Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror

Comment Re:Flutter/Dart? (Score 1) 42

I used to rock a Nokia N900. The idea of a phone with a full Linux setup with X11 and stuff (including a Firefox-derived browser) seems great at first but the software stack was full of binary blobs (including but not limited to GPU driver blobs, PulseAudio blobs, power management blobs, cellular blobs and hardware related blobs) that made actually updating the software to anything modern nearly impossible.

At the time my N900 bit the dust, it was impossible to even visit a large chunk of the web because the ancient Mozzilla-derived web browser didn't support TLS 1.2 (and not through lack of trying, I actually managed to BUILD various Mozilla source trees hoping to get something that I could run in the N900 with no success)

Comment Re:ISP efforts have been embarrassing (Score 1) 58

It's the same in a lot of places - legacy traffic is through CGNAT unless you pay (sometimes a LOT) extra. If you want any kind of home server you have to do it over v6. Also makes it much easier if you have more than one device since you can access them directly rather than having to mess with non standard ports or proxies etc.

Vodafone are a mixed bag - depends what country you're in. They have v6 in india, portugal, germany etc while in some other countries they don't.

Comment Re:So... How is this an "arm waving" problem? (Score 1) 46

Unless you want to physically go to the printer and plug in a cable, you'll probably network it, not that it's a huge problem really because you have to go to it to collect the paper anyway.

Creating an isolated airgapped network for the printer means you have to disconnect from your existing network first.

Putting the printer into its own isolated VLAN with limited access from wherever your user devices are works, but is more complex to set up.

If you're operating a perimeter based security model where you rely on perimeter security rather than each individual host then any compromised device inside the perimeter can be a serious problem. A printer will have an embedded computer and there's nothing stopping an advanced attacker from loading new firmware containing additional functionality.

Comment Default passwords (Score 2) 46

So the problem is users having default passwords. A default which is generated from the serial number is a really half assed approach and only slightly better than the old admin/admin.
Serial numbers are sequential/predictable, so you could easily brute force if you know the algorithm.

For something like a printer there is a much better approach:

1) Listen only on the IPv6 link-local address by default - so there's no way to access it without being on the same VLAN.
2) Disable remote functionality unless a physical control on the printer is set.
3) Keep the admin account locked by default - require the user to press a physical control on the printer to temporarily unlock the account. You could even have it generate and display a random password to the user - either on an inbuilt display which most of these printers have, or by printing it.
4) Force the password to be changed the first time the user logs in.
5) Tie management to the first device used to access the printer, again requiring a physical action to reset.

Comment Re:The push is ongoing, but the general consensus (Score 1) 58

It's odd but people like numbers they can remember for 2 minutes while they walk between machines.

If you're using IP addresses directly you're doing it wrong. DNS exists for a reason.
Aside from that...
v6 has a more sensible hierarchical approach, you have a prefix which in any business environment is going to be static - remembering that 2001:db8:: is your prefix isn't hard and then the whole company uses the same prefix.
Individual host addresses *can* be randomly generated using 64 bits, but they can just as easily be ::1 ::2 ::3 etc - if memorising addresses is your thing then choose an addressing scheme which facilitates that, so your have PREFIX:VLANID::1 PREFIX:VLANID::2 etc
Also avoiding NAT means that you have to remember one address, not an internal/external pair potentially with 1:many relationships and port mappings.

We also don't really need everyone's toaster, can opener, and vibrator accessible to the internet.

I guess you've never heard of a firewall.

All they really needed to do was add a country prefix number like the phone system to expand ipv4, instead ipv6 went all complicated and stuff.

Which would create an incompatible addressing system requiring a new protocol and larger addresses, and each country would still be limited to 2^32 addresses which would be fine for somewhere like Singapore but wouldn't work out well for the USA or China etc.
You'd also introduce new problems with a country prefix, like how to anycast something thats hosted in multiple countries etc.

127.0.0.1 vs eafd:45ac:5820:ffad:dead:beef::0 -- really? (apologies if that actually breaks out to a connectable address)

Actually it's 127.0.0.1 vs ::1

Comment Re:We really need to push IPv6 adoption (Score 1) 58

For an airgapped network sure, you can continue using whatever antiquated protocol you want - NetBEUI, DECNet, IPX/SPX, Vines etc.

If you're going to provide Internet access at all you really need IPv6. You can get away with IPv6-only and provide access to legacy resources through NAT64. Most legacy networks don't have full dual stack and are encumbered by NAT44 anyway so the single stack setup is easier. If you have a legacy only network encumbered by NAT you're going to find increasing numbers of things are inaccessible.

In terms of small airgapped networks with static addressing its a wash - setting a static v6 address is just as easy as setting a static legacy address.

But in many cases for a small airgapped network v6 is easier - for instance you can use the link-local addresses which means no need for static address configuration or having a dedicated DHCP server for handing out addresses etc. Apple Airdrop uses this method for example.

Slashdot Top Deals

/earth: file system full.

Working...