Blackberry Rant, or open letter to new RIM CEO

Dear Thorsten Heins:

It looks like under your leadership the company is trying to go back in time. Tell you what: It is impossible - the past does not exist anymore. People are not getting phones from their companies. People are companies - small businesses where just a handful of founders work.

Of course it would be very lucrative to focus on big-quantity, prices-do-not-matter sales like governments, banks, corporations.  But it is wrong way - even though those sales make complete sense (high margin, high volume, low support.)

I would outline weaknesses of Blackberry, strength of Blackberry, and throw in few ideas.

I am forty-one. I grew up in Soviet Union, moved to U.S. (through Ottawa) in 1996, worked for enterprises, startups, consulted, started my company. I now live in Ukraine and travel about 12 times a year. I keep two Blackberries (one for U.S. and one for Ukraine.) I love them.  And I hate them. I tried three different Android models, many Nokias, and of course iPhone. I keep coming back. I would tell you why.

But first, some recollection of the past.

I got my first blackberry (the one with simplified keyboard and roller on right hand side) in 2004 (GSM model from T-mobile US.)  SInce then, I got same from Verizon, full-keyboard GSM (Curve) from T-mobile, another one from T-mobile (Bold), and Storm2 I use overseas.

Why I became fan of RIM products? Because it was popular, because data plan was unlimited and cheap (like $30), but the most important ---

Because it worked, flawlessly.  My Blackberry was like that Kalashnikov gun I learned to disassemble in university.  It never failed.  It lasted long on single charge.  Emails arrived in one second.  You can drop it and it survived.  I can use buttons to invoke menu commands.  Everything was integrated - my hardware, OS, applications, email server.  It was flawless.  This was until 2008 or so.

Then I noticed something.  I moved to Europe, travelled, and found many less people using Blackberries (I except UK - wasn't there.)   Why?  Fewer corporations, data plans more expensive, devices hard to import.  I don't know.  I know one thing: RIM failed at global branding.

There is also too much choice of devices -- and there is a compromises to be made.  Look at Apple - I would repeat this later, for different reasons - they offer one device model each year or so with only difference in memory size, body color, and network capabilities (CDMA vs GSM, but only recently.)  

In comparison, my trip to blackberry.com shows me 21 recent models - with no way to even hide those which use CDMA or GSM.  I was looking for something to replace my aging Storm2 - a modern pure touch-screen device.   I wrote off Torch series as 9810 is hybrid (slider keyboard) and 9860/9850 looked like Android to me (can't tell why - maybe it is green color? screen proportions?)
I found nothing on US site, then I found Curve model 9380 on Canadian site which had almost same selection of devices - and was considering buying it when careful look at specs showed it lacks micro-SD card slot and has meager 512M of internal flash memory.

This is the general problem with RIM offerings - every time new set of devices comes, each of them is lacking: memory, CPU, OS version support, or GSM vs. CDMA.  Too much choice is not good, and I keep wondering why Bold and Curve lines exist separately, or why foldable Style only has CDMA version, or why Storm2 (or any other device which runs only version 4) have not got an update.  Oh well.

Now some reminder of what happened recently (last five years or so.)

iPhone appeared and everybody realized touch screen was way to go.  But Blackberry resisted, and when Storm appeared it failed.  (Altough I use Storm2 and I actually like its press screen to type feature, I must be in minority.)  Lesson: slow to adopt, and finding your own way to do common things.  Two mistakes -- and they have one name: NIH (Not Invented Here.)

I continued to try devices while keeping my U.S. device for trips.  I realized that I cannot swap SIM card and have the internet just work.  Lesson: Blackberry does not allow one to self-configure Internet (like iPhone, Android, or even Nokia can do - a special configuration message arrives when I insert freshly-bought SIM, I click Accept, and my phone can get cheap local data and voice calls.

You should allow people to take their device everywhere, and keep contacts and calendar synced to your servers.  Of course, there is Google sync - but why I can't I use trusted RIM?  You talk about corporate market -- but you can treat all of your BIS users as employees of one giant corporation, where they pay to you.  How?    Apple charges for iCloud storage (ok, over some limit.) Do the same.

Back then, desktop app sucked royally, and there was not one for Mac.  This is fixed now, but you should continue to work on this.  And make it work over cloud, just like iOS 5 does.  Backup to servers, not to user's PC - this would fit your corporate strategy.

It would give me this warm fuzzy feeling that I know that if I lose my device, I can go, buy new one (older or newer model - does not matter), insert (different) SIM card, login to Blackberry (you already have this account system, Blackberry ID) -- and everything's back.

So what is good about those blackberries.

Integration of all messaging types.  Context-sensitive apps (see phone number - email person who has it.)  Battery life (although this may have changed.)  UI niceties (dimming screen on standby).  Construction (not flimsy.)  Camera stabilizer.  Keyboard (of course - but some models are better than others.)  Dedicated call/end buttons (always.) Balance of cost and functionality, used models perform pretty well.  Swappable batteries.  Easy migration between devices.  Alarm clock (can wake everybody early enough for this most important meeting.)  All boring - but all working.  In fact, I would make "It just works.  Always." a new company slogan unless it is taken already.

