TechSNAP - Episodes Tagged with “Networking”

428: RAID Reality Check

Jupiter Broadcasting — Fri, 01 May 2020 00:15:00 -0700

We dive deep into the world of RAID, and discuss how to choose the right topology to optimize performance and resilience.

Plus Cloudflare steps up its campaign to secure BGP, and why you might want to trade in cron for systemd timers.

Links:

426: Storage Stories

Jupiter Broadcasting — Fri, 03 Apr 2020 00:15:00 -0700

We take a look at Cloudflare's impressive Linux disk encryption speed-ups, and explore how zoned storage tools like dm-zoned and zonefs might help mitigate the downsides of Shingled Magnetic Recording.

Plus we celebrate WireGuard's inclusion in the Linux 5.6 kernel, and fight some exFAT FUD.

Links:

WireGuard VPN makes it to 1.0.0—and into the next Linux kernel — It's a good day for WireGuard users—DKMS builds will soon be behind us.
Linux 5.6 Is The Most Exciting Kernel In Years With So Many New Features
fs: New zonefs file system — zonefs is a very simple file system exposing each zone of a zoned block device as a file. This is intended to simplify implementation of application zoned block device raw access support by allowing switching to the well known POSIX file API rather than relying on direct block device file ioctls and read/write.
Ama-ZNS! Zonefs File-System Will Land with Linux® 5.6
What is Zoned Storage and the Zoned Storage Initiative? — Zoned Storage is a new paradigm in storage motivated by the incredible explosion of data. Our data-driven society is increasingly dependent on data for every-day life and extreme scale data management is becoming a necessity.
Linux Kernel Support - ZonedStorage.io
dm-zoned — The dm-zoned device mapper target exposes a zoned block device as a regular block device.
Device Mapper - ZonedStorage.io
What are PMR and SMR hard disk drives?
Beware of SMR drives in PMR clothing — WD and Seagate are both submarining Drive-managed SMR (DM-SMR) drives into channels, disguised as "normal" drives.
Beware of SMR drives in PMR clothing [Reddit]
The exFAT filesystem is coming to Linux—Paragon software’s not happy about it — When software and operating system giant Microsoft announced its support for inclusion of the exFAT filesystem directly into the Linux kernel back in August, it didn't get a ton of press coverage. But filesystem vendor Paragon Software clearly noticed this month's merge of the Microsoft-approved, largely Samsung-authored version of exFAT into the VFS for-next repository, which will in turn merge into Linux 5.7—and Paragon doesn't seem happy about it.
The New Microsoft exFAT File-System Driver Is Set To Land With Linux 5.7
Speeding up Linux disk encryption - The Cloudflare Blog — Encrypting data at rest is vital for Cloudflare with more than 200 data centres across the world. In this post, we will investigate the performance of disk encryption on Linux and explain how we made it at least two times faster for ourselves and our customers.
Add inline dm-crypt patch and xtsproxy Crypto API patch

422: Multipath Musings

Jupiter Broadcasting — Fri, 07 Feb 2020 00:15:00 -0800

We take a look at a few exciting features coming to Linux kernel 5.6, including the first steps to multipath TCP.

Plus the latest Intel speculative execution vulnerability, and Microsoft's troubled history with certificate renewal.

Links:

421: Firewall Fun

Jupiter Broadcasting — Fri, 24 Jan 2020 00:15:00 -0800

We explore the latest round of Windows vulnerabilities and Jim shares his journey adding OPNsense to his firewall family.

Plus a look back at Apollo-era audio that's still relevant today with the surprising story of the Quindar tones.

Links:

420: Choose Your Own Compiler

Jupiter Broadcasting — Fri, 10 Jan 2020 00:15:00 -0800

Compiling the Linux kernel with Clang has never been easier, so we explore this alternative compiler and what it brings to the ecosystem.

Plus Debian's continued init system debate, and our frustrations over 5G reporting.

