[Newsclips] IETF SYN-ACK Newspack 2022-05-16

[David Goldstein <[e-mail]>]

The IETF SYN-ACK Newspack collects IETF-related items from a variety of news outlets and other online publications. They do not represent the views of the IETF and are not checked for factual accuracy.

 

 

**********************

IETF IN THE NEWS

**********************

John Gilmore on ARP, RARP, BOOTP, DHCP, and Sun

John Gilmore should be familiar to most of us involved in networking; he is one of the principals behind a series of current IETF drafts on releasing the historically reserved 240.0.0.0/4, 0.0.0.0/8 and the upper parts of 127.0.0.0/8 as globally routable addresses.

< <https://blog.apnic.net/2022/05/12/john-gilmore-on-arp-rarp-bootp-dhcp-and-sun/> https://blog.apnic.net/2022/05/12/john-gilmore-on-arp-rarp-bootp-dhcp-and-sun/>

 

Ukraine war a sorting hat for cyber-governance loyalties: Black Hat founder Jeff Moss

... His preferred model is for civil society institutions – the likes of ICANN or the IETF – to drive discussion on how tech policy can meet the moment.

< <https://www.theregister.com/2022/05/12/jeff_moss_ukraine_cyber_governance/> https://www.theregister.com/2022/05/12/jeff_moss_ukraine_cyber_governance/>

 

Bitcoin Changes With User-Signaled Soft Forks

... Finally, Provoost lays out the “rough consensus” guidelines as used in context of the IETF, and how this applies to Bitcoin upgrades.

< <https://bitcoinmagazine.com/technical/bitcoin-changes-with-user-signaled-soft-forks> https://bitcoinmagazine.com/technical/bitcoin-changes-with-user-signaled-soft-forks>

< <https://cryptonewsbtc.org/2022/05/10/bitcoin-changes-with-user-signaled-soft-forks/> https://cryptonewsbtc.org/2022/05/10/bitcoin-changes-with-user-signaled-soft-forks/>

 

Wer schickt mir diese Mail? Auf den wahren Absender achten [Who is sending me this email? Pay attention to the real sender]

... Da die Mengen an Spam und Phishing-Mails ständig anstiegen, entwickelte die IETF (eine Arbeitsgruppe, die sich mit technischen Standards für das Internet befasst) in den vergangenen Jahren eine Reihe von Techniken für die Authentifizierung von Mailadressen.

< <https://www.pcwelt.de/ratgeber/Wer-schickt-mir-diese-Mail-Auf-den-wahren-Absender-achten-11227726.html> https://www.pcwelt.de/ratgeber/Wer-schickt-mir-diese-Mail-Auf-den-wahren-Absender-achten-11227726.html>

 

IPV6 InterRegional Summit : Huawei présente sa technologie innovante d’IPV6 amélioré [IPV6 InterRegional Summit: Huawei Showcases Innovative Improved IPV6 Technology]

Digne successeur de l’iPV4, l’IPv6 constitue l’un des processus standardisés de transfert de paquets de données les plus efficients sur les réseaux informatiques. En effet, l’IPv6 apporte plusieurs avantages, à l’instar d’un routage plus efficace et hiérarchisé et permet aux fournisseurs de services Internet d’agréger les préfixes des réseaux de leurs clients en un seul préfixe

< <https://www.realites.com.tn/2022/05/ipv6-interregional-summit-huawei-presente-sa-technologie-innovante-dipv6-ameliore/> https://www.realites.com.tn/2022/05/ipv6-interregional-summit-huawei-presente-sa-technologie-innovante-dipv6-ameliore/>

 

Overheid positief over security.txt en kijkt naar bekendheidscampagne [Government positive about security.txt and looks at awareness campaign]

Het Digital Trust Center (DTC) van het ministerie van Economische Zaken is positief over de potentie van security.txt als standaard en kijkt of het onder het Nederlandse bedrijfsleven bekend moet worden gemaakt. Security.txt is een bestand waarmee organisaties en websites hun beleid voor het omgaan met beveiligingslekken kunnen vermelden. Onlangs besloot de IETF van security.txt een RFC (Request for Comments) te maken.