Some More Ideas

Go direct.  Carriers don't know how to sell.  Open retail store in Canada.  Then in U.S. Look at Apple.   Allow people to buy unlocked, unbranded by carrier devices from you. There are data plans there already.  Make brand more visible.  Sell at full price, with warranty.

Rename company to Blackberry Inc.  This shows focus.  Or maybe spin-off retails sales as Blackberry Inc, keeping RIM name for holding company. This would allow for better accountability as well.

Make older devices support OS 6, and ideally OS 7.  Apple customers love that their 3GS models can run latest 5.1 OS, three years after hardware release, and that they become faster with it.  Do the same -- perhaps doing market study of which models are most popular in the field.  One thing that people hate is being stuck with same for long.  Give them this option.

Make OS faster.  This goes together with previous point -- there is certain lag in operation.  Maybe it is because of Java virtual machine. Get some quality official skunkworks team and task them with doubling the speed of booting, launching applications, everything.  Look at what Google did - each newer OS is better in performance.

Keep system open -- one of strength of device for personal users like me is that I can copy my photos and music back and forth without launching equivalent of iTunes.  Keep it like this.

Consider opening platform specs to external developers somewhat.  And make external developers happy - I heard their program sucks royally, hard to get in, tools are nowhere as slick as those for OS X or Android, and it takes long time to get applications approved.

Make it cool.  This takes PR work, but also asking top influencers in each of your markets (corporate, youth, travellers, and self-employed) to tell *you* what *they* like and hate about your device.  Listen, analyze, respond.  Make a privileged circle of early adopters - like one thousand people to be kept in the loop and be given new devices one month before release with NDA.  Watch the leaks creating buzz about your product.  Keep silent yourself, and create culture of secrecy and anticipation.  This is from Jobs' book.  Steal this idea.

Please, make the company shine again.  Don't retreat.  Be smart.  Make people switch from Android.  You can do it.  You should!

Good luck,
your faithful customer of seven years.

Posted

DNSSEC TTLs are serious matter

Many DNS server code bases exist. Some of them do support various tricks to make life easier for system administrators.
In particular, there is a need for resolver cache to limit TTLs on both low side (say, at least five minutes) and high side (say, 48 hours.)

While this behavior seems harmless, it may cause issues while DNSSEC is in use, as RRSIG records contain TTLs of records they sign,
and the data is used for hash generation.

There was a discussion on IETF dnsext mailing list whether it makes sense to actually compare TTL stored in RRSIG with actual TTL.
A suggestion was made ( http://www.ietf.org/mail-archive/web/dnsext/current/msg10234.html ) to just ignore embedded TTL (OTTL).

At any rate, I have just encountered vendor which *changes* TTL when acting as authoritative server, and it causes validation failures with at least one application which checks DNSSEC signatures (I am not sure about exact reason for bug, but the end result is that DNSKEY trust chain is ignored.) Right now I am waiting for response from the vendor.

Moral of this story is: be conservative with DNS data. Like, don't mangle it.

Posted

Коста Рика - путевые записки

"Не больше двух килограмм сладостей и одного бинокля", прочитал я на обороте таможенной декларации,
посматривая в окошко аэробуса, неотвратимо приближающегося к аэропорту Сан-Хосе Санта Мария.

"Добро пожаловать в Коста-Рику!" сообщила табличка возле приема багажа. После того, как бдительный сотрудник пограничного контроля конфисковал банан, купленный в аэропорту Сан-Франциско за полтора доллара и который я так и забыл съесть, я был выпущен на свободу.

Целеуказание для таксиста состояло из слов "после здания юстиции триста (неизвестно чего) на север, потом на восток, после второго лежачего полицейского, дом с двумя платанами и зеленым балконом."

Так оно и есть - дом с двумя платанами, незапирающимися железными воротами, гамаками во всех удобных местах и ручным кроликом теперь временно мой. Опытным путем было установлено, что интернет лучше ловится с балкона, что под платаном.

Первая вылазка в город была предусмотрительно сделана с картой. Центр состоит из десяти горизонтальных и десяти вертикальных (если смотреть на север) улиц, все они односторонние, и квадратной улицы по периметру. Всего сто кварталов. Знаки на перекрестах отсутствуют. Знаки на домах тоже. Знаки стоп есть, но водители их игнорируют. Как-то случайно заметил один светофор. Он мигал попеременно красным и желтым. Зеленый подразумевается - его на нем нет.

Да, городок называется Alajuela. Читается это как "Алахуэйя". Где-то так я себя в нем и чувствую.

На ночь витрины магазинов закрываются ролетами (железными шторами снаружи.) Иногда это делают с покупателями (вроде меня) внутри. Возмущающихся покупателей спокойно выпускают.

Вообще тут все спокойны. Никто никуда не спешит - пешеходы терпеливо ждут на перекрестках, пока проедут машины. Машины ждут, пока пешеходы перейдут. Переход из состояния в состояние - случаен.

В киосках можно купить жвачку, пиво, сигареты (поштучно.) Девушки одетые, похоже, в ближайшей лавке пьют двухдолларовое пиво в барах, выложив на стойку белый айфон. По английски говорят плохо, особенно это казается владельцев китайских ресторанов (они разнообразят латиноамериканскую кухню -- карне, камаронес, тортийяс, пинто де гайо, арроз, вердурас и чуток плантанов - из них даже севиче делают. Доллары берут везде, все знают курс. У каждого магазина он немного свой. В Сальвадоре вообще отказались от колонес - тут еще есть, красивые пластиковые деньги с окошками и большие монеты.

Муж менеджера гостиницы открыл ресторан техасско-мексиканской кухни в двух кварталах от центра (это в трех от кольцево-квадратной дороги), переехав из Нью-Йорка. Я могу его понять.

Телевизор любят и включают погромче. Музыку латиноамериканскую тоже. Часто это совмещено.

Водитель на экскурсии на кофейную плантацию, в кратер вулкана и на водопады (три в одном, завтрак в семь, выезд в семь двадцать) был самым главным человеком. От него много раз зависела моя и пассажиров жизнь. Он каждый раз выходил из ситуации и из поворота. Чем-то похоже на маневры Сессны в воздухе, когда диспетчер советует поменять курс на 90 градусов. Хотелось пристегнуться.

В общем, прекрасная страна. Фото будут отдельно. Приезжайте - не пожалеете. ¡Pura Vida!

Posted

Great Mac Data Migration

I had many Macs in my life - so far, six (from 2005 until 2012). I normally use only one or two (desktop and portable.) However, few times I have switched my machines without proper data transfer - leaving some data behind. I also moved (cross-continents) so some of those machines were left quite far behind :)

Anyway, I decided to finally merge my data into one portable system, one Time Capsule and local backup disk, with possibility for secondary system. So, I need to copy data, and do it right.

Welcome Migration Assistant -- or so I thought. Well, there were hoops to jump through.

Some of my boxes are PowerPC (older Mac Mini and Powerbook 12"). They have firewire port though, which works wonderfully (and fast.) I also bought dual-interface WD Passport drive (it has both Frewire 800 and USB 2.0). All good, but my shiny new Macbook air does not have Firewire. Ok, I can use ethernet, as I did with Macbook to Macbook Pro -- but Air does not support this anymore on 10.7 Lion (I suppose 10.6 had it), and its ethernet adapter is slow.
Fine, so I would migrate data to Macbook Pro first, then to Time Capsule (or even to dual-interface same drive, as Time Machine backup.)
Even with Firewire, I had to have proper cable, as my old trusty one had 400-speed ports on both ends, but MBP has 800-speed one. Luckily, my new drive comes with 800-to-800 port and 800-to-400 adapter, so I can finally fetch data from that old Mini, and Powerbook. Good. Same works with Powerbook 12" running 10.3.

I actually do not have any idea how somebody can move data from PB to MBA, as 10.3 does not have Time Machine (and there is no upgrade to 10.5 where it become available - only to 10.4 I believe.) So, using Airport (oops, wifi) network can be only option if one does not have Apple USB Ethernet adapter. It does not help that my Powerbook's Airport stopped functioning some time ago, so I would have to string ethernet cable across the living room.

To add one little bit to this data copy saga, my SO has two-and-half year old MBP which developed a battery problem. As those batteries can only be safely replaced by certified Apple technicians (oops, Geniuses) an of course they do not guarantee that even a single bit would survive this action, I was faced with task to copy over the data from it too. Only that destination machine is MBA, and -- yes, you guessed it -- no Firewire, and my network is pretty slow (54Mbit on Time Capsule, but it is half-duplex as I understand.)

Long story short: Firewire rules; Air data migration ability sucks. I guess there is Thunderbolt array in my future. It better not require any new cabling.

Posted

My Barcelona experience

I (star) Raval, said t-shirt of waittress in restaurant facing big, open, palm-lined square in central Raval distict of Barcelona (or Barça, as locals call it.) I share this sentiment - and can extend it to entire city.

I was lucky enough to visit many capitals of Europe, so I can compare. To make this post shorter, I would start with short list of topics and then expand it.

The climate rocks.

The people rock.

Transportation system rocks.

City art, design, and layout rock absolutely.

They allow marijuana and nakedness.

The last part to me has more to do with free spirit of city - which is capital to Catalonian nation, split into countries of Spain and France - then with actual freedoms it refers to (San Francisco shares one of them competely - and other partially - at FSF.)

Before I go deep into details, let me also stress that I had absolutely no language issues - and I do not posess fluent Spanish (or Calalonian), same can be said about locals' knowledge of English (or Russian.) Yet somehow, we get on well, like new friends -or, rather, lovers - as I think this city loves its visitors as much as visitors love it. Now let me get to individual parts.
I would be comparing Barcelona to San Francisco a lot - not to say which one is better, but just as a point of reference.

The climate is an upgraded version of San Francisco, with warmer summers yet mild winters. You can actually swim in Mediterranean sea as early as May, and I saw somebody doing it even in January. Sun shiines around 300 days (think everyday but Mondays.) There is not much winter rain. There is also no earthquakes (if you consider them weather.)

People come from all cultures. Islamic (halal) meat shops, Indian restaurants, Sikh temple, Turkish and Kurdish cafes - all here.  There must be siginificant Russian and Chinese population but I haven't done count. It feels safe whereever you are, regardless of time of the day - petty theft notwithstanding, it is city with litle violence. Police was friendly (even during street march yesterday).

Metro is stunning. Quiet, frequent, quick, ubiquitous - with lines criss-crossing city into tiny walkable parcels. Same tickets work on busses, trams, and city rail lines. All signs are tri-lingual - Catalan, Spanish, English. They had a temporary closure of funicular line to Montjuic - with buses substituted - and the signage could have not been more prominent. It costs under 1 euro a ride if you buy a ten-pack. On Saturday (official party til the dawn day) metro does not stop (with reasonably sobering intervals.) BART can eat dust.

Walking through streets, squares, boulevards is a pure pleasure. Wide, with proper geometrical shapes, they are as practical as sight-seeing in its own. Compare Avenuda Diagonal with Market Street (both cut through rectangular grid of other streets.)  Bike pathways are separated from car ways if on street level (or share pavement space), and sometimes have own traffic signals. Corners are cut at perpendicular intersections to form proper diamonds, giving extra parking space, making mini-squares for commercial floor space, and stopping traffic farther from intersection on red light. Cars are not first class citizens here, like in SF.

I feel like entire city was made by engineers and artists, working together, to ensure practicality balances with beauty. It works.

I would come again.

Filed under  //  travel  
Posted

why new gTLDs would be bad for you

Just read @edyson Congress testimony - "new domain names are somewhat like derivatives: they add complexity and transactions and lots of rights and obligations without actually creating anything of vlaue." I agree fully.

Too much effort, too little innovation. Going from 300 current TLDs to, say, 800 new ones in year from now would not make the world better. During its more than ten years history, ICANN created around twenty new domains (including such special ones line .MUSEUM and .POST) - with about 50% success ratio (I define success as over hundred thousand domains registered.) For comparison, city of Kiev (about three million inhabitants) has slightly over fifty thousand domain names active.

If past performance is guarantee of future results, ICANN would attract about hundred million U.S. dollars in fees (assuming five hundred applcations - probably conservative number) and would create over two hundred useless domains. Which would be useless we would not know upfront, but I would imagine nobody in their sane mind would use them as *only* place to register their name - it would be me-too effect. (Ok, perhaps few of .TEL alikes pass and create something unique and special - like .BLOG. Still, my main point - duds quantity would be high.)

You see, Internet domain names are not things to lose or win in competition, primarily. Yes, individual operators should strive to be profitable - but each of those domains is public resource forever to be used. The reason people like .COM is not because it is run by Verisign - is because too many other people use it, or it is "too big to fail."

We are about to create "try and fail" scenario - and surely enough, insurance policies would pay user fees if domain operator stops operating - but would they pay back loss of trust in enitre system?

Innovation must be incremental. I would fully support five hundred application slots, even five thousand. I would support only five or ten winnera, though. They better be good.

Otherwise, it would be just another case of "What do you mean you've never been to Alpha Centauri?"

Posted

NSEC3PARAM salt hunt

This is technology post.  Skip it if you are not into DNSSEC.

Background:
http://tools.ietf.org/html/rfc5155#page-12
4.TheNSEC3PARAMResourceRecord

So, NSEC3PARAM (TYPE51) resource record has algorithm, opt-out flag, iteration count, and salt - the latter is a hex string.

But how it is actually used?

# dig axfr . @f.root-servers.net > root.zone
# cat root.zone | perl -alne 'print $F[0] if $F[3] eq NSEC' | sed 's/^/dig nsec3param /' | sh | grep -i nsec3param | tee root.type51

# grep '^;' root.type51 | grep NSEC3PARAM | wc
     313     939    7313
#


...313 domains in root zone...

# grep -v '^;' root.type51 | grep -v NSEC3PARAM$ | wc
      61     488    2408
#

... 61 of them use DNSSEC with some salt...  let us sort them out:

# grep -v '^;' root.type51 | grep -v NSEC3PARAM$ | sort +7
com.                    86400   IN      NSEC3PARAM 1 0 0 -
edu.                    86400   IN      NSEC3PARAM 1 0 0 -
net.                    86400   IN      NSEC3PARAM 1 0 0 -
uk.                     1551    IN      NSEC3PARAM 1 0 0 -
su.                     0       IN      NSEC3PARAM 1 0 3 00FF
ac.                     0       IN      NSEC3PARAM 1 0 5 021D
io.                     0       IN      NSEC3PARAM 1 0 5 021D
sh.                     0       IN      NSEC3PARAM 1 0 5 021D
tm.                     0       IN      NSEC3PARAM 1 0 5 021D
cz.                     0       IN      NSEC3PARAM 1 0 10 04A65146089ADC2A
nc.                     0       IN      NSEC3PARAM 1 0 10 140238C4
be.                     0       IN      NSEC3PARAM 1 0 5 1A4E9B6C
tw.                     0       IN      NSEC3PARAM 1 0 10 23411313
xn--kprw13d.            0       IN      NSEC3PARAM 1 0 10 23411313
xn--kpry57d.            0       IN      NSEC3PARAM 1 0 10 23411313
museum.                 43200   IN      NSEC3PARAM 1 0 12 3B616CCEF9D86ADC
sx.                     0       IN      NSEC3PARAM 1 0 10 4321
li.                     0       IN      NSEC3PARAM 1 0 2 44A3
la.                     0       IN      NSEC3PARAM 1 0 150 46A94223
at.                     10800   IN      NSEC3PARAM 1 0 5 4A9F8B7E2671E561
gov.                    300     IN      NSEC3PARAM 1 0 8 4C44934802D3
nu.                     0       IN      NSEC3PARAM 1 0 12 5544DA4B
pl.                     0       IN      NSEC3PARAM 1 0 12 5BDF29DB0DF4228F6301
eu.                     0       IN      NSEC3PARAM 1 0 1 5CA1AB1E
gl.                     0       IN      NSEC3PARAM 1 0 10 6CD13FB2
ug.                     0       IN      NSEC3PARAM 1 0 10 6F1F6F40
am.                     0       IN      NSEC3PARAM 1 0 10 76931F
kr.                     0       IN      NSEC3PARAM 1 0 10 96E920
si.                     3600    IN      NSEC3PARAM 1 0 5 9AC6108694CF480A
cl.                     0       IN      NSEC3PARAM 1 0 2 A45F80464BBAEFBA483973A43B8F78CB
cat.                    43200   IN      NSEC3PARAM 1 0 12 AE7A5F02ADAC6F45
mil.                    0       IN      NSEC3PARAM 1 0 10 AEEC
nl.                     1854    IN      NSEC3PARAM 1 0 5 B54C74E32E1F61AA
de.                     0       IN      NSEC3PARAM 1 0 15 BA5EBA11
fr.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
pm.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
re.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
tf.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
wf.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
yt.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
gr.                     0       IN      NSEC3PARAM 1 0 10 BEEF
my.                     0       IN      NSEC3PARAM 1 0 10 D197FC
ag.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
asia.                   900     IN      NSEC3PARAM 1 0 1 D399EAAB
bz.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
gi.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
hn.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
in.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
info.                   900     IN      NSEC3PARAM 1 0 1 D399EAAB
lc.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
me.                     635     IN      NSEC3PARAM 1 0 1 D399EAAB
mn.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
org.                    900     IN      NSEC3PARAM 1 0 1 D399EAAB
sc.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
vc.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
dk.                     3339    IN      NSEC3PARAM 1 0 17 D62599DF241F8204
fi.                     3332    IN      NSEC3PARAM 1 0 5 D9945CE53B53A52D
jp.                     0       IN      NSEC3PARAM 1 0 8 DC5B6568A4
lu.                     7200    IN      NSEC3PARAM 1 0 3 E780D40A
pt.                     0       IN      NSEC3PARAM 1 0 10 FCCE
ch.                     0       IN      NSEC3PARAM 1 0 2 FED8
#


so, who is clever, or just smart?

cute: .de "BA5EBA11" and fr "BADFE11A" (they got several TLDs), .gr "BEEF"; 
longest: .cl "A45F80464BBAEFBA483973A43B8F78CB";  
boring: .sx "4321" probably;
family: .asia, .info, .org etc "D399EAAB" - they are all on Afilias.

meanwhile, i am thinking of good string to use;  for now, settled on "c0ffee42".

it is also interesting to sort by iteration count:

