The day after the zero-days
Guest Post: Patching faster cannot keep up with AI-driven discovery. Leverage structural invariants to make bug classes irrelevant.
Tag: security
Beyond origin validation: Four classes of routing attack nobody Is validating
Guest Post: RPKI has made real progress against prefix hijacking. But when you map every known class of BGP attack against the defences that exist, four of them turn out to sit entirely outside cryptographic validation — handled with local filters, static thresholds and reactive response.
Asia Pacific privacy laws are arriving. Your NREN holds more personal data than you think.
Guest Post: Privacy compliance starts with knowing your data. Many NREN services, including federated identity, eduroam, CSIRT operations, and network telemetry, process personal data and may already fall under emerging privacy laws.
APNIC 62 keynotes explore automation, trust, and the future of the Internet
APNIC 62 will explore two essential foundations of a resilient Internet: Intelligent network automation and trusted cybersecurity collaboration. Keynotes from Amajit Gupta and Yukako Uchida offer complementary perspectives on how technology and human relationships will shape the Internet’s future.
Finding zero-days with any model
Guest Post: Vulnerability discovery is an orchestration problem, not a frontier-model problem.
[Podcast] Canonical Cache Representation
Job Snijders discusses a new, compact representation of RPKI-signed objects and an archive of spooled snapshots of the global RPKI repositories.
Secure by default: How ‘HSTS-Enforced’ could finally close the web’s oldest backdoor
Guest Post: The current web still relies on a legacy assumption that website should be accessible over unencrypted HTTP unless it explicitly signals otherwise. HSTS-Enforced builds on top of HSTS by inverting its security model.
Who’s running all those tiny RPKI servers?
Guest Post: Small RPKI publication servers comprise a quiet but important part of the Internet’s trust infrastructure. Understanding who operates these servers, and why, helps reveal both strengths and gaps in today’s routing security.
ASPA at APNIC: Strengthening BGP path validation
With support now available in MyAPNIC and the Registry API, APNIC Members can publish ASPAs to help detect route leaks and strengthen the integrity of Internet routing.
ROA adoption barriers to practical planning tools: Reflections from ARIN 57
Guest Post: Even operators with strong BGP knowledge tend to create ROAs infrequently and may lack deep familiarity with their behaviour. ROOTBEER helps operators understand what to consider when creating ROAs.