TechSNAP

Latest Episodes:

Episode 390: What’s Up with WireGuard Nov 22, 2018

Show notes

WireGuard has a lot of buzz around it and for many good reasons. We’ll explain what WireGuard is specifically, what it can do, and maybe more importantly, what it can’t.

Special Guest: Jim Salter.

Links:

How to easily configure WireGuard — At its core, all WireGuard does is create an interface from one computer to another.
Jessie Frazelle's Blog: Installing and Using Wireguard, obviously with containers — What is cool about Wireguard is it integrates into the Linux networking stack.
WireGuard Didn't Make it To The Mainline Linux Kernel This Cycle — The code continues to be improved upon but looks like it came up just short of making it into this current development cycle.
WireGuard VPN review: A new type of VPN offers serious advantages — Fewer lines of code, simpler setup, and better algorithms make a strong case.
The Current Status of WireGuard VPNs - Are We There Yet?
Using a free VPN? Why not skip the middleman and just send your data to President Xi?
Feedback from Cody
NRE Labs — NRE Labs is a no-strings-attached, community-centered initiative to bring the skills of automation within reach for everyone
Introduction to Antidote — Antidote is an open-source project aimed at making automated network operations more accessible with fast, easy and fun learning.
StackStorm — From simple if/then rules to complicated workflows, StackStorm lets you automate DevOps your way.
wireguard-private-networking: Build your own multi server private network using wireguard and ansible
Algo: Set up a personal IPSEC or WireGuard VPN in the cloud

Episode 389: The Future of HTTP Nov 15, 2018

Show notes

Wes is joined by special guest Jim Salter to discuss Google's recent BGP outage and the future of HTTP.

Plus the latest router botnet, why you should never go full UPnP, and the benefits of building your own home router.

Special Guest: Jim Salter.

Links:

Google goes down after major BGP mishap routes traffic through China — Google lost control of several million of its IP addresses for more than an hour on Monday in an event that intermittently made its search and other services unavailable to many users.
Internet Vulnerability Takes Down Google
China has been 'hijacking the vital internet backbone of western countries'
RPKI - The required cryptographic upgrade to BGP routing
HTTP/3 — The protocol that's been called HTTP-over-QUIC for quite some time has now changed name and will officially become HTTP/3.
HTTP/3: Come for the speed, stay for the security
The Road to QUIC
Botnet pwns 100,000 routers using ancient security flaw — Researchers have stumbled on another large botnet that’s been quietly hijacking home routers while nobody was paying attention
BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers
From Zero to ZeroDay Journey: Router Hacking
The Ars guide to building a Linux router from scratch

Episode 388: The One About eBPF Oct 25, 2018

Show notes

We explain what eBPF is, how it works, and its proud BSD production legacy.

eBPF is a technology that you’re going to be hearing more and more about. It powers low-overhead custom analysis tools, handles network security in a containerized world, and powers tools you use every day.

Links:

Chris Goes to MeetBSD
Linus Torvalds talks about coming back to work on Linux | ZDNet — BPF has actually been really useful, and the real power of it is how it allows people to do specialized code that isn't enabled until asked for.
The Kernel Report - Jonathan Corbet
BPF - the forgotten bytecode — All this changed in 1993 when Steven McCanne and Van Jacobson published the paper introducing a better way of filtering packets in the kernel, they called it "The BSD Packet Filter" (BPF)
The BSD Packet Filter
eBPF: Past, Present, and Future — The Extended Berkeley Packet Filter, or eBPF, has rapidly been adopted into a number of Linux kernel systems since its introduction into the Linux kernel in late 2014. Understanding eBPF, however, can be difficult as many try to explain it via a use of eBPF as opposed to its design. Indeed eBPF's name indicates that it is for packet filtering even though it now has uses which have nothing to do with networking.
Using eBPF in Kubernetes — Cilium is a networking project that makes heavy use of eBPF superpowers to route and filter network traffic for container-based systems. By using eBPF, Cilium can dynamically generate and apply rules—even at the device level with XDP—without making changes to the Linux kernel itself
Why is the kernel community replacing iptables with BPF? — The Linux kernel community recently announced bpfilter, which will replace the long-standing in-kernel implementation of iptables with high-performance network filtering powered by Linux BPF, all while guaranteeing a non-disruptive transition for Linux users.
bpftrace (DTrace 2.0) for Linux 2018 — Created by Alastair Robertson, bpftrace is an open source high-level tracing front-end that lets you analyze systems in custom ways. It's shaping up to be a DTrace version 2.0: more capable, and built from the ground up for the modern era of the eBPF virtual machine.
The bpftrace One-Liner Tutorial
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more — BCC is a toolkit for creating efficient kernel tracing and manipulation programs, and includes several useful tools and examples.
Linux eBPF Tracing Tools — This page shows examples of performance analysis tools using enhancements to BPF (Berkeley Packet Filter) which were added to the Linux 4.x series kernels, allowing BPF to do much more than just filtering packets. These enhancements allow custom analysis programs to be executed on Linux dynamic tracing, static tracing, and profiling events.
eBPF Vulnerability (CVE-2017-16995): When the Doorman Becomes the Backdoor
Ultimate Plumber — Ultimate Plumber is a tool for writing Linux pipes with instant live preview
BSD Now 073: Pipe Dreams — Interview w/ David Maxwell about Pipecut, text processing, and commandline wizardry.

