Subnet routers

Use subnet routers to give devices outside your local network access to services within specific subnets. Extend your private network with Tailscale.

ArsTechnica is reporting on a “new” attack against RSA, one that bypasses factoring.

First, this attack isn’t new. The original research is from 2007. What is new is the implementation.

Second, it is a forgery attack. It allows an attacker to forge digital signatures. It does not recover the private key from the public key.

Third, the attack only works against pure signatures. That is, signatures without any formatting or padding. This is not generally how we use RSA in practice.

Fourth, speed is all relative. This is not a polynomial-time algorithm; it’s a subexponential-time algorithm. But it is somewhat faster than factoring. The authors were able to forge messages for 1024-bit RSA with 1380 CPU core-years (over five real-world months).

The authors have a webpage that explains the context much better than the article. And here’s the paper.

You can get started for FREE with a 10GB vault. I think that’s really cool, because it’s enough to actually give it a try and use it productively. It’s not time-limited, so you can set up a vault, stream some backups to it, and let it keep working to really test the service.

So I decided to do just that.

I have a small box I use for VPN purposes on DigitalOcean. It’s a 512MB “droplet” (ick – it’s a VPS people). I already back it up to my home lab, but it’s a good candidate for a Restic-based backup.

In general, when I backup, I capture the following:

• Essential file and filesystems, using a “default include” model. I exclude a bunch of directories such as /dev, but by default I include everything.
• I also include “status” dumps, such as dpkg -l, ps -ef, df -h, and other info.
• Finally I do database dumps.

In the case of my VPN server, the things I care about are:

• /etc, where all the OpenVPN config lives
• because I use @Nyr’s Road Warrior script and I put the .ovpn file in /root, I should back that up, too.
• My own backups put data in /backup (dpkg -l output, etc.) so I’ll back that up.

Bot farms generating comments to reinforce a narrative, opinion, idea, that they were paid to push

I, Tom Lehrer, individually and as trustee of the Tom Lehrer Trust 2007, hereby grant the following permissions:

All copyrights to lyrics or music written or composed by me have been permanently and irrevocably relinquished, and therefore such songs are now in the public domain. All of my songs that have never been copyrighted, having been available for free for so long, are now also in the public domain. In other words, I have abandoned, surrendered and disclaimed all right, title and interest in and to my work and have injected any and all copyrights into the public domain.

The permission granted includes all lyrics which I have written to music by others, although the music to such parodies, if copyrighted by their composers, are of course not included without permission of their copyright owners. The translated songs on this website may be found on YouTube in their original languages.
Performing and recording rights to all of my songs are included in this permission. Translation rights are also included. //

So help yourselves, and don’t send me any money.

Did you know that the first character that Walt Disney created to specifically appear on television was inspired, in part, by early Space Age rocket scientists?

On this day 65 years ago (September 24, 1961), Disney introduced the “renowned scientist, lecturer, psychologist [and] world traveler,” Ludwig Von Drake. A member of the Duck family (he is the “brilliant and eccentric” uncle of Donald Duck), Von Drake was “the outstanding genius of the century” (per Disney himself) who helped to explain scientific principles and technological concepts to the millions of people who tuned in every Sunday to watch Walt Disney’s Wonderful World of Color on NBC. //

“The world-famous authority on outer space, Professor Wernher von … I mean … Ludwig Von Drake,” Disney said.

This page serves as a comprehensive guide to understanding Time Zones. IANA Time Zones, short for Internet Assigned Numbers Authority Time Zones, play a critical role in standardizing time zone identification. Based on IANA and Moment.js 2.30.1 (2025b).

IANA Time Zones adhere to a structured format: {AREA}/{LOCATION}. The "AREA" signifies a continent or ocean, while "LOCATION" designates a precise location within that continent. The table also contains DST and standard offset time in ± hh:mm format and offset abbreviations.

When I was a young lad learning networking (informallly in the late '80s and early '90s, and formally in the mid '90s), your could start from scratch and get a somewhat whole picture in a 12 week 2x90min sessions per week term.

Nowadays, It takes 2~3 14 week terms to work through the full stack. And, to top it off, many lazy professors (the older the more common this behaviour, perhaps us a burden to make new powerpoints) dedicate ample swathes of time to dead-wood topics (like 10base2 Eth and the intricacies of the crossover cable), and little to no time to modern topics (like 2.5Gbps and up Eth and the intriciacies of the 64b-66b cookbook of some 10Gbps (and up) Eth). I saw (and heard) this with my own eyes (and ears) when I was teaching networks at undergrad level between 2009~2016.