< <https://www.security.nl/posting/752790/> https://www.security.nl/posting/752790/>

 

IPv4 ed IPv6 – Differenze e funzionamento [IPv4 and IPv6 – Differences and How It Works]

... IPv6 è stato sviluppato dall’IETF per affrontare il problema a lungo atteso dell’esaurimento degli indirizzi IPv4 ed è destinato a sostituire IPv4. Nel dicembre 1998, IPv6 è diventato un progetto di standard per l’IETF, che successivamente lo ha ratificato come standard Internet il 14 luglio 2017.

< <https://www.evemilano.com/ipv4-vs-ipv6/> https://www.evemilano.com/ipv4-vs-ipv6/>

 

OTP, cos'è e come funziona il codice usato per l'autenticazione a due fattori [OTP, what it is and how the code used for two-factor authentication works]

... Tutta la procedura è descritta in questo documento redatto dall'IETF.

< <https://www.ilsoftware.it/articoli.asp?tag=OTP-cos-e-e-come-funziona-il-codice-usato-per-l-autenticazione-a-due-fattori_24502> https://www.ilsoftware.it/articoli.asp?tag=OTP-cos-e-e-come-funziona-il-codice-usato-per-l-autenticazione-a-due-fattori_24502>

 

Crypto ID entrevista: William Bergamo – Padrões técnicos dos protocolos SSL/TLS [Crypto ID interview: William Bergamo - Technical standards of SSL/TLS protocols]

... Existem globalmente várias comunidades trabalhando em atualizações como por exemplo a Comunidade IETF, que gerencia as RFCs – Request for Comments, a CAB Forum e instituições como o NIST – National Institute of Standards and Technology, que é uma referência mundial e influencia as outras comunidades

< <https://cryptoid.com.br/ssl-tls/crypto-id-entrevista-william-bergamo-padroes-tecnicos-dos-protocolos-ssl-tls/> https://cryptoid.com.br/ssl-tls/crypto-id-entrevista-william-bergamo-padroes-tecnicos-dos-protocolos-ssl-tls/>

 

Ukrayna’da siber yönetişim ve savaş üzerine Black Hat kurucuları • The Register [Black Hat founders on cyber governance and war in Ukraine • The Register]

... Tercih ettiği model, ICANN veya IETF gibi sivil toplum kurumlarının teknoloji politikasının bugüne kadar nasıl yaşayabileceği konusundaki tartışmaları yönlendirmesidir.

< <https://zamanbelcika.be/teknoloji/ukraynada-siber-yonetisim-ve-savas-uzerine-black-hat-kuruculari-the-register/49011/> https://zamanbelcika.be/teknoloji/ukraynada-siber-yonetisim-ve-savas-uzerine-black-hat-kuruculari-the-register/49011/>

 

[스투/리포트] “공급망 종속·운용성 부족이 스마트시티 발목 잡는다” [[Stu / Report] "Supply chain dependency and lack of operability are catching up with smart cities"]

... ISO(국제표준화기구), IEC(국제전기표준회의), ETSI(유럽전기통신표준화기구) 및 ITU-T(국제전기통신연합) 등 여러 표준화 국제기구 및 조직을 포함, 전 세계적으로 표준화에 관여하는 많은 기관과 컨소시엄이 있다. 또한 IEEE(국제전기전자공학자협회), IETF(국제인터넷포준화기구) 및 TM 포럼(통신사 및 장비회사 중심의 통신산업 협의체)과 같은 비영리 단체, 컨소시엄 및 동맹도 있다.

< <https://www.smartcitytoday.co.kr/news/articleView.html?idxno=23276> https://www.smartcitytoday.co.kr/news/articleView.html?idxno=23276>

 

Биткойн меняется с сигнализированными пользователями софт-форками [Bitcoin Changes with User Signaled Soft Forks]

... Наконец, Провост излагает принципы «приблизительного консенсуса», используемые в контексте Инженерной группы Интернета (IETF), и то, как это применимо к обновлениям Биткойн.