Episode 387: Private Cloud Building Blocks Oct 11, 2018

Show notes

We bring in Amy Marrich to break down the building blocks of OpenStack. There are nearly an overwhelming number of ways to manage your infrastructure, and we learn about one of the original tools.

Plus a few warm up stories, a war story, and more.

Special Guest: Amy Marrich.

Links:

James Stanley - Someone used my IPFS gateway for phishing
Scaling Engineering Teams via Writing Things Down and Sharing — I have recently been talking at small and mid-size companies, sharing engineering best practices I see us use at Uber, which I would recommend any tech company adopt as they are growing. The one topic that gets both the most raised eyebrows, as well the most "aha!" moments is the one on how the planning process for engineering has worked since the early years of Uber.
Say hello to Kata Containers — Kata Containers bridges the gap between traditional VM security and the lightweight benefits of traditional Linux containers.
Disappearing videos and disappointed grandmothers — Here's another story about broken things with some of the details changed just a little. If it sounds familiar, it's probably because your company also did it at some point.

Episode 386: What Makes Google Cloud Different Oct 04, 2018

Show notes

We bring on our Google Cloud expert and explore the fundamentals, demystify some of the magic, and ask what makes Google Cloud different.

Plus how Google hopes Roughtime will solve one of the web’s biggest problems, some great emails, and more!

Special Guest: Matt Ulasien.

Links:

Cloudflare Embraces Google Roughtime, Giving Internet Security a Boost — The internet infrastructure firm Cloudflare will now support a free timekeeping protocol known as Roughtime, which helps synchronize the internet's clocks and validate timestamps.
Roughtime: Securing Time with Digital Signatures — Roughtime lacks the precision of NTP, but aims to be accurate enough for cryptographic applications, and since the responses are authenticated, man-in-the-middle attacks aren’t possible
Google Cloud rolls out security feature for container images — All container images built using Cloud Build, Google's fully-managed CI/CD platform, will now be automatically scanned for OS package vulnerabilities
Tweets by Matthew Ulasien (@mulasien)
Google Cloud Weekly | 10.03.2018
Matthew Ulasien - Quora
Google Certified Professional Cloud Architect
Feedback: Can't Even Google This One!
Feedback: The Button Pusher Problem
Feedback: Can I monitor that?
Pingdom
Site24x7
prometheus/blackbox_exporter: Blackbox prober exporter
Kubernetes the Hard Way - Course
How do Kubernetes Deployments work? An adversarial perspective. — What is happening when a Deployment rolls out a change to your app? What does it actually do when a Pod crashes or is killed? What happens when a Pod is re-labled so that it's not targeted by the Deployment?
Kubernetes: The Surprisingly Affordable Platform for Personal Projects — I think that Kubernetes makes sense for small projects and you can have your own Kubernetes cluster today for as little as $5 a month.
Kubernetes for personal projects? No thanks! — I have read multiple times this article about running Kubernetes to run small projects and thought I could share why I think that might not be a great idea.
KubeDirector: The easy way to run complex stateful applications on Kubernetes — KubeDirector is an open source project designed to make it easy to run complex stateful scale-out application clusters on Kubernetes.
Kubernetes On Bare Metal — This guide will take you from nothing to a 2 node cluster, automatic SSL for deployed apps, a custom PVC/PV storage class using NFS, and a private docker registry.
Introducing DigitalOcean Kubernetes in Limited Availability

Episode 385: 3 Things to Know About Kubernetes Sep 27, 2018

Show notes

Kubernetes expert Will Boyd joins us to explain the top 3 things to know about Kubernetes, when it’s the right tool for the job, and building highly available production grade clusters.