Links:

419: Nebulous Networking

Jupiter Broadcasting — Fri, 27 Dec 2019 00:15:00 -0800

From classifying cats to colorizing old photos we share our top tips and tools for starting your machine learning journey. Plus, learn why Nebula is our favorite new VPN technology, and how it can help simplify and secure your network.

Links:

418: 5G Fundamentals

Jupiter Broadcasting — Fri, 13 Dec 2019 00:15:00 -0800

As the rollout of 5G finally arrives, we take some time to explain the fundamentals of the next generation of wireless technology.

Plus the surprising performance of eero's mesh Wi-Fi, some great news for WireGuard, and an update on the Librem 5.

Links:

417: Machine Learning Magic

Jupiter Broadcasting — Fri, 29 Nov 2019 00:15:00 -0800

We explore the rapid adoption of machine learning, its impact on computer architecture, and how to avoid AI snake oil.

Plus so-so SSD security, and a new wireless protocol that works best where the Wi-Fi sucks.

Links:

413: The Coffee Shop Problem

Jupiter Broadcasting — Fri, 04 Oct 2019 00:15:00 -0700

We peer into the future with a quick look at quantum supremacy, debate the latest DNS over HTTPS drama, and jump through the hoops of HTTP/3.

Plus when to use WARP, the secrets of Startpage, and the latest Ryzen release.

Links:

412: Too Good To Be True

Jupiter Broadcasting — Fri, 20 Sep 2019 00:15:00 -0700

It's TechSNAP story time as we head out into the field with Jim and put Sure-Fi technology to the test.

Plus an update on Wifi 6, an enlightening Chromebook bug, and some not-quite-quantum key distribution.

Links:

RF Chirp tech: Long distance, incredible penetration, low bandwidth | Ars Technica — Recently, I took the company's technology for a spin with a pair of hand-held demo communicators about the size of a kid's walkie-talkie. They don't do much—just light up with a signal strength reading on both devices, whenever a transmit button on either is pressed—but that's enough to get a good indication of whether the tech will work to solve a given problem.
Wi-Fi 6 Is Officially Here: Certification Program Begins — Finally, along with the launch of the certification program itself, the Wi-Fi Alliance has already certified its first dozen devices.
Say hello to 802.11ax: Wi-Fi 6 device certification begins today | Ars Technica — Today, the Wi-Fi Alliance launched its Wi-Fi Certified 6 program, which means that the standard has been completely finalized, and device manufacturers and OEMs can begin the process of having the organization certify their products to carry the Wi-Fi 6 branding.
Someone sent us 21 more pictures of the leaked Pixel 4 XL - The Verge
iPhone 11, iPhone 11 Pro, and iPhone 11 Pro Max: Hands-on with Apple’s new phones | Ars Technica
Some Chromebooks mistakenly declared themselves end-of-life last week | Ars Technica — A lot of Chromebook and Chromebox users don't realize this, but all ChromeOS devices have an expiration date. Google's original policy was for devices to be supported for five years, but the company has recently extended that time to 6.5 years.
LINUX Unplugged 318: Manjaro Levels Up
Fear the Man in the Middle? This company wants to sell quantum key distribution | Ars Technica
Gentle intro to Quantum Key Distribution (QKD) – Lahiru Madushanka
The Super-Secure Quantum Cable Hiding in the Holland Tunnel - Bloomberg — Banks and governments are testing quantum key distribution technology to guard their closest secrets.
Quantum Key Distribution - QKD — This paper provides an overview of quantum key distribution targeted towards the computer science community. A brief description of the relevant principles from quantum mechanics is provided before surveying the most prominent quantum key distribution protocols present in the literature.
TechSNAP 403: Keeping Systems Simple
Linux Headlines — Linux and open source headlines every weekday, in under 3 minutes.

406: SACK Attack

Jupiter Broadcasting — Sun, 23 Jun 2019 18:15:00 -0700

A new vulnerability may be the next 'Ping of Death'; we explore the details of SACK Panic and break down what you need to know.

Plus Firefox zero days targeting Coinbase, the latest update on Rowhammer, and a few more reasons it's a great time to be a ZFS user.

