Just a guy in Vermont trying to connect all the dots...
Dan York
Author's posts
Dec 17
Two New Asterisk Security Vulnerabilities Related To SMS And AMI
The great folks at the Digium / Asterisk Security Team have issued two new security advisories that folks running Asterisk should pay attention to. They are:
AST-2013-006: Buffer Overflow When Receiving Odd Length 16 bit SMS Message – If you have Asterisk set up to receive SMS messages, it seems that a 16-bit SMS message of a certain size can cause the Asterisk server to have a buffer overflow and the system to crash. The fix is to upgrade to the latest version of Asterisk. It sounds like the only attack method is via SMS and so if you are not connecting SMS to Asterisk it would seem this advisory would not apply to you.
AST-2013-007: Asterisk Manager User Dialplan Permission Escalation – The Asterisk Manager Interface (AMI) allows you to control the operation of your Asterisk server through external applications or other systems. The Security Team notes that the AMI interface does allow for the execution of dialplan functions that can go beyond simply controlling Asterisk but can in fact issue shell commands to the underlying operating system. The new versions of Asterisk now include a new option in asterisk.conf called, amusingly, “live_dangerously”, that can be set to “no” to forbid the execution of these extra functions. They note that for backwards compatibility the default for this option is “yes” because there may be applications in use that rely on these shell functions. It would seem prudent, though, to see if you can set this to “no” to provide the highest level of system security.
I am not currently running any Asterisk systems myself but it would seem to me that a basic “security 101″ level you should also be making sure that access to that AMI port on your Asterisk server is restricted to only the systems running any applications that need that access.
In any event, if you are an Asterisk user and haven’t upgraded to the latest version, these security alerts may be a good reason to do so!
Dec 16
A Trio Of IPv6 Posts From Mark Townsley Worth Reading
Interested in understanding more about what IPv6 is all about? What to know the benefits of “IPv6-centric” networks?
Mark Townsley is a Cisco Fellow and someone very well-known to many of us in the IPv6 community through his writing, videos, and strong advocacy for making the move to IPv6. Recently he’s been writing on Cisco’s “Internet of Everything” blog and three of his posts are well worth a read.
In his first post, “Demystifying IPv6“, Mark goes into the basics of why we need to care about IPv6, why it is important for what Cisco terms the “Internet of Everything” (that incorporates the regular Internet and also what many of us call the “Internet of Things”). He also explains what happened to “IPv5″. 
Next, in “Moving to IPv6: Rebuilding the Heart of the Internet Without Missing a Beat“, Mark looks at some of the challenges of switching to a new underlying networking protocol and discusses a few of the transition technologies.
Finally, in his latest post, “IPv6-Centric Networking: Innovation Without Constraints“, Mark looks at the kind of innovation that is happening within mobile networks, homes, enterprise networks and data centers when you don’t have to worry about running out of address space.
All in all a great set of contributions to the ongoing discussions about IPv6 deployment!
Now, how can we help you get your network moved over to IPv6?
Dec 16
FIR #735 – 12/23/13 – For Immediate Release
Inside PR, Thought Leadership and Higher Education all debuting on FIR Podcast Network; Jill Rowley interview is up; Neville interviewed on AMP Up Your Social Media; Quick News: WhatsApp has 400 million users, New York Times outlines native advertising plans, Peugeot Citroen orders 10,000 BlackBerry handsets, #NotYourAsianSidekick is a top-trending hashtag; Ragan promo; News That Fits: Are upi ready for new social media sites that do just one thing well?, Dan York's Tech Report, beware the Twitter mob, Media Monitoring Minute from CustomScoop, listener comments, six business cases for real-time marketing, Michael Netzley's Asia Report, the survival of Brand Nigella and the power of PR in reputation management; music from Jann Klose; and more.
Dec 16
FIR #734 – 12/16/13 – For Immediate Release
Three interview and three book reviews coming; FIR Presents Thought Leadership with Mitchell and Michael debuting; FIR website to relaunch; Quick News: national libraries digitizing books, Internet of Things about to explode, bots account for most web traffic, marketing potential in Instagram Direct; Rasgan promo; News That Fits; rules for handing a public safety crisis, Michael Netzley's Asia Report, mobile recruitment, Media Monitoring Minute from CustomScoop, listener comments, Facebook's latest algorithm change, Dan York's Tech Report, WestJet's Christmas Micracle; music from Night's Bright Colors; and more.
