Based in Paris (France)
Articles
Likes on articles
I work at AFNIC (the registry of .fr domain names), in the computer department, on, among other things, DNS, security, technical watch, standardization.
Website: https://www.bortzmeyer.org/
• 3 min read
Around the end of October and beginning of November 2024, twenty six African TLDs had a technical problem - one of their authoritative name servers served stale data. This is a tale of monitoring, anycast, and debugging.
• 8 min read
There have been several calls for Russian Internet networks to be shut down in one way or another and announcements that Russia is going to make such cuts. In this article, Stéphane Bortzmeyer explores the issue from a technical point of view.
• 22 min read
There are several ways to create RIPE Atlas measurements, thanks to its API. Here, we present Blaeu, a set of tools to create one-off measurements, mostly to debug temporary issues.
• 2 min read
On 17 October 2016, a website hosted by the French Ministry of the Interior went offline when a large number of customers of the Internet service provider, Orange, were redirected to the site. The problem occurred after Google, Wikipedia and cloud provider OVH were mistakenly placed on a terrorism …
• 15 min read
This article explains how I use RIPE Atlas probes, the official API and custom scripts to debug network issues.
• 23 min read
More and more governments, authorities and courts are requesting censorship of Internet content. It is often done via a lying DNS resolver. Can we use RIPE Atlas probes to see it, and how?
• 7 min read
If you monitor your external Internet connectivity, you may wonder which machine is the best to ping. Hesitate no more - you can use RIPE Atlas anchors as landmarks.
• 7 min read
The techniques used by the L-root DNS server are documented in RFC 7108 "A Summary of Various Mechanisms Deployed at L-Root for the Identification of Anycast Nodes". These techniques can be used by the RIPE Atlas probes to find the instance of L-root they are talking to.
Here is an asynchronous version of a Python client so you can do other things while waiting for updates. (In that case, we just display a timestamp.) #!/usr/bin/env python3 PERIOD = 5 RFC3339 = '%Y-%m-%dT%H:%M:%SZ' import sys import json import time import asyncio # https://websockets.readthedocs.io/ import websockets class RISliveWebsocket(): def __init__(self, router, asn): self.router = router self.asn = asn async def __aenter__(self): self._conn = await websockets.connect("wss://ris-live.ripe.net/v1/ws/?client=asynchronous-python-script-by-me") opening = json.dumps({"type": "ris_subscribe", "data": {"host": self.router, "path": self.asn}}) await self._conn.send(opening) print("Connected, %s sent" % opening) return self async def __aexit__(self, *args, **kwargs): print("Goodbye") pass async def send(self, message): await self._conn.send(message) async def receive(self): print("Trying to receive") return await self._conn.recv() async def tick(): while True: await asyncio.sleep(PERIOD) print("Waking up, it is %s" % time.strftime(RFC3339, time.gmtime(time.time()))) async def main(router, asn): sock = RISliveWebsocket(router, asn) async with sock as feed: while True: print(await feed.receive()) if __name__ == '__main__': if len(sys.argv) != 3: print("Usage: %s RIS-router ASn" % sys.argv[0], file=sys.stderr) sys.exit(1) try: loop = asyncio.get_event_loop() loop.run_until_complete(asyncio.wait([main(sys.argv[1], sys.argv[2]), tick()])) except KeyboardInterrupt: pass # Does not call __aexit__?
“Stephane, Quad9 has also DoH ( https://www.quad9.net/doh-quad9-dns-servers/ )”
OK, they should just update the FAQ :-) Thanks for the info.
"CloudFlare, Google and Quad9 all offer DoH" As far as I know, only Cloudflare does it. Google Public DNS has an experimental DNS-over-HTTPS (proprietary, not DoH) service and Quad9 seems to have "only" DoT (see https://quad9.net/faq/#Does_Quad9_support_DNS_over_TLS )
Saying that automatic contracts ("smart contracts" is the marketing BS) cannot be changed ("these contracts are unmodifiable") is not strictly true. To quote an old saying "every problem in computer science can be solved with one more indirection". So, you can have a pointer to the current version of the code of the smart contract, and changing the code by adding a new version of the pointer. Of course, this adds complexities and security risks but it shows that there are ways to modify automatic contracts, for instance to follow a change in policies. The description of the "51 % attack" is very sketchy ("quickly spawning a large quantity of client nodes that participate in the consensus making"). In a real blockchain, techniques like proof-of-work and proof-of-stake prevent this trivial Sybil attack. But there is a subtler reason why the "51 % attack" is overhyped: it is easily detectable (the Bitcoin Core code, for instance, logs it). So, honest miners will see it. It will not be easy to recover from the attack (the honest miners will have to fork) but it cannot be stealthy.
The link "real-time streaming capabilities" goes to a 404. I suspect the correct target is https://labs.ripe.net/Members/colin_petrie/updates-to-the-ripe-ncc-routing-information-service
I love "curl | sudo bash" in an article about security :-) Seriously, it seems the article has a confusion between DoH, as currently being standardized at IETF (and deployed by Cloudflare on 1.1.1.1) and the Google service which, unlike DoH, does not use the DNS wire format, but JSON, as shown in your example.
The first package is for Gentoo :-) https://www.swordarmor.fr/ebuild-pour-la-suite-de-tests-blaeu-pour-les-sondes-ripe-atlas.html
“Looks useful, thanks for sharing this! Can you briefly comment on what features this tool offers that are not in the official command line client?”
I started its development long before the "official" CLI program existed. After that, it's a matter of choice. Can you now display aggregated results with the "official" client? Last time I tried it, it was weak on that, displaying results probe per probe.
For Orange (AS 3215), it does not seem solved yet. A lot of timeouts: % blaeu-resolve -r 1000 --as 3215 --nameserver 1.1.1.1 --type AAAA --displayvalidation www.bortzmeyer.org Nameserver 1.1.1.1 [ (Authentic Data flag) 2001:4b98:dc0:41:216:3eff:fe27:3d3f 2605:4500:2:245b::42] : 129 occurrences [TIMEOUT(S)] : 84 occurrences [2001:4b98:dc0:41:216:3eff:fe27:3d3f 2605:4500:2:245b::42] : 1 occurrences Test #12196625 done at 2018-04-17T12:38:13Z
The tools presented here have been superseded by Blaeu, available at https://framagit.org/bortzmeyer/blaeu and documented at https://labs.ripe.net/Members/stephane_bortzmeyer/creating-ripe-atlas-one-off-measurements-with-blaeu
Showing 59 comment(s)