Links:

SACK Panic Security Bulletin — Netflix has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels. The vulnerabilities specifically relate to the Maximum Segment Size (MSS) and TCP Selective Acknowledgement (SACK) capabilities. The most serious, dubbed “SACK Panic,” allows a remotely-triggered kernel panic on recent Linux kernels.
Ubuntu SACK Panic Guidance — You should update your kernel to the versions specified below in the Updates section and reboot. Alternatively, Canonical Livepatch updates will be available to mitigate these two issues without the need to reboot.
Red Hat SACK Panic Advisory — Red Hat customers running affected versions of these Red Hat products are strongly recommended to update them as soon as errata are available. Customers are urged to apply the available updates immediately and enable the mitigations as they feel appropriate.
RFC 2018 - TCP Selective Acknowledgment Options — TCP may experience poor performance when multiple packets are lost from one window of data. With the limited information available from cumulative acknowledgments, a TCP sender can only learn about a single lost packet per round trip time. An aggressive sender could choose to retransmit packets early, but such retransmitted segments may have already been successfully received. A Selective Acknowledgment (SACK) mechanism, combined with a selective repeat retransmission policy, can help to overcome these limitations.
Ping of Death — In a nutshell, it is possible to crash, reboot or otherwise kill a large number of systems by sending a ping of a certain size from a remote machine.
Firefox zero-day was used in attack against Coinbase employees, not its users | ZDNet — A recent Firefox zero-day that has made headlines across the tech news world this week was actually used in attacks against Coinbase employees, and not the company's users.
Mozilla fixes second Firefox zero-day exploited in the wild | ZDNet — Mozilla has released a second security update this week to patch a second zero-day that was being exploited in the wild to attack Coinbase employees and other cryptocurrency organizations.
RAMBleed — RAMBleed is a side-channel attack that enables an attacker to read out physical memory belonging to other processes. The implications of violating arbitrary privilege boundaries are numerous, and vary in severity based on the other software running on the target machine. As an example, in our paper we demonstrate an attack against OpenSSH in which we use RAMBleed to leak a 2048 bit RSA key.
Digging into the new features in OpenZFS post-Linux migration | Ars Technica — One of the most important new features in 0.8 is Native ZFS Encryption. Until now, ZFS users have relied on OS-provided encrypted filesystem layers either above or below ZFS. While this approach does work, it presented difficulties.
Allan Jude on Twitter — Once the FreeBSDs are upstreamed, everything is changing to 'OpenZFS', including the github organization currently know as 'zfsonlinux'.
ZFS on Linux Releases
Linux Academy is hiring!
Mozilla teases $5-per-month ad-free news subscription — Mozilla has started teasing an ad-free news subscription service, which, for $5 per month, would offer ad-free browsing, audio readouts, and cross-platform syncing of news articles from a number of websites.

404: Prefork Pitfalls

Jupiter Broadcasting — Sat, 25 May 2019 18:00:00 -0700

We turn our eye to web server best practices, from the basics of CDNs to the importance of choosing the right multi-processing module.

Plus the right way to setup PHP, the trouble with benchmarking, and when to choose NGiNX.

Links:

Jim's Blog: Installing WordPress on Apache the modern way — It’s been bugging me for a while that there are no correct guides to be found about using modern Apache 2.4 or above with the Event or Worker MPMs. We’re going to go ahead and correct that lapse today, by walking through a brand-new WordPress install on a new Ubuntu 18.04 VM.
Apache Performance Tuning — Apache 2.x is a general-purpose webserver, designed to provide a balance of flexibility, portability, and performance. Although it has not been designed specifically to set benchmark records, Apache 2.x is capable of high performance in many real-world situations.
Tuning Your Apache Server
worker - Apache HTTP Server Version 2.4 — This Multi-Processing Module (MPM) implements a hybrid multi-process multi-threaded server. By using threads to serve requests, it is able to serve a large number of requests with fewer system resources than a process-based server.
event - Apache HTTP Server Version 2.4 — The event Multi-Processing Module (MPM) is designed to allow more requests to be served simultaneously by passing off some processing work to the listeners threads, freeing up the worker threads to serve new requests.
PHP-FPM — PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites.
FastCGI overview — FastCGI is a way to have CGI scripts execute time-consuming code (like opening a database) only once, rather than every time the script is loaded. In technical terms, FastCGI is a language independent, scalable, open extension to CGI that provides high performance without the limitations of server specific APIs.
Alexa Top 500 Global Sites
What Is a CDN? How Does a CDN work? — A content delivery network (CDN) refers to a geographically distributed group of servers which work together to provide fast delivery of Internet content.
W3 Total Cache – WordPress plugin — W3 Total Cache improves the SEO and user experience of your site by increasing website performance, reducing load times via features like content delivery network (CDN) integration and the latest best practices.
krakjoe/apcu: APCu - APC User Cache — APCu is an in-memory key-value store for PHP. Keys are of type string and values can be any PHP variables.
PHP: APCu - Manual
Introduction to Varnish — Varnish HTTP Cache — Varnish Cache is a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architectur
ab - Apache HTTP server benchmarking tool — ab is a tool for benchmarking your Apache Hypertext Transfer Protocol (HTTP) server. It is designed to give you an impression of how your current Apache installation performs. This especially shows you how many requests per second your Apache installation is capable of serving.
HTTP(S) Benchmark Tools
jimsalterjrs/network-testing — This is a small collection of GPLv3-licensed tools to assist an intrepid researcher in testing the performance of networks, wired or wireless.

397: Quality Tools

Jupiter Broadcasting — Thu, 14 Feb 2019 21:00:00 -0800

Join Jim and Wes as they battle bufferbloat, latency spikes, and network hogs with some of their favorite tools for traffic shaping, firewalling, and QoS.

Plus the importance of sane defaults and why netdata belongs on every system.

Links:

Why you want QoS - Netdata Documentation — One of the features the Linux kernel has, but it is rarely used, is its ability to apply QoS on traffic. Even most interesting is that it can apply QoS to both inbound and outbound traffic.
FireQOS Wiki — FireQOS is a helper to assist you configure traffic shaping on Linux.
FireHOL - Linux firewalling and traffic shaping for humans — FireHOL is a language (and a program to run it) which builds secure, stateful firewalls from easy to understand, human-readable configurations. The configurations stay readable even for very complex setups.
tc(8) man page — Traffic Control consists of the following: SHAPING When traffic is shaped, its rate of transmission is under control. Shaping may be more than lowering the available bandwidth - it is also used to smooth out bursts in traffic for better network behaviour. Shaping occurs on egress. SCHEDULING By scheduling the transmission of packets it is possible to improve interactivity for traffic that needs it while still guaranteeing bandwidth to bulk transfers. Reordering is also called prioritizing, and happens only on egress. POLICING Where shaping deals with transmission of traffic, policing pertains to traffic arriving. Policing thus occurs on ingress. DROPPING Traffic exceeding a set bandwidth may also be dropped forthwith, both on ingress and on egress.
Overview of Traffic Control Concepts — Traffic control is the name given to the sets of queuing systems and mechanisms by which packets are received and transmitted on a router. This includes deciding which (and whether) packets to accept at what rate on the input of an interface and determining which packets to transmit in what order at what rate on the output of an interface.
Advanced traffic control - ArchWiki
Journey to the Center of the Linux Kernel: Traffic Control, Shaping and QoS — This document describes the Traffic Control subsystem of the Linux Kernel in depth, algorithm by algorithm, and shows how it can be used to manage the outgoing traffic of a Linux system.
Netdata Real-time performance monitoring, done right! — Netdata is distributed, real-time, performance and health monitoring for systems and applications. It is a highly optimized monitoring agent you install on all your systems and containers.
Add more charts to netdata — To collect non-system metrics, netdata supports a plugin architecture.

395: The ACME Era

Jupiter Broadcasting — Sun, 20 Jan 2019 20:45:00 -0800

We welcome Jim to the show, and he and Wes dive deep into all things Let’s Encrypt.

The history, the clients, and the from-the-field details you'll want to know.

Links:

Let’s Encrypt and CertBot – JRS Systems
Automatic Certificate Management Environment (ACME) — The surprisingly readable IETF draft.
How It Works - Let's Encrypt
ACME Client Implementations
Certbot — Certbot is EFF's tool to obtain certs from Let's Encrypt.
acme-nginx: python acme client for nginx — A particularly simple client that is useful for understanding the protocol details.
Caddy - The HTTP/2 Web Server with Automatic HTTPS
mod_md: Let's Encrypt (ACME) support for Apache httpd
Traefik - The Cloud Native Edge Router
Looking Forward to 2019 - Let's Encrypt — We’re now serving more than 150 million websites while maintaining a stellar security and compliance track record. Most importantly though, the Web went from 67% encrypted page loads to 77% in 2018, according to statistics from Mozilla. This is an incredible rate of change!
Let's Encrypt ACME v2 API Announcements — Now that the draft standard is in last-call and the pace of major changes has slowed, we’re able to release a “v2” API that is much closer to what will become the final ACME RFC.
Let's Encrypt disables TLS-SNI-01 validation — The researcher noticed that "at least two" large hosting providers host many users on the same IP address and users are able to upload certificates for arbitrary names without proving they have control of a domain.
A Technical Deep Dive on Using Certbot to Secure your Mailserver from the EFF — With the most recent release of Certbot v0.29.1, we’ve added some features which make it much easier to use with both Sendmail and Exim.

394: All About Azure

Jupiter Broadcasting — Thu, 10 Jan 2019 04:00:00 -0800

Wes is joined by a special guest to take a look back on the growth and development of Azure in 2018 and discuss some of its unique strengths.

Special Guest: Chad M. Crowell.

Links:

Under the sea, Microsoft tests a datacenter that’s quick to deploy, could provide internet connectivity for years
An Azure Infrastructure Year in Review
Azure File Sync now generally available
Microsoft's Newest OS is Based on Linux
Azure Sphere
What is Azure Stack?
Azure Outage Proves the Hard Way Availability Zones are a Good Idea
Microsoft Azure Infrastructure and Deployment on Linux Academy — In this course, we will cover an introduction to the Azure portal, followed by how to build infrastructure and deploy that infrastructure in real world scenarios.
Chad Crowell on Twitter

393: Back to our /roots

Jupiter Broadcasting — Thu, 03 Jan 2019 04:00:00 -0800

In a special new year’s episode we take a moment to reflect on the show’s past, its future, and say goodbye to an old friend.

Links:

Jim Salter — Jim Salter (@jrssnet) is an author, public speaker, small business owner, mercenary sysadmin, and father of three—not necessarily in that order. He got his first real taste of open source by running Apache on his very own dedicated FreeBSD 3.1 server back in 1999, and he's been a fierce advocate of FOSS ever since.
Jim Salter on Twitter
Dropbox Flaws | TechSNAP | 1
PSN Breech Details | TechSNAP 3
2089 Days Uptime | TechSNAP 300

392: Keeping up with Kubernetes

Jupiter Broadcasting — Wed, 12 Dec 2018 19:00:00 -0800

A security vulnerability in Kubernetes causes a big stir, but we’ll break it all down and explain what went wrong.

Plus the biggest stories out of Kubecon, and serverless gets serious.

Links:

Everything that was announced at KubeCon
CNCF to Host etcd — The Cloud Native Computing Foundation Technical Oversight Committee voted to accept etcd as an incubation-level hosted project.
Introduction to Knative — Knative is a framework from the folks at Google and Pivotal focused on “serverless” style event driven functions.
IBM Embraces Knative to Drive Serverless Standardization — Knative is not the first open-source functions-as-a-service effort that IBM has backed. Back in 2016, IBM announced the OpenWhisk effort, which is now run as an open-source project at the Apache Software Found.
How Google Is Improving Kubernetes Container Security — "We go beyond what's in open source and put additional restrictions in place to secure users"
Demystifying Kubernetes CVE-2018-1002105 — With a specially crafted request, users that are authorized to establish a connection through the Kubernetes API server to a backend server can then send arbitrary requests over the same connection directly to that backend, authenticated with the Kubernetes API server’s TLS credentials used to establish the backend connection.
The silent CVE in the heart of Kubernetes apiserver
Crossplane: An Open Source Multicloud Control Plane
security.christmas — This year we will prepare you for the Christmas celebration, by giving you small presents of knowledge every day, which will teach you about the world of security.
Introducing the Helm Hub — This hub provides a means for you to find charts hosted in many distributed repositories hosted by numerous people and organizations.

Episode 391: Firecracker Fundamentals

Jupiter Broadcasting — Thu, 29 Nov 2018 14:00:00 -0800

We break down Firecracker Amazon’s new open source kvm powered, virtual machine monitor, and explore what makes it different from the options on the market now.

Plus some good news for OpenBGP and the wider internet community, and a handy tool for inspecting docker images.

Links:

Firecracker – Lightweight Virtualization for Serverless Computing — Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant containers and functions-based services.
Firecracker — Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant containers and functions-based services.
Firecracker Design Docs
Firecracker Roadmap
QEMU — QEMU is a generic and open source machine emulator and virtualizer.
Qemu : Security vulnerabilities
VENOM Vulnerability — VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host.
s2n — s2n is a C99 implementation of the TLS/SSL protocols that is designed to be simple, small, fast, and with security as a priority.
OpenBGPD - Adding Diversity to the Route Server Landscape — Thanks to the RIPE NCC Community Project Fund we were able to revive the OpenBGPD daemon and bring more diversity to the Route Server landscape.
OpenBGPD — OpenBGPD is a FREE implementation of the Border Gateway Protocol, Version 4. It allows ordinary machines to be used as routers exchanging routes with other systems speaking the BGP protocol.
LSI Questions from Anton
ServeTheHome
Sennheiser Headset Software Could Allow Man-in-the-Middle SSL Attacks — When users have been installing Sennheiser's HeadSetup software, little did they know that the software was also installing a root certificate into the Trusted Root CA Certificate store. To make matters worse, the software was also installing an encrypted version of the certificate's private key that was not as secure as the developers may have thought.
evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
dive: A tool for exploring each layer in a docker image

Episode 390: What’s Up with WireGuard

Jupiter Broadcasting — Thu, 22 Nov 2018 10:30:00 -0800

WireGuard has a lot of buzz around it and for many good reasons. We’ll explain what WireGuard is specifically, what it can do, and maybe more importantly, what it can’t.

Special Guest: Jim Salter.

Links:

How to easily configure WireGuard — At its core, all WireGuard does is create an interface from one computer to another.
Jessie Frazelle's Blog: Installing and Using Wireguard, obviously with containers — What is cool about Wireguard is it integrates into the Linux networking stack.
WireGuard Didn't Make it To The Mainline Linux Kernel This Cycle — The code continues to be improved upon but looks like it came up just short of making it into this current development cycle.
WireGuard VPN review: A new type of VPN offers serious advantages — Fewer lines of code, simpler setup, and better algorithms make a strong case.
The Current Status of WireGuard VPNs - Are We There Yet?
Using a free VPN? Why not skip the middleman and just send your data to President Xi?
Feedback from Cody
NRE Labs — NRE Labs is a no-strings-attached, community-centered initiative to bring the skills of automation within reach for everyone
Introduction to Antidote — Antidote is an open-source project aimed at making automated network operations more accessible with fast, easy and fun learning.
StackStorm — From simple if/then rules to complicated workflows, StackStorm lets you automate DevOps your way.
wireguard-private-networking: Build your own multi server private network using wireguard and ansible
Algo: Set up a personal IPSEC or WireGuard VPN in the cloud

Episode 389: The Future of HTTP

Jupiter Broadcasting — Thu, 15 Nov 2018 15:00:00 -0800

Wes is joined by special guest Jim Salter to discuss Google's recent BGP outage and the future of HTTP.

