Ben Cox (benjojo)

Quoting for endorsement. Ben, of https://blog.benjojo.co.uk [1] and https://age-encryption.org/design fame, built something genuinely useful out of sheer technical depth, use case understanding, and experience. I don't really work with networks but the changelog is indeed a great read because 1) I learn stuff, and 2) it's great to see a useful focused product just get better. [1] https://hn.algolia.com/?query=benjojo.co.uk

https://blog.benjojo.co.uk/ would be one of my favorites in this vein.

We use them in AWS as IPv6 hasn't been feasible, though its become better in the last 1-2 years. AWS uses it internally, likely other big providers probably also do. If you can get away with IPv6 only, ie not constrained by provider/device, its likely worth going that direction instead. Works fine in Linux, doesn't really work on Windows and some BSDs. https://blog.benjojo.co.uk/post/class-e-addresses-in-the-real-world

EDIT: Paste this hacky snippet into your browser's console to save all of the links into your clipboard: (() => { let result = [...document.querySelectorAll('td a')] .map((link) => link && !link.href.includes('ycombinator') && !link.href.includes('javascript:void') ? link.href : '' ) .filter(Boolean); result = [...new Set(result)]; result.sort(); copy(result.join('\n\n')); })(); Just to help, here's a compiled-list of all of the links shared here so…

"Ultrasonic watermark" reminds me of this[1] great blogpost. It's not the same thing but based on the same concept. [1] https://blog.benjojo.co.uk/post/encoding-data-into-dubstep-drops

blame my friend Ben, I just cloned his blog and Cynthiaified it :P https://blog.benjojo.co.uk/

Love it. But I like the skrillex steganography even more! https://blog.benjojo.co.uk/post/encoding-data-into-dubstep-drops

Great point. That's already happened, and a lot of weak keys were found [0]. [0] https://blog.benjojo.co.uk/post/auditing-github-users-keys

Excellent help. To clarify a few items: - yes I mean drives with autoloader. for example: https://www.backupworks.com/qualstar-Q24-LTO-9-SAS-Library.aspx it’s basically a hard requirement as we don’t have staff time to enter data centers frequently. we are a bit unusual in being certainly not big, but not really a small business either when looking at budgets available. unless there is something wrong with qualstar product linked above perhaps autoloaders are cheaper than you believed? - understood your rebooting trick. however being full automated (apart from blank tape rotations) is a requirement also. it’s a production infrastructure. if FreeBSD provides significant value it seems safer to spec a dedicated 1U server to use for backups. there is a management node currently that might work though that has to run Linux as it currently does and I need to check if the SAS on it can be used. It has an bunch of SAS ssd drives currently and I would have assumed there is a way to cable up the qualstar drive … but again I’m still early in researching. and the SAS compatibility issue you raise is perfect example of stuff I need to figure out. - love par2cmdline and our burner with mdisc for IP backup uses that on git repo files and then seqbox as an outer container for data to guard against potential fs metadata corruption issues. there was a newer low level tool (rust rewrite I think) with many bitrot protection features that I can’t recall it’s name currently and isn’t…

I think this is fantastic. I can see your investment pitch being "the HackerRank/LeetCode of devops". I've only tried one scenario (DNS) so far but it seems well done, not too long, not too easy, not too hard. I am excited to try it out further. First I'll address your questions and then add some comments of my own. 1. I do a lot of technical interviewing. Many people can _sound_ like they know what they're talking about, but it can be a struggle to get to the nitty gritty to really test their understanding. This product seems to have an angle of "take-home tests as a service", which is cool. Over time I can see how you could come to have a large library of scenarios and use of them would be very helpful in filtering candidates for real, demonstrable competence. 2. I like it. I once tried a DIY approach involving having candidates talk to a Kafka server I provided, with client certificates. It was cumbersome. There was a 100% overlap of candidates who succeeded and candidates who could be bothered to take the test at all. From this I gathered that the mere existence of the test was a strong filter, but it's also fair to say that judging test difficulty level well is extremely hard. (In other words: "oh no, he wants me to actually understand how to use client certs? Bye.") 3. Pre-interview. Async hiring process with just-in-time candidate attention means the team does not lose too much productivity (as much as hiring is a valuable use of time, developer time in a small…

Also we could probably achieve this by using dnsfs and regular doom install https://blog.benjojo.co.uk/post/dns-filesystem-true-cloud-storage-dnsf…

Short answer: no Tape is really complicated and physically challenging, and there are no incentives for people investing insane amounts of time for something that has almost no fan base. See the blog post about why you don’t want tape from some time ago. Edit: https://blog.benjojo.co.uk/post/lto-tape-backups-for-linux-nerds