I've always advocated for a scheme in which you dedicate the first part of the first term by runnig up the stack fast by analyzing only a few SIMPLE components in each layer (say, 802.11b + IPv4 + RIPv2 + UDP + Some apps that use UDP), so that the students get a picture of a whole stack as fast as possible, and the reminder of the 2 + Chage terms to go through the model layer by layer (application to phy like cisco or phy to application like classic, does not matter)...

And to drop all the dead wood.

This gave me my opening to elaborate on my belief that teaching mental models is central to what we as educators need to do. I managed to quote Rodney Brooks one more time on the symbol-grounding problem. He makes the point that robots can’t use transformer-like LLMs to reliably perform tasks, because LLMs don’t have grounding in the real world of physical objects in which robots operate. They manage symbols (words) but can’t connect those words to real objects.

I believe this is equally true when the objects in question are networks. A real understanding of, say, transport protocols and their relationship to end-to-end security is not the same as how the words written about transport protocols normally show up in a document. Certainly this matches my experience from asking an LLM about QUIC and the Internet hourglass for a previous discussion about LLMs in networking education.

I was challenged on the question of how one builds a mental model of networking, and my initial answer – that it is built up over years of experience – was rightly challenged by Jim as well. What can we teach in a one semester course if that’s the expectation? To take an example of a famously complex protocol, I think it’s fair to expect that a student can learn the broad design challenges that are tackled by a protocol like BGP, while we would not expect them to be able to configure BGP policies for an ISP at the end of one semester. //

We need to teach about how abstracting away the details can lead to later problems, of which the initial design of HTTP over TCP is a famous example. //

we did seem to have something like a consensus around a few ideas: teaching principles and the design process more than artifacts; helping students build a solid mental model of networking; and using a problem/solution approach rather than just teaching the current set of protocols.

On Wednesday, Anthropic announced that its Claude AI had identified what researchers believe is a previously unrecognized biological system hidden in the DNA of bacteriophages, viruses that infect bacteria. The system contains a reverse transcriptase, a nearby partner gene, and a long array of repeating DNA sequences. Anthropic calls it ART, short for array-associated reverse transcriptases.

From Anthropic:

Today, we’re sharing early results from one of our first research programs, in which Claude autonomously discovered a novel enzyme system that is associated with an array of DNA repeats, a pattern reminiscent of CRISPR. Although we don’t yet know its function, the system that Claude discovered has a set of characteristics that have only ever been found together in a handful of other systems, all of which are programmable and perform operations like cutting, copying, and pasting DNA. Beyond CRISPR, which has already transformed science and medicine, several other such systems are now in development as promising tools. //

The enzyme itself wasn't unknown. Scientists had already catalogued the reverse transcriptase. What humans apparently missed was the larger pattern surrounding it. Claude noticed that these pieces occurred together and that the repeating DNA looked strangely organized.

Finding it required scale no human research team could easily match. Anthropic unleashed roughly 950 Claude agents on an enormous genetic database. The technical report says they surveyed reverse transcriptase locations across 1.9 billion protein clusters. Claude gathered more than 200,000 reverse transcriptases, found about 3,500 candidate systems, and narrowed them to 20 particularly interesting possibilities. //

Nobody yet knows what ART actually does.

Anthropic compares its structure with CRISPR because CRISPR also contains repeating genetic sequences associated with programmable biological machinery. Researchers haven't shown that ART edits genes, cuts DNA, or can become another CRISPR. The work is a preprint, not a peer-reviewed conclusion, and much of the biology remains unresolved. //

Scientists have built databases containing mountains of genetic information collected over decades. The bottleneck has increasingly become our ability to examine all of it, recognize unusual relationships, and decide which oddities deserve another look.

Claude just demonstrated a possible answer.

Until now, cryptographers thought factoring was the only way to break RSA. Not anymore.

The world has known for decades that the RSA cryptosystem’s days are numbered. Once quantum computing becomes practical (estimates for that range from 3 to 20 or more years), the foundational security it provides will crumble. New research has revealed a novel method that uses classical computing to reduce the current RSA security level to an unacceptably low threshold.

The finding poses little to no practical threat in the immediate term, except possibly in a few edge cases. Even applying the attack against the deprecated use of 1024-bit keys, the method requires more computation than just about anybody—short of nation-states or companies with massive resources—can achieve. Widely used RSA implementations are also safe.

Nonetheless, the research has taken cryptographers by surprise because it introduces signature forgery, a new way to break RSA keys without factoring. Equally important, this novel method reduces the required computing resources by orders of magnitude. //

The key forgery attack Heninger and the other researchers devised brings the breakage of 1024-bit RSA into the realm of possibility much sooner than previously estimated. Even for 2048- and 4096-bit keys, the method reduces the security of RSA to unacceptable levels.

