code, musings and more
Hi everybody! What a day! Remco van Mook and I received a message today that our RFC Draft (full text here ) has entered the AUTH48 stage. This means that it has been assigned a number (RFC 5452!), and that barring meteor strikes or similar things, we are now finally done. Yay! We spent 2 years and 9 months on this. It felt like even more. I ve been told the draft has already made a difference in…
This post is about an obscure corner of TCP network programming, a corner where almost everybody doesn t quite get what is going on. I used to think I understood it, but found out last week that I didn t. So I decided to trawl the web and consult the experts, promising them to write up their wisdom once and for all, in hopes that this subject can be put to rest. The experts (H. Willstrand, Evgeniy…
Ok, I like to think a lot, and I think I know a lot. Sometimes, this leads me to conclusions. Conclusions are only interesting if they are unexpected, but afterwards , nothing is ever unexpected. So, to turn a conclusion into an interesting conclusion, it has to become.. a prediction. I read an interesting book some time ago, What we believe, but cannot prove , read my predictions below in the…
Idea - estimates for time to completion range from 3 days to 3 weeks Pretty convincing first stab look how cool this would be The Hard Slog to get something that actually works. Estimates now range from 3 months to 3 years. First real users pop up, discovery is made that all assumptions were off Starts to look good to the first real user Elation! Someone actually uses the code it for real, the…
After too much posting on IETF mailing lists, and not achieving anything, I ve gone back to coding a bit more. There are two things I want to share - the first because I had a devil of a time figuring out how to do something, and I hope that posting here will help fellow-sufferers find the solution via Google. The second thing I want to talk about because, and this is getting to be rare, I…
This post sets out to calculate how hard it is to spoof a resolver that takes simple, unilateral, steps to prevent such spoofing. Unilateral in this case means that any resolver can implement these steps, without changing the DNS protocol or authoritative server behaviour. Everybody that implements the ideas below immediately improves the general security of the DNS. To save you all the reading,…
Yesterday it was announced that there is an unspecified but major DNS vulnerability, and that Microsoft, Nominum and ISC had fixes available. It is amusing to note that this has been hailed as a major feat of cooperation , with the vulnerable parties spinned as being part of secret industry cabal that has just saved the world from very bad things. To say the least, I find this a funny way of…
18th of May, Delft, The Netherlands Mirjam & Bert are proud to announce the birth of their son Maurits Hubert! Mother, son & father are doing very well. Feel free to email the little guy on maurits@hubertnet.nl! Picture when Maurits was only an hour old: And a slightly geeky Droste Effect photo:
Exactly one year ago today , my father passed away, less than a year after my mother did. Here you can see them in happier times, together with the other subject of this post: While we mourn their passing today, not all news is bad. I m happy to announce Mirjam and I are expecting a baby! We re very happy, but sad we won t be able to share the good news with my parents. But: life goes on - which…
While running the risk of turning this blog into a lecture series, I can t resist. This post will dive into cryptography, and I hope to be able to transfer the sense of wonder that caught me when I first read about Diffie-Hellman key exchange many years ago. Let s assume you are in a room with two other people, and that you want to share a secret with one of them, but not with the other. In the…