<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="background-color: rgb(255, 255, 255); color: rgb(0, 0,
0); font-family: Tahoma; font-size: 16px;" text="#000000"
bgcolor="#FFFFFF">
<br>
<br>
<div class="moz-cite-prefix">On 6/Nov/16 18:27, Loganaden Velvindron
wrote:<br>
<br>
</div>
<blockquote type="cite"
cite="mid:CAOp4FwT9HG_y7mo9Hf_GXfjHEdkGrFu=eV7vN0_wHWf-Zkk7aw@mail.gmail.com"
style="border-left: 2px solid #009900 !important; border-right:
2px solid #009900 !important; padding: 0px 15px 0px 15px; margin:
8px 2px; color: rgb(0, 0, 0) !important; color: rgb(0, 0, 0)
!important; background-color: null !important; color: null
!important;">[speaking for myself only]
<pre wrap="">
We talk a lot about IPv6 as a primary requirement that all CPE should
have, as IPv4 resources are depleting.</pre>
</blockquote>
<br>
Right, but what does that have to do with the original subject of
this thread?<br>
<br>
The insecurities identified in these GPON deployments would affect
both IPv4 and IPv6. So have a secure IPv6 on your CPE won't save you
from the issues that would affect IPv4.<br>
<br>
This research is about the fundamental GPON technology and its
implementation with the various vendors in question.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAOp4FwT9HG_y7mo9Hf_GXfjHEdkGrFu=eV7vN0_wHWf-Zkk7aw@mail.gmail.com"
style="border-left: 2px solid #009900 !important; border-right:
2px solid #009900 !important; padding: 0px 15px 0px 15px; margin:
8px 2px; color: rgb(0, 0, 0) !important; color: rgb(0, 0, 0)
!important; background-color: null !important; color: null
!important;">
<pre wrap="">
I see those as opportunities for us. The opportunity to learn from
others mistakes, and make the internet in Africa, competitive. I see
the FTTH, Mirai DDOS, and other recent problems as part of the same
set of issues that could have been addressed by investing at the edge
of the network. I would argue strongly that "investing in the edge"
has very high return on investment for Afrinic members.</pre>
</blockquote>
<br>
Well, the GPON tech. being run in France is not that dissimilar from
what is running in Africa. So not sure what you mean by "investing
in the edge", but in the context of this thread, perhaps you mean
investing in the time and energy to discover these issues and bring
them to the attention of both the operators and vendors.<br>
<br>
Building a network is easy. Building a secure network (particularly
a consumer network); now that's a whole other discussion.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAOp4FwT9HG_y7mo9Hf_GXfjHEdkGrFu=eV7vN0_wHWf-Zkk7aw@mail.gmail.com"
style="border-left: 2px solid #009900 !important; border-right:
2px solid #009900 !important; padding: 0px 15px 0px 15px; margin:
8px 2px; color: rgb(0, 0, 0) !important; color: rgb(0, 0, 0)
!important; background-color: null !important; color: null
!important;">
<pre wrap="">
For example, assuming there's a remote vulnerability that affects all
FTTH CPE equipment in Mauritius. The market would react to this as:
"Hey ISP, I don't want your equipment, it's insecure. Fix it or I go
somewhere else". The ISP would then tell the equipment vendor to send
it an updated firmware that it would deploy. This is how things should
happen in a free market. The customers vote with their wallet.
However, in our region, we do not have the "triggers" that make the
market behave that way. We need those triggers to make ourselves
competitive, and improve the quality of the internet in our region.
Internet should be (relatively) cheap, reliable, secure & fast as far
as ISP customers are concerned.</pre>
</blockquote>
<br>
Vendors are strange things. <br>
<br>
If you've had to deal with them for any extended period of time,
you'd realize it's not always that straight forward. I wish it were.<br>
<br>
If you look at the Pierre Kim's logs on his reporting time line to
Orange, he submitted his findings to Orange on 11th May. He only
makes meaningful headway 5 months later. Granted, Orange aren't a
vendor, but you get the scale of the issue.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAOp4FwT9HG_y7mo9Hf_GXfjHEdkGrFu=eV7vN0_wHWf-Zkk7aw@mail.gmail.com"
style="border-left: 2px solid #009900 !important; border-right:
2px solid #009900 !important; padding: 0px 15px 0px 15px; margin:
8px 2px; color: rgb(0, 0, 0) !important; color: rgb(0, 0, 0)
!important; background-color: null !important; color: null
!important;">
<pre wrap="">
Personally, I believe that it is financially feasible to make this a
reality. I've seen ISPs sitting on a lot of money, but not knowing
where to invest it. When you show them how they can improve the
services for their own customers, some of them listen. Ultimately,
having a good internet in Africa is just as important as having good
roads.</pre>
</blockquote>
<br>
DM me the names of those cash-laden ISP's. It's time for a
consulting gig :-)...<br>
<br>
Mark.<br>
</body>
</html>