For over 50 years, every commercial flight crossing the North Atlantic eastbound through Canadian airspace would contact Gander Oceanic Control at least 30 minutes before reaching the coast to negotiate a three-part clearance covering route, speed, and altitude. Without that explicit radio or datalink handshake, pilots faced an immediate halt in domestic airspace or an entry into a holding pattern over Newfoundland. That mandatory pre-entry clearance has now disappeared in favor of a new approach to crossing this airspace.

“Beijing’s intended strategy is to dominate the high ground of the twenty-first century.” //

In a forthcoming memoir, former US politician and NASA Administrator Bill Nelson offers a blistering assessment of China, saying the United States must do all it can to retain its leadership in space exploration.

“Beijing’s intended strategy is to dominate the high ground of the twenty-first century,” writes Nelson in Space Odyssey, a book to be published by Harper Horizon in January 2027. //

Nelson has long been wary of China as a threat to the United States, noting his concerns about technology theft from the West. Unlike his predecessor under a Democratic president—former astronaut Charlie Bolden, who served as NASA leader under President Obama—Nelson supported the Wolf Amendment, which strictly limits cooperation between NASA and China’s space program.

The reason, Nelson says, is that China’s space program is militarized and highly secretive.

“China is not a partner to be trusted,” he writes. “Partnership requires trust, and trust is founded on transparency. With China, despite repeated efforts to build verifiable, rules-based cooperation and set commonsense guard rails for engagement, there has never been much of either.” //

Although he’s no fan of the Trump administration, Nelson does seem to agree with NASA’s current administrator, Jared Isaacman, that this competition is urgent and requires the agency to pursue more than a flags-and-footprints approach. In his 10 months as administrator, Isaacman’s signature initiative has been to launch an effort across NASA and its commercial space ecosystem to build a Moon Base at the lunar South Pole.

China, Nelson writes, is planning “infrastructure for lunar permanence,” seeking to occupy the limited area at the South Pole of the Moon where the most resources are. “They are not sprinting against us to plant another flag; they are settling in for a marathon, an endurance race that will take us deeper into space than humankind has ever dared to venture before,” Nelson writes. //

Being first, and being there for the long haul, matters, Nelson says. And he tells his readers to not be fooled by talk of exploration, especially when it comes to China’s space program. This is a competition for the high ground of the 21st century.

“What looks like exploration on the surface is, in truth, also a raging struggle for space supremacy,” he writes. “This race will determine who sets the rules for a new era of human expansion beyond Earth. For Beijing, this race is not about exploration but about domination, securing the infrastructure of orbit in much the same way empires once seized trade routes and aggressively defended sea lanes.”

Should the United States lose this competition, Nelson writes, “we’ll watch the next frontier slip from our grasp.”

Decades of cheaper imports left US dependent on China for crucial rare earth processing. //

Look around you, and you’ll see rare earth elements at work. A phone vibrates because a magnet moves a weight. Its screen was polished with cerium powder. Its connection to the rest of the world crosses oceans on cables amplified with erbium. If you drove today, a rare earth magnet helped you steer, and a cerium compound scrubbed the exhaust.

All of these devices function because of 17 metals collectively known as rare earth elements. The scientists who gave the group that name in 1794 created a misnomer. Cerium alone is about as common in the Earth’s crust as copper.

However, separating rare earth minerals from one another and from raw ore is intensely difficult. As a result, countries that control the processing of rare earth minerals have a lot of political leverage.

$11M competition showed wildfire detection is still easier than stopping fires.

High prices are caused by a bottleneck at the refinery level and is not due to supply. Here are a few short-term solutions. //

Believe it or not, today the issue is not a lack of crude. There is plenty of that. Instead, the issue centers on a relative lack of refining capability due to a series of concurrent, unfortunate events. //

This issue has been a long time in the making. Since 2020, 11 domestic refineries have closed or been “repurposed to renewables,” representing a loss of production of about 900,000 barrels a day. Remaining refineries have limited capacity to pick up the slack, so if another is lost, it is difficult to mitigate the price damage that results.

It doesn’t help that the last U.S. refinery with significant downstream unit capacity was built in 1977. //

Right now, there are a few “idle” refineries (New Jersey and Nevada) that if engaged would combine to produce about 25,000 barrels a day. It would be relatively easy and quick to put them back into operation.

There are also four U.S. refineries that are listed as closed, but could reopen if business owners and regulators worked together (Benicia, Los Angeles, Houston, and Belle Chasse). They could produce around 750,000 barrels a day. These actions would mitigate a significant portion of the shortfall. At this point, every gallon is valuable.

You can install and run pkgs in an embedded install via unionfs_mount. I have done this for over 12 years (as of mid-2025) without any problems whatsoever. No jails or VM, and it's quick and easy to set up.

INSTRUCTIONS:

1. Choose one of your data discs (NOT system disc). Mine is /mnt/HDD.

2. Enter the following commands (change the name "extensions" to whatever you choose):

cd /mnt/HDD
mkdir extensions
mkdir extensions/usr
mkdir extensions/usr/local
mkdir extensions/var
mkdir extensions/var/db
mkdir extensions/var/db/pkg
mkdir extensions/var/cache
mkdir extensions/var/cache/pkg

1. Then go to "Command Scripts" and add the following commands in this order (all PostInit and usually the first commands). They're all important!

rsync -a /usr/local/ /mnt/HDD/extensions/usr/local/ 
mount_unionfs -o rw /mnt/HDD/extensions/usr/local/ /usr/local/
mount_unionfs -o rw /mnt/HDD/extensions/var/db/pkg /var/db/pkg
mkdir /var/cache && mkdir /var/cache/pkg
mount_unionfs -o rw /mnt/HDD/extensions/var/cache/pkg /var/cache/pkg

1. Of course, you should modify the above commands to reflect the name of your selected data disc and the name you choose for your primary directory (in my case /extensions)

2. Reboot XNAS

You should now be able to add (and later upgrade) all desired pkgs, and they will remain and operate the same as if you did a full install.

You might hear of the so-called "dangers" of unionfs_mount - THEY DON'T APPLY TO AN EMBEDDED INSTALL, which by its very nature makes it impossible to screw up your system. Should there ever be any problem installing a package(and I've never experienced any), all one has to do is disable the command script items and reboot for a "clean" install.

A KLM flight to Curaçao became an 11-hour flight to nowhere after a power bank reportedly belonging to the airline’s former CEO exploded while being charged onboard.

People seem to approach this from the wrong angle. The question here should always be what data do we actually genuinely need to be able to back up and restore? //

The problem was this was 30+ years ago. Imagine even in a small salon we'd backed up decades of booking data on the basis that we could easily store it given the cheapness of storage.

Now compound that problem across all businesses and throw in loads of AI toss. How much stuff is actually in backups that is never going to see the light of day again?

The volume of data that you could back up in comparison to what you genuinely need gets more and more skewed over the years. Which is part of this problem and a reason why so many people either don't have a proper strategy or find it just doesn't work when they need a restore.

If systems designed to withstand war cannot cope with sustained physical attacks, civilian bit barns have little chance. The episode also underlines a familiar but easily neglected lesson: resilience within one cloud region is not the same thing as maintaining an independent backup elsewhere.

Physical destruction is not the only threat. A major outage of the UK air traffic control system in September, which stranded hundreds of thousands of passengers and led to thousands of flight cancellations, was reportedly triggered by a military aircraft filing an incompatible flight plan. Presumably Flight Lieutenant Bobby Tables has been reprimanded.

The apparent failure to validate the flight plan data was not the worst of it. NATS, which runs the UK's air traffic control system, reportedly told airports and airlines that no backup system was available because it was undergoing a "complete overhaul." Nor was there a backup of the live data, supposedly because of the "vast amounts" involved.

If your system produces too much data to back up, you had better be running a particle collider or a giant telescope. Otherwise, you may be in the wrong business. More charitably, backup strategies are complicated, expensive, and difficult to test. They also suffer from the insurance problem: while nothing is going wrong, management sees only capital and operating expenditure with no obvious return. //

The development of marine insurance in 14th-century Italian city-states spread risk and helped make what became today's global trading network viable. The loss of a vessel was no longer an existential disaster for its owner. Provided insurers understood and priced the risks correctly, the market could grow in lockstep with mercantile activity. Data resilience has a similar dynamic, although it is rarely described in those terms. Modern IT would be impossible without it, and moving off-premises amounts to sharing some of that risk with an outside provider. //

It may take the combination of geopolitical instability and intense competition for storage to make enterprises perform similar calculations about their own precious cargoes of information. When AWS can lose an entire region and critical national infrastructure can fail without an adequate backup, those risks have plainly not been priced in properly. There is no global market where AWS, NATS, or your organization can buy the data equivalent of war-risk insurance, although imagining what one might look like suggests some intriguing possibilities.

Until something like that happens, we'll have to play by the old rules. Work through what happens if your primary data store disappears. Match backup provision to the actual risks, and if you cannot afford to protect all the data your organization needs to survive, determine how to survive with less. Backups, like insurance, are all too easy to let slide.