Plus the privacy improvements that could be coming to HTTPS, and a new SSH auditing tool hits the open source scene.

Special Guest: Will Boyd.

Links:

Open Sourcing HASSH — HASSH is a network fingerprinting standard invented within the Detection Cloud team at Salesforce.
ESNI: A Privacy-Protecting Upgrade to HTTPS — Today, Cloudflare is announcing a major step toward closing this privacy hole and enhancing the privacy protections that HTTPS offers. Cloudflare has proposed a technical standard for encrypted SNI, or “ESNI,” which can hide the identities of the sites you visit—particularly when a large number of sites are hosted on a single set of IP addresses
What's new in Kubernetes 1.12?
Kubernetes the Hard Way — Kubernetes The Hard Way guides you through bootstrapping a highly available Kubernetes cluster with end-to-end encryption between components and RBAC authentication.
Install Minikube
Creating a single master cluster with kubeadm
10 open-source Kubernetes tools for highly effective SRE and Ops Teams
Clonezilla — Clonezilla is a partition and disk imaging/cloning program similar to True Image or Norton Ghost.

Episode 384: Interplanetary Peers Sep 21, 2018

Show notes

Jon the Nice Guy joins Wes to discuss all things IPFS. We'll explore what it does, how it works, and why it might be the best hope for a decentralized internet.

Plus, Magecart strikes again, Alpine has package problems, and why you shouldn't trust Western Digital's MyCloud.

Special Guest: Jon Spriggs.

Links:

GovPayNow.com Leaks 14M+ Records — Government Payment Service Inc. has leaked more than 14 million customer records dating back at least six years, including names, addresses, phone numbers and the last four digits of the payer’s credit card.
Magecart claims another victim in Newegg merchant data theft — Researchers from RiskIQ, together with Volexity, revealed that California-based retailer Newegg is the latest well-known merchant to succumb to the threat actors.
RiskIQ: Another Victim of the Magecart Assault Emerges
Password bypass flaw in Western Digital My Cloud drives puts data at risk — A security researcher has published details of a vulnerability in Western Digital’s My Cloud devices, which could allow an attacker to bypass the admin password on the drive, gaining complete control over the user’s data.
WD MyCloud Metasploit Example
Cloudflare goes InterPlanetary — Today we’re excited to introduce Cloudflare’s IPFS Gateway, an easy way to access content from the InterPlanetary File System (IPFS) that doesn’t require installing and running any special software on your computer.
End-to-End Integrity with IPFS — This post describes how to use Cloudflare's IPFS gateway to set up a website which is end-to-end secure, while maintaining the performance and reliability benefits of being served from Cloudflare’s edge network.
How permanent is data stored on IPFS?
Lesson: Add Content to IPFS and Retrieve It · Decentralized Web Primer
Leo Tindall: Putting This Blog on IPFS
A Beginner’s Guide to IPFS — IPFS consists of several innovations in communication protocols and distributed systems that have been combined to produce a file system like no other.
Useful resources for using IPFS and building things on top of it
OrbitDB: Peer-to-Peer Databases for the Decentralized Web
Rebuild Alpine Linux Docker Containers After Package Manager Patch — An attacker could intercept a package request as a Alpine Linux Docker image is being built and add malicious code that target machines would then unpack and run within the Docker container

Episode 383: The Power of Shame Sep 13, 2018

Show notes

TechSNAP progenitor and special guest Allan Jude joins us to talk mobile security, hand out some SSH tips and tricks, and discuss why security shaming works so well.

Plus, how Mozilla is protecting their GitHub repos, a check-in on Equifax, and some great picks.

Special Guest: Allan Jude.

Links:

Episode 382: Domestic Disappointments Sep 06, 2018

Show notes

We’re joined by a special guest to discuss the failures of campaign security, the disastrous consequences of a mismanaged firewall, and the suspicious case of Speck.

Plus the latest vulnerabilities in Wireshark and OpenSSH, the new forensic hotness from Netflix, and some great introductions to cryptography.

Special Guest: Martin Wimpress.

Links:

Episode 381: Here Comes Cloud DNS Aug 29, 2018

Show notes

To make DNS more secure, we must move it to the cloud! At least that’s what Mozilla and Google suggest. We breakdown DNS-over-HTTPS, why it requires a “cloud” component, and the advantages it has over traditional DNS.

Plus new active attacks against Apache Struts, and a Windows 10 zero-day exposed on Twitter.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected