Akamai's corporate blog covering CDN operations, web security updates, and performance topics like Heartbleed patching, leap-second handling, and Brotli compression.
HN commenters mostly link it for specific posts, such as the BEAST and TLS discussion, rather than giving opinions on the blog as a whole.
In addition to this:
Carrier grade NAT ISPs sometimes have global scope ipv6s assigned, and if the other endpoint has ipv6 support, too, you can breakout easily using the assigned ipv6.
Rather than that I would recommend reading up on DNS exfiltration techniques [1] and things like pwnat [2] that use faked SNMP reply packets that make routers think they forgot to let a data packet through for hop traces.
And if you have the time, I'd recommend to use websockets as a tunneling protocol because it's very flexible in its payload size and allows compressions via websocket extensions and the srv flags. I wrote a detailed article that explains the WS13 protocol and all its quirks [3]
Additionally to that it's good to know the limitations of a SOCKS proxy, hence that's what most "easy to use" implementations provide. Spoiler: forget ipv6 via socks5 proxies. I also wrote a detailed article about its quirks [4]
I'm currently experimenting with the idea of a DNS protocol implementation that uses multicast DNS service discovery to find local peers and that uses DNS exfiltration techniques to breakout of a CGNAT, but I'm not there yet to write a detailed article about it. It's current research for my stealth browser project.
[1] https://blogs.akamai.com/2017/09/introduction-to-dns-data-exfiltration.html
[2] https://github.com/samyk/pwnat
[3] https://cookie.engineer/weblog/articles/implementers-guide-to-websockets.html
[4]…
What Cloudflare's announced is more than just DOM reconstruction, though. They sound very different to the likes of Opera Mini Turbo or Amazon Silk's Cloud Browser or Chrome's Fly Wheel...[0] In Cloudflare's case, the rendering happens on the server and only rasterization commands are sent to the clients similar to AWS NICE [1].
As a security product (if you trust Cloudflare), browser isolation sounds super tempting on-paper. As they mention in the blogspot, an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser. DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2].
So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly.
I have also been following MightyApp.com that is trying to do something similar but for consumers and with focus on productivity. It is interesting to see how this would play out. If there's a huge market for this, Google is sure to pounce on it too, and then things will get real interesting... as if AMP, WebComponents [2] and Privacy Sandbox [3] weren't already enough.
[0] https://news.ycombinator.com/item?id=19774768
[1] https://aws.amazon.com/hpc/dcv/
[2]…
See Akamai's response: https://blogs.akamai.com/2013/04/clarifying-state-of-the-internet-report-metrics.html
("This data encompasses connections from both residential and business connections, and as such, represents a blend of the observed connection speeds. (The report has never claimed to measure only residential traffic.) Having said that, we believe that the number of residential connections to Akamai's platform greatly outnumbers the number of business connections, so the potential skew caused by higher speed business connections should be minimized.")
Also, the U.S. does pretty well on Ookla's survey too, compared to similarly-situated countries: http://www.netindex.com. The U.S. average clocks in at 24.1 megabits. Canada and Australia, two similarly sprawl-y Anglo countries clock in at 21.8 and 14.4, respectively. Germany, France, and the U.K. beat us, though, at 25.4, 33.4, at 26.9 megabits, respectively.
However, drilling down, you can see that sparsely-populated central and western states drag down our overall average: http://www.netindex.com/download/2,1/United-States. In the densely-populated Northeast, speeds are generally above 30 megabits. Virginia is 30.3, Pennsylvania is 29.7, New York 30.2, New Jersey 38.2, Maryland 36.8, Delaware 36.0, Massachusetts 34.0, Connecticut 31.4. These are the places in the U.S. that are comparably dense and urbanized as continental Europe.
> Do any site operators actually block non-Google search engine crawlers because being listed DDG/Bing/etc isn't worth the extra cost of serving the crawler?
Many website operators do actually block crawlers from non Google search engines and it's because the cost of being crawled isn't worth it to them. Here's a good quote from one such webmaster:
As a webmaster I get a bit tired of constantly having to deal with the startup crawler du jour.
From law firms looking for DMCA violations to verticals search engines, to image aggregators, to company intelligence resellers… It feels to me that everybody and their brother has gotten into spidering sites.
With 10,000s of pages that have content that is only relevant to a targeted audience who is perfectly able to find us on the majors, I do not hesitate to block (and possibly ban) when I see an aggressive crawler that does not provide me or my customers with direct benefits.
Taken from http://www.skrenta.com/2008/04/cuill_is_banned_on_10000_sites.html
> Perhaps other search engines should spoof GoogleBot. Browsers have being doing that since forever spoofing Netscape (Mozilla), Safari, etc. for the same reason.
People have tried this and it doesn't work. Google provides ways to check to make sure traffic is coming from Google IP addresses and practitioners and academics study how to spot fake…
I'm running OpenNTPD on all my devices (laptops, servers, VMs) and as far as I can tell they are in sync. Both amongsts themselves, as well as with other devices that are running other NTP implementations.
I've heard other people claiming that OpenNTPD is not accurate enough and what not, but my anecdata says it performs well enough. Do you happen to have any specific gripes with it ? Is it the timekeeping algorithm that is lacking ?
Sibling comment mentioned leap seconds, and that's unlikely to change. AFAIK, for 'proper' leap second support, the daemon must support it (to parse the announcement from the upstream NTP) as well as the OS. Gathering from I've read on OpenBSD's mailing lists, leap second support in the kernel is not a priority -- to say the least. Seeing the fallout on other OSes, I'd say it's a sound decision. On a similar note, Google introduced leap smearing to not deal with introducing leap seconds across all of its' servers[1]. Several other actors, such as Amazon[2] and Akamai followed suite.
[1] https://googleblog.blogspot.fr/2011/09/time-technology-and-leaping-seconds.html
[2] https://aws.amazon.com/blogs/aws/look-before-you-leap-the-coming-leap-second-and-aws/
[3] https://blogs.akamai.com/2016/11/planning-for-the-end-of-2016-a-leap-second-and-the-end-of-support-for-sha-1-tls-certificates.html
No, IRR assignments are only regional in terms of the company requesting them. A European company can use their RIPE resources anywhere in the world without "delegating" them.
Yes, filter lists generated by recursively resolving IRR AS-SETs and RPKI can prevent incidents like this, if they were universally applied. Note that origin validation on its own (i.e. what RPKI does) does not prevent malicious attacks, which can just spoof the right origin.
Some Tier 1's - most notably NTT - also use a mechanism called "Peer Lock", where an ASN can specify that it will only ever use a given set of transit providers (i.e. "NTT should never receive a Google prefix from a China Telecom peer"), which would have prevented this.
https://archive.nanog.org/sites/default/files/Snijders_Everyday_Practical_Bgp.pdf
https://blogs.akamai.com/Minimizing%20BGP%20Hijacking%20Risk_2018-10-29.pdf