# grep -v '^;' root.type51 | grep -v PARAM$ | sort -n +6
com.                    86400   IN      NSEC3PARAM 1 0 0 -
edu.                    86400   IN      NSEC3PARAM 1 0 0 -
net.                    86400   IN      NSEC3PARAM 1 0 0 -
uk.                     1551    IN      NSEC3PARAM 1 0 0 -
ag.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
asia.                   900     IN      NSEC3PARAM 1 0 1 D399EAAB
bz.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
eu.                     0       IN      NSEC3PARAM 1 0 1 5CA1AB1E
fr.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
gi.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
hn.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
in.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
info.                   900     IN      NSEC3PARAM 1 0 1 D399EAAB
lc.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
me.                     635     IN      NSEC3PARAM 1 0 1 D399EAAB
mn.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
org.                    900     IN      NSEC3PARAM 1 0 1 D399EAAB
pm.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
re.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
sc.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
tf.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
vc.                     900     IN      NSEC3PARAM 1 0 1 D399EAAB
wf.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
yt.                     0       IN      NSEC3PARAM 1 0 1 BADFE11A
ch.                     0       IN      NSEC3PARAM 1 0 2 FED8
cl.                     0       IN      NSEC3PARAM 1 0 2 A45F80464BBAEFBA483973A43B8F78CB
li.                     0       IN      NSEC3PARAM 1 0 2 44A3
lu.                     7200    IN      NSEC3PARAM 1 0 3 E780D40A
su.                     0       IN      NSEC3PARAM 1 0 3 00FF
ac.                     0       IN      NSEC3PARAM 1 0 5 021D
at.                     10800   IN      NSEC3PARAM 1 0 5 4A9F8B7E2671E561
be.                     0       IN      NSEC3PARAM 1 0 5 1A4E9B6C
fi.                     3332    IN      NSEC3PARAM 1 0 5 D9945CE53B53A52D
io.                     0       IN      NSEC3PARAM 1 0 5 021D
nl.                     1854    IN      NSEC3PARAM 1 0 5 B54C74E32E1F61AA
sh.                     0       IN      NSEC3PARAM 1 0 5 021D
si.                     3600    IN      NSEC3PARAM 1 0 5 9AC6108694CF480A
tm.                     0       IN      NSEC3PARAM 1 0 5 021D
gov.                    300     IN      NSEC3PARAM 1 0 8 4C44934802D3
jp.                     0       IN      NSEC3PARAM 1 0 8 DC5B6568A4
am.                     0       IN      NSEC3PARAM 1 0 10 76931F
cz.                     0       IN      NSEC3PARAM 1 0 10 04A65146089ADC2A
gl.                     0       IN      NSEC3PARAM 1 0 10 6CD13FB2
gr.                     0       IN      NSEC3PARAM 1 0 10 BEEF
kr.                     0       IN      NSEC3PARAM 1 0 10 96E920
mil.                    0       IN      NSEC3PARAM 1 0 10 AEEC
my.                     0       IN      NSEC3PARAM 1 0 10 D197FC
nc.                     0       IN      NSEC3PARAM 1 0 10 140238C4
pt.                     0       IN      NSEC3PARAM 1 0 10 FCCE
sx.                     0       IN      NSEC3PARAM 1 0 10 4321
tw.                     0       IN      NSEC3PARAM 1 0 10 23411313
ug.                     0       IN      NSEC3PARAM 1 0 10 6F1F6F40
xn--kprw13d.            0       IN      NSEC3PARAM 1 0 10 23411313
xn--kpry57d.            0       IN      NSEC3PARAM 1 0 10 23411313
cat.                    43200   IN      NSEC3PARAM 1 0 12 AE7A5F02ADAC6F45
museum.                 43200   IN      NSEC3PARAM 1 0 12 3B616CCEF9D86ADC
nu.                     0       IN      NSEC3PARAM 1 0 12 5544DA4B
pl.                     0       IN      NSEC3PARAM 1 0 12 5BDF29DB0DF4228F6301
de.                     0       IN      NSEC3PARAM 1 0 15 BA5EBA11
dk.                     3339    IN      NSEC3PARAM 1 0 17 D62599DF241F8204
la.                     0       IN      NSEC3PARAM 1 0 150 46A94223
#

here, it is intesting to note that four (.com, .edu, .net, .uk) domains use "-" (no salt) [1], those are all big TLDs;
then, twenty, some big folks (.info, .eu, .org) use one iteration only;  just three use two iterations, and two - three; nine domains iterate their hashes five times; only two do it eight times - but they are .gov and .jp (they must know something);   then, default value ten was chosen by fourteen;  a dozen times was good enough for four, including .cat and .museum; .de used fifteen reps (secure enough for them?  does it relate to baseball?);  .dk went with seventeen;  and the winner in CPU load during zone generation must be .la - one hundred fifty times must serve them right. 

Myself, I think ten is reasonable - after all, it was default;  thirteen may suit well, too.

#E0F#

[1] fixed typo - no salt is denoted as string "-".

Filed under  //  dnssec  
Posted

my mobile internet data use

I am online all the time except when asleep (well, my phone is, anyway.) I switched from Blackberry to Android as my everyday pocket device in June of 2011. So, it was a little over six months. My main computer is Macbook; therefore, I mostly use phone on the way to office, around town, and occaisionally at home (in bed, in bathroom, on the dinner table, and other inappropriate places.) This means that most of my use is on wifi; although I do keep it disabled sometimes to save battery. Android 2.x is not good in battery management department, although JuiceDefender helps a lot.

I use Network Traffic Counter by Cyril Jaquier - excellent tool for those on measured data plans (like me). Here are some statistics.

Since June 15th until today (December 30th) I received 6.689 GB an sent 1.017 GB, for a total of 7.683 GB. This means that 13% of traffic is upload. In November, the figures were 1.367 and 0.178 (12%) - 1.54 together. In last seven days, 533 an 73 (again, 13%). Seems pretty interesting, those 13% - it is about 1/8. Some kind of internet golden ratio?

With my voice plan come 250MB of included GPRS/EDGE traffic. This month I have used 150 MB of it, which amounts to 5 MB a day. This means,
using November figures for reference, that wifi traffic amounts for 90% - 1.5G per month. It makes sense, as I tend to browse more when on wifi (it is faster, of course, and would not drain my battery as much as 2G.)

I have very conservative settings. My contacts (all two thousand of them) are on Google but I update them very rarely. Abount 500 more come from social networks, but I set SNS sync frequency to 12 hours. My TweetDeck settings are once an hour for "me and direct" settings. My SMS Backup+ also runs every hour. My Gmail is not my primary account, and receives about 30 messages daily. I also run ClockSync (daily), RememberTheMilk (auto mode), and Evernote (wifi sync only, as updates tend to be large). My Foursquare is _not_ scanning for nearby locations. My GPS is off, as well as bluetooth. I use Opera as my primary browser (very helpful on 2G). I run Skype in background - probably the only unknown here. My phone's camera abosolutely sucks and I upload like five pictures a month. I do not run Google plus on my phone.

So, in theory, I should not be one of those people who advocate unlimited mobile internet (unlimited as in 10 Gbytes per month - something that cost ten euro, or fifteen US dollars, in Austria on prepaid "drei.at" card). But I am not.

You see, my low data use required a lot of discipline. I also pretty much "sit and work" person vs. "run and walk and navigate" one. So, this kind of person who would use 10G per month is not some kind of bandwidth hog. In fact, 10 Gbytes per month would translate to 3858 bytes per second on average, or 30Kbit. Most of it (in my case, 83%) would be download (27Kbit/s) with upload being 4Kbps. Those are "1G" speeds - and even assuming that peaks are 10x higher than average (so, our user browses for 2.4 hours per day and then retires) it would be measly 270Kbps down.

So, why mobile telco industry makes it look like mobile data costs them a fortune? Mostly because they are greedy, and cannot keep high voice costs subsidize their expensive network expansion to 3G - something that, as I prove above, people cannot use and do not need (I tried to use Skype over 128Kbit connection. It worked, on acceptable quality. The lag made it impractical though.)

Mobile networks today are: high-latency (100ms on first hop is fast), slow (practical 3G is under 5Mbits? This is like DSL in 2005), high-packet-loss, unusable for real-time communication, typically use NAT and HTTP proxies, probably do not offer proper EDNS needed for DNSSEC. Yet, they are measured by traffic not by bandwidth allocated (I also saw per-minute prices in Thailand... wow) and have very non-linear overage charges. And let's not get started on data roaming prices (15 USD per Megabyte? This would be 2250 USD a month for very low-key user like myself.)

I now only one flat-fee mobile carrier with global data service: T-Mobile US (50 dollars per month, limited to Blackberry devices).
For general use, the best deal is from abroadband.com (60 euro cent per megabyte, roaming pretty much everywhere; they only ship to EU.)

The world needs sensible mobile internet. Perhaps by new kind of company - I call it GMISP (Global Mobile ISP). Any takers?

Filed under  //  3g  
Posted

a modest proposal for DNSSEC file transport mechanism

So I was sitting there thinking of file transport to use for my DNSSEC signer.
Roughly, it is a blackbox that just takes file in, does something with it (adds RRSIG records and such), then sends new file out. For outgoing part, there is already a method to send them securely, called IXFR (standard DNS protocol zone transfer). SInce no modification is possible after signing, it makes sense. We already use hidden distribution master for UA - a machine known only to staff and public servers. 

But what about inbound transfer part? Zone data is not completely stored in registry database - just delegation records are (and those are dumped in BIND-compatible format, ready to be $INCLUDE-d). Apart from that, there is so-called zone apex data (SOA record, NS set, glue records for in-bailiwick NSes, and of course DNSKEY records which are best kept on separate hardware device, encrypted of course.)

On the database which generates zone data, we need "send-this-file-and-process-it-remotedly" command.

The job of signing server, is, among other things, is to ensure consistency of sequence - every time new zone data file comes in, it must, after prepending all special apex data and before adding signatures, increment serial number. Every new complete file is bakes must be based on specific source file. Also, as signature generation uses CPU time (on hardware or not), zone signing must be serialized - only one process must be doing it at a time, and any further transfers in must be queued and wait for their turn. So, we need to be able to limit number of jobs to be processed in parallel (one per each zone signed.)

Normally of course zone source data must not be generated more often than it can be processed,
but if some backlog occurs. This means that we would also like to have job queue control, with ability to temporarily suspend and resume processing (say, during key repository maintenance), and job removal.

Of course, one can always use rsync, and remote ssh, and spme locking for device access.. but I had a feeling that this problem was already solved before. And then it dawned on me.

All I need is - please don't laugh - UUCP with SSL transport. To send a file, I would use uux.
To process it later (in event it would be delayed after receipt), there is uuxqt. Job queue control is done by uustat.

I can already see it -- a small patch for uucico to support SSL... there is already a 't' protocol in Taylor UUCP. The payload may be encrypted, but it may be cleaner to add key exchange to transport level. An RFC would be nice.

Feel free to flame in comments. I can take it - I have been on Netnews, ah, USENET. Hey, that's where we used to run UUCP. On Telebit trailblazers. Over analog phone lines with pulse dialing. In Soviet lines. Uphill both ways barefoot in snow.

Filed under  //  dnssec  
Posted

DNSSEC results fetched directly from authorities

Here are some commands I run today in terminal window on my Mac:

My-MacBook-Air$ dnssec-trigger-control status
at 2011-11-19 22:38:14
authority 128.8.10.90: OK 
cache 82.144.192.21: error no EDNS
cache 82.144.192.130: error no EDNS
state: auth secure

My-MacBook-Air$ dnssec-trigger-control  reprobe
My-MacBook-Air$ 

If those things mean nothing to you, do not panic - it is normal.  What happens here is a brilliant combination of software running on my Macbook, called dnssec-trigger, periodically checks my ISP DNS configuration changes and verifies that data is not altered on its way.  If it does, it mitigates the issues by doing some additional querying on its own.

If you still do not understand what this means, here is an explanation.  You may have to google or wikipedia every other sentence if you are not an Internet technology expert.  Again, this is normal.  Keep reading if you are still curious.

DNS is Internet application protocol acting as distributed directory service.  Think of it as a mapping from names to numbers (almost like telephone book).  The questions are sent by your computer to your ISP, with their substance being "where exactly is that www.facebook.com is located?"  The response comes back to your computer saying, "there, at 69.171.242.11".  Your computer (or, to be exact, a browser program running on it) connects to this address.  SImple.

Well, not really -- as your ISP really has no idea where that site is located, so it has to ask somewhere else.  It has to ask, in fact, many questions, to servers high and low, each giving him a reference to another one, or partial answer, or even nothing - DNS servers are numerous and some of them are down, sometimes -- until eventually it gets an answer.

The answer is then sent to you.  Well, not just that -- it is also cached at ISP server, for some time, to save bandwidth.

There are several issues with this approach.  First, questions are sent in cleartext, without encryption.  People who operate your ISP, people who operate that router in cafe you sit while surfing the web, people located somewhere else who happen to be in between your ISP and some, unknown to you, server that knows the answer - they can all, well, lie.  Second, the answers can be spoofed - and they are also cleartext - by attackers with enough resources.

They can lie by mistake - stale data (saved for limited time, or cached).  They can lie by trust -- somebody else told them a lie, and they repeat it.  They can lie on their own (intercepting some ads and replacing them with some others.)  You would never notice those things unless you are an Internet geek with lots of spare time.

They also can lie by policy (be it a corporate rules of no social network access, or some government order to block sites with content being not appropriate, or some other similar thing.)  I am not going into details - however, it is important to understand that originally, when this whole DNS protocol was invented, there was no spam, and (almost) no liars.  Everybody on the Internet was honest.  All computers just passed data through.  So you got correct, if only stale, data.

Not anymore.  DNS data was "played with" in many ways.  Lookup "Verisign wildcard record .COM" for some stories.   Our networks have too many actors.
There is no turning back - on the Internet of today, you cannot be sure of anything.  So, how can we trust the DNS?

Turns out, we can -- if there is something called DNSSEC (DNS Security Extensions) present.  This technology, developed for over ten years, is not just some obscure standard implemented only by geeks in academia and security departments in the military -- it is actually running worldwide, thanks to efforts of current Internet DNS policy operator, an American non-profit corporation called ICANN, and many of technical and policy partnerships it has.

DNSSEC allows you to know if the trust was violated.  It does not tell you what the correct data is -- but it allows you to find out by yourself if the data was tampered with, truncated, augmented, or plain invented, on its way.

It all works only if everybody is cooperating - in case above, it would be Facebook keeping digital signatures on their DNS servers which know about facebook.com, which would be then signed by operator of COM (Verisign, as of now), and then signed by manager of top-level, or root, zone (ICANN).   I am pretty sure one of those days all parts of the security chain would work - except that your ISP can be too lazy, or ignorant, or outright naughty.  

What can you do, on your own, besides waiting for good security to come your way from the top?  

You can install a program I mentioned above -- dnssec-trigger, available for download at http://www.nlnetlabs.nl/projects/dnssec-trigger/ in binary and source form.  This software would verify security chain for name resolution (aka DNS) and warn you if something is amiss. It would also remedy the situation by sending some extra little traffic on its own (providing that your ISP allows that) and add security when it is possible.

This software would not always work -- your home router may ignore security data until you upgrade its firmware, your ISP can filter your questions, or third-party answers, or both.  Worst, there may be another authority disallowing it.  Still, in majority of cases, it would act as a "fixer" and make sure that your name resolution is secure.  If something fails the tool can be disabled until you need it again.

It may be not the most user-friendly way to use new technology, but it is something that it is easy enough.  Try it today - it is free software!

Posted