to  the entropy pool used for  /dev/random  and
 crypto operations ?


 You could  setup a  video capture card  or radio tuner card,  tune it into
 a good noise source,  and arrange for   the bit stream to get  written
  to  /dev/random

Yes, but then you're also introducing a way for an external attacker
to transmit data that can be mixed into your entropy pool.

While certainly a cool hack, I don't think anything like this would be
safe for cryptographic use.

/two cents

Cheers,
jof



Re: best way to create entropy?

2012-10-11 Thread Jussi Peltola
On Thu, Oct 11, 2012 at 05:25:37PM -0700, Jonathan Lassoff wrote:
 Yes, but then you're also introducing a way for an external attacker
 to transmit data that can be mixed into your entropy pool.
 
XORring predictable data to random data does not yield a predictable
result. /dev/random is world writable so if writing to it causes the
random generator to output something predictable it's a bug that needs
to be fixed. Also, an analog TV receiver will always have some noise that is
not predictable even if you are transmitting a known signal to it.

If you seriously need good entropy for cryptography, I think you will not
ask about it on nanog, and I'd be very wary of cheap hardware RNGs too.



Re: best way to create entropy?

2012-10-11 Thread Owen DeLong

On Oct 11, 2012, at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:

 in the past, i've done many different things to create entropy -
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
 kernel. but, what is best? just whatever gets your cpu to peak or are
 some tasks better than others?

I find that giving a screwdriver and a hammer to a child between the ages
of 4 and 10 will usually do pretty well.

Owen




Re: best way to create entropy?

2012-10-11 Thread Robert M. Enger

On 10/11/2012 5:08 PM, Jonathan Lassoff wrote:

On Thu, Oct 11, 2012 at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:

in the past, i've done many different things to create entropy -
encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
kernel. but, what is best? just whatever gets your cpu to peak or are
some tasks better than others?

Personally, I've used and recommend this USB stick: http://www.entropykey.co.uk/

Internally, it uses diodes that are reverse-biased just ever so close
to the breakdown voltage such that they randomly flip state back and
forth.

Cheers,
jof


Intel claims to include a hardware Digital Random Number Generator (DRNG) in 
its later generation chips.  Is their offering inadequate/discredited?

http://en.wikipedia.org/wiki/RdRand
http://www.pcmag.com/article2/0,2817,2391367,00.asp
http://www.intel.com/p/en_US/embedded/innovation/security/walker-article-security
http://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide/






Re: best way to create entropy?

2012-10-11 Thread shawn wilson
On Fri, Oct 12, 2012 at 12:49 AM, Robert M. Enger na...@enger.us wrote:
 On 10/11/2012 5:08 PM, Jonathan Lassoff wrote:

 On Thu, Oct 11, 2012 at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:

 in the past, i've done many different things to create entropy -
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
 kernel. but, what is best? just whatever gets your cpu to peak or are
 some tasks better than others?

 Personally, I've used and recommend this USB stick:
 http://www.entropykey.co.uk/

 Internally, it uses diodes that are reverse-biased just ever so close
 to the breakdown voltage such that they randomly flip state back and
 forth.

 Cheers,
 jof

 Intel claims to include a hardware Digital Random Number Generator (DRNG) in
 its later generation chips.  Is their offering inadequate/discredited?

 http://en.wikipedia.org/wiki/RdRand
 http://www.pcmag.com/article2/0,2817,2391367,00.asp
 http://www.intel.com/p/en_US/embedded/innovation/security/walker-article-security
 http://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide/


that's good to know about. i'll have to remember it when tech moves
along in a year or so. but, right now, i don't think i have that
capability. also, i'd prefer to have a chip agnostic solution as a
month or so ago, i wanted to create a key on a raspberry pi (should've
just copied one over) and it took forever to generate enough entropy -
even as i was compiling stuff. after that, i considered tcpdump.



Re: best way to create entropy?

2012-10-11 Thread Mark Andrews

In message 50776926.1030...@enger.us, Robert M. Enger writes:
 On 10/11/2012 5:08 PM, Jonathan Lassoff wrote:
  On Thu, Oct 11, 2012 at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:
  in the past, i've done many different things to create entropy -
  encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
  kernel. but, what is best? just whatever gets your cpu to peak or are
  some tasks better than others?
  Personally, I've used and recommend this USB stick: http://www.entropykey.c
 o.uk/
 
  Internally, it uses diodes that are reverse-biased just ever so close
  to the breakdown voltage such that they randomly flip state back and
  forth.
 
  Cheers,
  jof
 
 Intel claims to include a hardware Digital Random Number Generator (DRNG) in 
 its later generation chips.  Is their offering inadequate/discredited?
 
 http://en.wikipedia.org/wiki/RdRand
 http://www.pcmag.com/article2/0,2817,2391367,00.asp
 http://www.intel.com/p/en_US/embedded/innovation/security/walker-article-secu
 rity
 http://software.intel.com/en-us/articles/intel-digital-random-number-generato
 r-drng-software-implementation-guide/

Which is about time.  It's not like this hasn't been needed for 10+ years.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org



Re: best way to create entropy?

2012-10-11 Thread Jimmy Hess
On 10/11/12, Jonathan Lassoff j...@thejof.com wrote:
 Yes, but then you're also introducing a way for an external attacker
 to transmit data that can be mixed into your entropy pool.

The binary operations used to  'mix in'  data  preserve entropy, when
non-random data is mixed in, given the birwise operation A
(+)  B.
The result is guaranteed to have  entropy no less than the entropy of
A,   and also guaranteed to have entropy no less than the entropy of
B.

The transmitter/source  of data does not control the system's
administrative structures, so it is not possible for one source of
data to reduce  or compromise the entropy of an entropy pool.

An external attacker would have to have a way of making the other
sources of entropy unavailable,  and  make sure the system
over-estimates the amount of remaining entropy, to ensure _no_  new
entropy is available, other than their fake entropy.  That risk is
dwarfed by the risk of physical tampering, installation of remote bugs
to steal key material, etc.


 While certainly a cool hack, I don't think anything like this would be
 safe for cryptographic use.

These methods of generating entropy, when implemented reasonably, are
far better than perfectly adequate  for the generation of random
numbers for one time pads,  and cryptographic  keys for  long term
use;for very high security purposes, as in  3-letter agency use,
multiple independent sources of entropy are recommended.

For high security applications,  actions should always be contemplated
to detect or protect against tampering  with the hardware and
software,   or using software to steal key material.

That may involve the use of  smart cards,  or dedicated
single-purpose  hardware security modules  to generate and store keys,
  so a general purpose computer never has access  to the keys,   only
a very simple one,  that performs just the required crypto operations,
 when the  proper number of authorized users   prove their identity
and ask  the device to perform crypto operations.


For applications that don't require that...  RF noise from one source
fed to  /dev/random  is  highly adequate :)

 jof
--
-JH



Re: best way to create entropy?

2012-10-11 Thread Valdis . Kletnieks
On Thu, 11 Oct 2012 19:20:02 -0500, Jimmy Hess said:

 You could  setup a  video capture card  or radio tuner card,  tune it into
 a good noise source

Finally, a good use for political talk radio. :)


pgpGRW6vGgt7E.pgp
Description: PGP signature


Re: best way to create entropy?

2012-10-11 Thread Dan White

On 10/11/12 17:08 -0700, Jonathan Lassoff wrote:

On Thu, Oct 11, 2012 at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:

in the past, i've done many different things to create entropy -
encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
kernel. but, what is best? just whatever gets your cpu to peak or are
some tasks better than others?


Personally, I've used and recommend this USB stick: http://www.entropykey.co.uk/

Internally, it uses diodes that are reverse-biased just ever so close
to the breakdown voltage such that they randomly flip state back and
forth.


+1.

--
Dan White



Re: best way to create entropy?

2012-10-11 Thread shawn wilson
On Fri, Oct 12, 2012 at 12:08 AM, Jonathan Lassoff j...@thejof.com wrote:
 On Thu, Oct 11, 2012 at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:
 in the past, i've done many different things to create entropy -
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a
 kernel. but, what is best? just whatever gets your cpu to peak or are
 some tasks better than others?

 Personally, I've used and recommend this USB stick: 
 http://www.entropykey.co.uk/



not sure how much others care about server entropy in general.
however, after reading this:
http://strugglers.net/~andy/blog/2010/06/06/adventures-in-entropy-part-1/
i'm basically sold on that entropykey. $30 for a entropy through
electron tunneling with tons of failsafes wow. i might just have
to get two so i can nail the other to a frame, hang it on a wall and
geek out every now and again :)



RE: best way to create entropy?

2012-10-11 Thread Naslund, Steve
I know that a popular method for generating random bit streams is to take radio 
(stellar) noise and convert it into a digital bit stream.  Very popular among 
crypto geeks.

Steven Naslund

-Original Message-
From: Dan White [mailto:dwh...@olp.net] 
Sent: Thursday, October 11, 2012 10:55 PM
To: Jonathan Lassoff
Cc: North American Network Operators Group
Subject: Re: best way to create entropy?

On 10/11/12 17:08 -0700, Jonathan Lassoff wrote:
On Thu, Oct 11, 2012 at 5:01 PM, shawn wilson ag4ve...@gmail.com wrote:
 in the past, i've done many different things to create entropy - 
 encode videos, watch youtube, tcpdump -vvv  /dev/null, compiled a 
 kernel. but, what is best? just whatever gets your cpu to peak or are 
 some tasks better than others?

Personally, I've used and recommend this USB stick: 
http://www.entropykey.co.uk/

Internally, it uses diodes that are reverse-biased just ever so close 
to the breakdown voltage such that they randomly flip state back and 
forth.

+1.

--
Dan White




Re: Native IPv6 providers/datacenters list?

2012-10-11 Thread ML

On 10/9/2012 11:05 AM, Jared Mauch wrote:

On Oct 9, 2012, at 10:42 AM, Ryan Rawdon r...@u13.net wrote:


On Oct 9, 2012, at 9:34 AM, Christopher J. Pilkington wrote:


I want to make an informed response to a comment made by our
CenturyLink rep regarding IPv6, in the context of SAVVIS not
being able to provide IPv6 at their DC3 facility:


There is only a handful of carriers that can provide that
service today and CenturyLink (Legacy Qwest) happen to be one
of them.

Is there a list of native IPv6 providers out there somewhere,
particularly one that includes hosting data centers (e.g.,
SAVVIS), with which I could cluebat^Wshare with my rep?


I'm not sure about a list of facilities, but here's a start for transit 
providers who should be able to provide IPv6 connectivity:

http://en.wikipedia.org/wiki/Comparison_of_IPv6_support_by_major_transit_providers

I'll come out in public and say that sometimes a backbone supports it but the 
datacenter group does not.  This is quite common core - edge deployment 
strategy with network technology.  Some technology can grow from the edges inward, 
but IPv6 is not a technology that does it [well].

I've been observing some big increases in IPv6 traffic (its no longer measured 
in Mbps as from years ago, but in Gbps).  I'm waiting for it to approach a fair 
percentage of the IPv4 traffic but there are some big steps being made by the 
networks and edges to bridge this gap.

- Jared


Avoiding providers that can't provide a complete [*] IPv6 routing table 
is recommended too.  The wiki URL provided by Christopher states quite 
clearly the limitations of using certain providers...



[1] For varying levels of completeness