Plus the latest router botnet, why you should never go full UPnP, and the benefits of building your own home router.

Special Guest: Jim Salter.

Links:

Google goes down after major BGP mishap routes traffic through China — Google lost control of several million of its IP addresses for more than an hour on Monday in an event that intermittently made its search and other services unavailable to many users.
Internet Vulnerability Takes Down Google
China has been 'hijacking the vital internet backbone of western countries'
RPKI - The required cryptographic upgrade to BGP routing
HTTP/3 — The protocol that's been called HTTP-over-QUIC for quite some time has now changed name and will officially become HTTP/3.
HTTP/3: Come for the speed, stay for the security
The Road to QUIC
Botnet pwns 100,000 routers using ancient security flaw — Researchers have stumbled on another large botnet that’s been quietly hijacking home routers while nobody was paying attention
BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers
From Zero to ZeroDay Journey: Router Hacking
The Ars guide to building a Linux router from scratch

Episode 388: The One About eBPF

Jupiter Broadcasting — Thu, 25 Oct 2018 15:00:00 -0700

We explain what eBPF is, how it works, and its proud BSD production legacy.

eBPF is a technology that you’re going to be hearing more and more about. It powers low-overhead custom analysis tools, handles network security in a containerized world, and powers tools you use every day.

Links:

Chris Goes to MeetBSD
Linus Torvalds talks about coming back to work on Linux | ZDNet — BPF has actually been really useful, and the real power of it is how it allows people to do specialized code that isn't enabled until asked for.
The Kernel Report - Jonathan Corbet
BPF - the forgotten bytecode — All this changed in 1993 when Steven McCanne and Van Jacobson published the paper introducing a better way of filtering packets in the kernel, they called it "The BSD Packet Filter" (BPF)
The BSD Packet Filter
eBPF: Past, Present, and Future — The Extended Berkeley Packet Filter, or eBPF, has rapidly been adopted into a number of Linux kernel systems since its introduction into the Linux kernel in late 2014. Understanding eBPF, however, can be difficult as many try to explain it via a use of eBPF as opposed to its design. Indeed eBPF's name indicates that it is for packet filtering even though it now has uses which have nothing to do with networking.
Using eBPF in Kubernetes — Cilium is a networking project that makes heavy use of eBPF superpowers to route and filter network traffic for container-based systems. By using eBPF, Cilium can dynamically generate and apply rules—even at the device level with XDP—without making changes to the Linux kernel itself
Why is the kernel community replacing iptables with BPF? — The Linux kernel community recently announced bpfilter, which will replace the long-standing in-kernel implementation of iptables with high-performance network filtering powered by Linux BPF, all while guaranteeing a non-disruptive transition for Linux users.
bpftrace (DTrace 2.0) for Linux 2018 — Created by Alastair Robertson, bpftrace is an open source high-level tracing front-end that lets you analyze systems in custom ways. It's shaping up to be a DTrace version 2.0: more capable, and built from the ground up for the modern era of the eBPF virtual machine.
The bpftrace One-Liner Tutorial
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more — BCC is a toolkit for creating efficient kernel tracing and manipulation programs, and includes several useful tools and examples.
Linux eBPF Tracing Tools — This page shows examples of performance analysis tools using enhancements to BPF (Berkeley Packet Filter) which were added to the Linux 4.x series kernels, allowing BPF to do much more than just filtering packets. These enhancements allow custom analysis programs to be executed on Linux dynamic tracing, static tracing, and profiling events.
eBPF Vulnerability (CVE-2017-16995): When the Doorman Becomes the Backdoor
Ultimate Plumber — Ultimate Plumber is a tool for writing Linux pipes with instant live preview
BSD Now 073: Pipe Dreams — Interview w/ David Maxwell about Pipecut, text processing, and commandline wizardry.