Dec 12
Awesomeness! Jetpack 2.7 Lets WordPress Users Auto-Post Content To Google+
For quite some time, users of Jetpack (and other similar WordPress plugins) have been able to auto-post out to Twitter and Facebook using the "Publicize" component of Jetpack, but posting to a Google+ page always required you to manually go to G+ to post the link. As a result, it was just yet-another-step that sometimes didn't happen. This was particularly true for scheduled posts that you might arrange to go out at particular times when staff were not available to post the link into Google+. (I've scheduled posts like this any number of times when I'm going to be spending a day traveling on planes.)
This changes with Jetpack 2.7 and puts Google+ on equal footing with other services. Now when you configure "Publicize" within Jetpack you see this screen (shown on my Monadnock Curling Club web site):
You then are asked how you want to connect to Google+ for this WordPress site. You can either connect to your own G+ account or to any of the Google+ Pages for which you are a manager:
You next must approve the permissions and indicate who you want to see your posts:
One final step is to approve whether you want all users of the blog to be able to publicize the post through this Google+ connection:
That's it!
Now all your future posts will be publicized through Google+! I'd note that you do have the option to control on a per-post basis what services your content is auto-posted to. When you are in a post you can see right in the "Publish" box an area for "Publicize" and by clicking on an "Edit" link you can have control over what services get the post automatically and what the message will be:
In a very nice feature I found that you can click "Add New" and go through the process again to connect additional Google+ pages or accounts. Here I've configured posts to this blog to go not only to the Monadnock Curling Club page but also to my personal Google+ account:
All in all a very cool addition to Jetpack! Well worth the upgrade to 2.7 (or the installation of Jetpack if you're not using it yet). Looking forward to now being able to more regularly get my content into Google+.
If you found this post interesting or useful, please consider either:
- following me on Twitter;
- adding me to a circle on Google+;
- following me on App.net;
- subscribing to my email newsletter; or
- subscribing to the RSS feed.
Dec 12
Video: An introduction to curling by David Murdoch
The folks at World Curling TV published this good “into to curling” tutorial from Scotland’s David Murdoch that explains the basics of curling:
Would you like to see the sport of curling brought to southwestern NH? If so, please help us get the word out and let us know you are interested!
Dec 12
First Geographic NewgTLD, .RUHR, Now Delegated (Featured Blog)
Each week ICANN has been delegating more new generic top-level domains (newgTLDs) and it's been somewhat entertaining to watch the list of delegated strings to see what new TLDs will enter the domain name space starting sometime in early 2014 when they become generally available for people to register new domains under. More...
Dec 10
Watch Olympic Curling Qualification LIVE This Week (Dec 10-15)
Want to see amazing Olympic-level curling live over the Internet? The World Curling Federation is streaming the Olympic Qualification Event live via YouTube. The schedule is online and runs from today, December 10, through Sunday, December 15, 2013. I saw part of the first Korea vs. Japan game today and it was excellent!
This is the first time this “OQE” event has been run as a way to identify the last two teams that will compete in the 2014 Sochi Olympics. Essentially, there are already 8 curling teams qualified for the Sochi Olympics and this event is a chance for everyone who hasn’t already qualified to potentially earn one of the last two spots. The USA already qualified for the Women’s event but the USA Men’s curling team is in this event vying for one of the two men’s teams.
Note that the times on the schedule of games are in Central European Time, which is currently 6 hours ahead of US Eastern time.
Tune in to watch some excellent curling! And then… if you’d like to see the sport of curling brought to southwestern NH, help us get the word out and let us know you are interested!
Dec 10
India’s Dept of Telecommunications for Tamil Nadu Making Plans for Transition To IPv6
We were very pleased to see a report out of The Hindu that the Department of Telecommunications (DoT) in the Indian state of Tamil Nadu is making a concerted effort to plan for the migration to IPv6. From the article:
The Department of Telecommunications (DoT) has started compiling an inventory of all computer networks used by government departments, State and Central public sector undertakings and banks across Tamil Nadu for finalising a plan for transition to the next generation Internet address, IPv6 (Internet Protocol version 6).
and
The DoT’s road map envisaged complete migration to IPv6 by 2017-end as the address capacity of IPv4 had been exhausted. Besides freeing up space for more Internet users, the other benefits of the move to IPv6 include better quality of service for consumers, support for high-end applications and better security features. It is also proposed that the actual migration work will adopt a dual stack that will support both IPv4 and IPv6 platforms.
The DoT’s timeline for the migration is to have all public facing interfaces for government services available over both IPv4 and IPv6 by January 1, 2015.