< <https://itbusiness.com.ua/crypto/118992-bitkojn-menyaetsya-s-signalizirovannymi-polzovatelyami-soft-forkami.html> https://itbusiness.com.ua/crypto/118992-bitkojn-menyaetsya-s-signalizirovannymi-polzovatelyami-soft-forkami.html>

 

ไปรษณีย์ไทย เปิดบริการใหม่ e-Timestamp ตราประทับรับรองความปลอดภัยบนเอกสารดิจิทัล [Thailand Post Launch a new e-Timestamp security stamp on digital documents]

... นอกจากนี้ บริการ e-Timestamp ยังได้รับมาตรฐาน IETF RFC 3161 Time-Stamp Protocol (TSP) และได้รับการยอมรับระดับโลก สามารถให้บริการประทับเวลาได้พร้อมกันไม่น้อยกว่า 100 Transaction/วินาที หากมีการเปลี่ยนแปลงตัวเลข ราคา หรือ ข้อมูลสำคัญในเอกสาร ระบบสามารถทำการตรวจสอบได้และยังเรียกดูข้อมูลได้ตลอดเวลา รวมทั้งสามารถติดต่อศูนย์ให้บริการได้ทุกวันไม่มีวันหยุด

< <https://mgronline.com/greeninnovation/detail/9650000043268> https://mgronline.com/greeninnovation/detail/9650000043268>

 

**********************

SECURITY & PRIVACY

**********************

eu: Commission welcomes political agreement on new rules on cybersecurity of network and information systems

The Commission welcomes the political agreement reached today between the European Parliament and EU Member States on the Directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive) proposed by the Commission in December 2020.

< <https://digital-strategy.ec.europa.eu/en/news/commission-welcomes-political-agreement-new-rules-cybersecurity-network-and-information-systems> https://digital-strategy.ec.europa.eu/en/news/commission-welcomes-political-agreement-new-rules-cybersecurity-network-and-information-systems>

 

EU governments, lawmakers agree on tougher cybersecurity rules for key sectors

EU countries and lawmakers agreed on Friday to tougher cybersecurity rules for large energy, transport and financial firms, digital providers and medical device makers amid concerns about cyber attacks by state actors and other malicious players.

< <https://www.reuters.com/technology/eu-governments-lawmakers-agree-tougher-cybersecurity-rules-key-sectors-2022-05-13/> https://www.reuters.com/technology/eu-governments-lawmakers-agree-tougher-cybersecurity-rules-key-sectors-2022-05-13/>

 

Improving cybersecurity means understanding how cyberattacks affect governments and civilians

For nearly two years, 68 United Nations member states — along with private enterprises, non-governmental organizations, technical communities and academics — participated in an open-ended working group on developments in information and telecommunications in international security (Cyber OEWG). The working group deliberated on responsible state behaviour in cyberspace.

< <https://www.itu.int/hub/2022/05/improving-cybersecurity-understanding-cyberattacks-unu/> https://www.itu.int/hub/2022/05/improving-cybersecurity-understanding-cyberattacks-unu/>

 

Threathunt 2030: How to Hunt Down Emerging & Future Cyber Threats

Understanding emerging cybersecurity threats and future scenarios was the objective of “Threathunt 2030”, a new flagship conference organised by the European Union Agency for Cybersecurity on Friday, 6th of May.

< <https://www.enisa.europa.eu/news/enisa-news/threathunt-2030-how-to-hunt-down-emerging-future-cyber-threats> https://www.enisa.europa.eu/news/enisa-news/threathunt-2030-how-to-hunt-down-emerging-future-cyber-threats>

 

TEAM EUROPE on the Starting Blocks for the 1st International Cybersecurity Challenge!

The European Union Agency for Cybersecurity (ENISA) is proud to announce a Team Europe ready to compete in the International Cyber Challenge (ICC) taking place in Greece next month!

< <https://www.enisa.europa.eu/news/team-europe-on-the-starting-blocks-for-the-1st-international-cybersecurity-challenge> https://www.enisa.europa.eu/news/team-europe-on-the-starting-blocks-for-the-1st-international-cybersecurity-challenge>

 

You Can’t Eliminate Cyberattacks, So Focus on Reducing the Blast Radius

Tony Lauro, director of security technology and strategy at Akamai, discusses reducing your company’s attack surface and the “blast radius” of a potential attack.

< <https://threatpost.com/cyberattacks-blast-radius/179612/> https://threatpost.com/cyberattacks-blast-radius/179612/>

 

CISA, NSA, FBI and International Cyber Authorities Issue Cybersecurity Advisory to Protect Managed Service Providers (MSP) and Customers

The Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the United Kingdom’s National Cyber Security Centre (NCSC-UK), Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), New Zealand National Cyber Security Centre (NZ NCSC), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) released an advisory today with cybersecurity best practices for information and communications technology (ICT), focusing on enabling transparent discussions between managed service providers (MSPs) and their customers on securing sensitive data. CISA, NCSC-UK, ACSC, CCCS, NZ-NCSC, NSA, and FBI expect state-sponsored advanced persistent threat (APT) groups and other malicious cyber actors to increase their targeting of MSPs against both provider and customer networks.

< <https://www.cisa.gov/news/2022/05/11/joint-cybersecurity-advisory-protect-msp-providers-and-customers> https://www.cisa.gov/news/2022/05/11/joint-cybersecurity-advisory-protect-msp-providers-and-customers>

 

Open DNS resolvers, from bad to worse

Hosting open DNS resolvers has long been considered bad practice because it exposes infrastructure to abuse and can lead to service deterioration including in the operating network. I’m not talking about public DNS services that are (in general) carefully operated and taken care of, but devices that typically, due to misconfigurations, are exposed as an open DNS resolver and can potentially be misused in DDoS attacks.

< <https://blog.apnic.net/2022/05/13/open-dns-resolvers-from-bad-to-worse/> https://blog.apnic.net/2022/05/13/open-dns-resolvers-from-bad-to-worse/>

 

**********************

INTERNET OF THINGS

**********************

au: Govt to make its voluntary IoT cybersecurity standards mandatory

Existing cybersecurity standards for smart devices will be made mandatory by the federal government but device security labels will be voluntary under a Coalition election pledge.

< <https://www.innovationaus.com/govt-to-make-its-voluntary-iot-cybersecurity-standards-mandatory/> https://www.innovationaus.com/govt-to-make-its-voluntary-iot-cybersecurity-standards-mandatory/>

 

**********************

NEW TRANSPORT PROTOCOLS

**********************

Wave: a Case Study for Low Architectural Complexity

... Application data is transported over HTTP/3. Its underlying QUIC protocol is a better match for operational constraints on the field, such as mobile data service unreliability and low bandwidth. Wave now only maintains a custom transport protocol on top of USSD for emergencies.

< <https://www.infoq.com/news/2022/05/wave-low-architecture-complexity/> https://www.infoq.com/news/2022/05/wave-low-architecture-complexity/>

 

Google Cloud Introduces Media CDN for Content Delivery

... In addition to running on planet-scale infrastructure, Media CDN tailors delivery protocols to individual users and network conditions. Media CDN includes out-of-the-box support for QUIC (HTTP/3), TLS 1.3, and BBR, optimizing for last-mile delivery . When the Chrome team rolled out widespread support for QUIC, video rebuffer time decreased by more than 9% and mobile throughput increased by over 7%.

< <https://www.infoq.com/news/2022/05/google-cloud-media-cdn/> https://www.infoq.com/news/2022/05/google-cloud-media-cdn/>

 

DEX, don’t front run me bro

... Developers appear to be addressing “spam” transactions by implementing a handshake over UDP (QUIC protocol), to be followed up with a transaction fee market. However, this only addresses the shortage in transaction processing capacity and does not touch the front running issue.

< <https://coingeek.com/dex-dont-front-run-me-bro/> https://coingeek.com/dex-dont-front-run-me-bro/>

 

**********************

OTHERWISE NOTEWORTHY

**********************

W3C Strategic Highlights, April 2022

megaphoneW3C released today to the public the April 2022 edition of the W3C Strategic Highlights. This report summarizes recent work W3C Members and the public do at the Web Consortium to enhance the web and innovate for its growth and strength.

< <https://www.w3.org/blog/news/archives/9532> https://www.w3.org/blog/news/archives/9532>

 

Two Months of War: The Impact on the Internet’s Core

The Internet shouldn’t become a battleground. The Internet Society has been saying this for years. More recently, we called upon stakeholders to make sure that the sanctions imposed on Russia as a result of its invasion of Ukraine do not impact the global Internet infrastructure.

< <https://www.internetsociety.org/blog/2022/05/two-months-of-war-the-impact-on-the-internets-core/> https://www.internetsociety.org/blog/2022/05/two-months-of-war-the-impact-on-the-internets-core/>

 

Reducing bias of networking A/B tests

Networking algorithms are often evaluated by running A/B tests. In an A/B test, we randomly allocate a small fraction of traffic (say 1% or 5%) to a ‘treatment group’ running the new algorithm, and compare its performance against the control group running the old algorithm. If the treatment group outperforms the control group in the various metrics we care about, we treat this as evidence that the new algorithm would perform well if deployed.

< <https://blog.apnic.net/2022/05/11/reducing-bias-of-networking-a-b-tests/> https://blog.apnic.net/2022/05/11/reducing-bias-of-networking-a-b-tests/>

 

Transitioning organizations to post-quantum cryptography

Abstract: Quantum computers are expected to break modern public key cryptography owing to Shor’s algorithm. As a result, these cryptosystems need to be replaced by quantum-resistant algorithms, also known as post-quantum cryptography (PQC) algorithms. The PQC research field has flourished over the past two decades, leading to the creation of a large variety of algorithms that are expected to be resistant to quantum attacks.

< <https://www.nature.com/articles/s41586-022-04623-2> https://www.nature.com/articles/s41586-022-04623-2>

 

Podcast: Do government networks have a role to play in deploying RPKI?

In this episode, we’re taking a closer look at Resource Public Key Infrastructure (RPKI) in Australia and New Zealand with Terry Sweetser.

< <https://blog.apnic.net/2022/05/13/podcast-do-government-networks-have-a-role-to-play-in-deploying-rpki/> https://blog.apnic.net/2022/05/13/podcast-do-government-networks-have-a-role-to-play-in-deploying-rpki/>

 

The future (and history) of IPSec

Internet Protocol Security (IPSec) is a set of standards applicable to IPv4 and IPv6 networks that provide end-to-end security. It is based on three elements:
< <https://blog.apnic.net/2022/05/09/future-of-ipsec/> https://blog.apnic.net/2022/05/09/future-of-ipsec/>

 

Using ccTLD data to study the impact of local IXPs

Studying Internet routing data can turn up some interesting trends. Recently I have been looking into routing and hosting of sites under various country code Top-Level Domains (ccTLDs). The Internet Society examines the impact of local Internet Exchange Points (IXPs) in many contexts, which has engaged me to investigate the intersection of both.

< <https://blog.apnic.net/2022/05/10/using-cctld-data-to-study-the-impact-of-local-ixps/> https://blog.apnic.net/2022/05/10/using-cctld-data-to-study-the-impact-of-local-ixps/>

 

Our Pledge to Achieve Universal Connectivity

At the close of 2021, new data from the International Telecommunications Union (ITU) showed we’re slowly progressing in bringing more people online. But there is still a long way to go. Nearly three billion people around the world are still living without the Internet. In today’s world that means they’re not only living without opportunities, but they’re also being left behind on an emerging digital economy and losing out on essential public services.

< <https://www.internetsociety.org/blog/2022/05/our-pledge-to-achieve-universal-connectivity/> https://www.internetsociety.org/blog/2022/05/our-pledge-to-achieve-universal-connectivity/>

 

World Telecommunication and Information Society Day 2022

On 17 May, the International Telecommunication Union (ITU) will celebrate World Telecommunication and Information Society Day (WTISD) with a spotlight on older persons and health ageing.

< <https://www.itu.int/en/mediacentre/Pages/MA2022-05-11-WTISD_Media_Advisory.aspx> https://www.itu.int/en/mediacentre/Pages/MA2022-05-11-WTISD_Media_Advisory.aspx>

------

David Goldstein

email:  <mailto:[e-mail]> [e-mail]

web:  <http://goldsteinreport.com/> http://goldsteinreport.com/

Twitter:  <https://twitter.com/goldsteinreport> https://twitter.com/goldsteinreport

phone: [phone] - mobile; [phone] - office/home