Have you ever been in a hackspace? That's where you'll usually find such discussions IRL. Other examples include "let's build a submarine" https://media.ccc.de/v/37c3-11828-how_to_build_a_submarine_and_survive… creating your own 2000s style phone ringtone/wallpaper subscription service https://blamba.de/ or running toslink audio over regular long-distance fiber links https://blog.benjojo.co.uk/post/sfp-experiment-ultra-long-range-toslin…

They're part of AS749, which is US Department of Defense IP space that appears to be unused and which, based on public statements made by the Pentagon, might just be safely parked or might be part of a network scanning observatory [1]. Either way, scanning that space is probably a waste of bandwidth. [1] https://blog.benjojo.co.uk/post/ip-address-squatting

The TLS verifier workaround that you've constructed is reasonably sound (based on how TLS validation works in browsers), but the boring answer to workaround certificate problems is to do what Firefox actually does: skip AIA and only rely on known intermediates. You can import Mozilla's intermediate list as roots (https://wiki.mozilla.org/CA/Intermediate_Certificates, requires additional processing to convert to usable certs) to emulate this. Chrome on the other hand... just read this article (https://blog.benjojo.co.uk/post/browsers-biggest-tls-mistake), it's very hard to emulate and is really, really bonkers.

(author of the post) Yes, this is exactly what I did in the post I linked to: https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handli…

https://blog.benjojo.co.uk/post/sn2010-linux-hacking-switchdev if you hadn't seen it already and the associated HN comments: https://news.ycombinator.com/item?id=40141967

Do current routers deal with other addresses correctly? This reminds me a little of the challenges in reclaiming 240.0.0.0/4 [0]. [0] - https://blog.benjojo.co.uk/post/class-e-addresses-in-the-real-world

benjojo has an article on this, with another (Golang) implementation: https://blog.benjojo.co.uk/post/ssh-randomart-how-does-it-work-art Includes example results, as well as an explanation for the randomart algorithm.

> I couldn't resist The common refrain of a teenager... https://www.npr.org/2016/04/15/474348291/why-teens-are-impulsive-addic… honestly at that age I never went out of my room, and I still got in trouble. If you do develop some self-control, you could look at https://blog.benjojo.co.uk/post/dive-into-the-world-of-dos-viruses or https://www.sciencedirect.com/science/article/abs/pii/B978012801507000… (c.f. also https://hackmd.io/@_01X9rimQmWH33Djf8QhoA/SkygF9WdP which is based on that book)

Two things spring to mind: a whole computer inside an SFP module[1] and the O.MG cable[2] [1]: https://blog.benjojo.co.uk/post/smart-sfp-linux-inside [2]: https://shop.hak5.org/products/omg-cable

I've wondered the same. Ben Cox's blog[0] shows there is some bias for the random art generation. [0]: <https://blog.benjojo.co.uk/post/ssh-randomart-how-does-it-work-art>

I want to make it updateable, so we can see how the DNS records change over time. Also, I want to map various scans, similar to https://blog.benjojo.co.uk/post/scan-ping-the-internet-hilbert-curve

At NANOG 62, there was a presentation "A practical guide to (correctly) troubleshooting with traceroute", by Richard Steenbergen (slides [pdf]: https://archive.nanog.org/sites/default/files/tuesday_steenbergen_trou… talk [video]: https://www.youtube.com/watch?v=WL0ZTcfSvB4). It also mentions that isolated hops that show increased latency or loss are most likely throttling on the device. However, if that latency or loss persists on further hops, that indicates a problem. Another issue with traceroutes is that is usually doesn't account for asymmetry in the return path. What I would find interesting to see is something like isoping/splitping (see this blog post https://blog.benjojo.co.uk/post/ping-with-loss-latency-split), to account for that asymmetry. Regarding the tool trippy itself: awesome visualizations!

Somewhat related article: https://blog.benjojo.co.uk/post/dns-filesystem-true-cloud-storage-dnsf… (DNSFS. Store your files in others DNS resolver caches - 2018)

Seems to be pretty doable ("collisions" in the last section): https://blog.benjojo.co.uk/post/ssh-randomart-how-does-it-work-art

Dies (see: https://blog.benjojo.co.uk/post/the-death-of-a-tld). Something that anyone should consider before getting a domain on a hippy GTLD. Alongside with how "bad" reputation it has that is usually correlated with low price offers.

Another implementation https://blog.benjojo.co.uk/post/traceroute-haikus and I've seen many more.

If you want to be properly anonymous, don't use public key authentication (ssh -o 'PubkeyAuthentication no' [email protected]). Otherwise, anyone in the chat can /whois you and get your public key hash - and they could pretty easily deanonymize you if you use that same key on GitHub (https://blog.benjojo.co.uk/post/auditing-github-users-keys) or potentially other services.

https://blog.benjojo.co.uk/post/smart-sfp-linux-inside Tl;dr - they baked a computer inside of network connector cuz it’s already huge. To do… stuff. Kinda like bmc