Engineer distributes resume via IPv6 traceroute(cv6.poinsignon.org) |
Engineer distributes resume via IPv6 traceroute(cv6.poinsignon.org) |
main.screen.turn.on
how.are.you.gentlemen
$ traceroute cv6.poinsignon.org
traceroute to cv6.poinsignon.org (2001:bc8:3eff:c0::ff), 30 hops max, 80 byte packets
1 gateway 0.795 ms 0.789 ms
[...]
8 hello (2001:bc8:3eff:c0::1) 1.431 ms 1.202 ms
9 My.name.is.Louis.Poinsignon (2001:bc8:3eff:c0::2) 1.649 ms 1.274 ms
10 I.am.a.network.and.systems.Engineer (2001:bc8:3eff:c0::3) 1.695 ms 2.090 ms
11 This.is.my.resume.over.traceroute (2001:bc8:3eff:c0::4) 1.698 ms 1.793 ms
12 o---Experience---o (2001:bc8:3eff:c0:ee::) 1.829 ms 2.052 ms
13 2018.Cloudflare.NetworkEngineer.SF (2001:bc8:3eff:c0:ee::cf3) 2.261 ms 2.155 ms
14 2017.Cloudflare.NetworkEngineer.London (2001:bc8:3eff:c0:ee::cf2) 2.293 ms 1.284 ms
15 2016.Cloudflare.NetworkEngineer.Intern.SF (2001:bc8:3eff:c0:ee::cf1) 1.136 ms 1.205 ms
16 2015.CEA.SoftwareEngineer.Intern.France (2001:bc8:3eff:c0:ee::cea) 1.204 ms 1.226 ms
17 o---Education---o (2001:bc8:3eff:c0:ed::) 1.360 ms 1.607 ms
18 2015-2016.DrexelUni.Exchange.CE.Philadelphia (2001:bc8:3eff:c0:ed::1) 1.237 ms 1.312 ms
19 2011-2016.UTT.Master.CE.France (2001:bc8:3eff:c0:ed::2) 1.492 ms 1.604 ms
20 o---Skills---o (2001:bc8:3eff:c0:51::) 1.565 ms 1.418 ms
21 C.Java.Python.Golang (2001:bc8:3eff:c0:51::1) 1.364 ms 1.536 ms
22 Net.Linux.Automation (2001:bc8:3eff:c0:51::2) 1.381 ms 1.266 ms
23 Statistics.Maths.Photoshop (2001:bc8:3eff:c0:51::3) 1.504 ms 1.431 ms
24 o---Various---o (2001:bc8:3eff:c0:7a::) 1.461 ms 1.519 ms
25 Swimming.and.karate (2001:bc8:3eff:c0:7a::1) 1.378 ms 1.473 ms
26 Piano (2001:bc8:3eff:c0:7a::2) 1.552 ms 1.683 ms
27 o---Contact---o (2001:bc8:3eff:c0:c0::) 1.551 ms 1.486 ms
28 mail.jobs.at.poinsignon.org (2001:bc8:3eff:c0:c0::1) 1.576 ms 1.473 msAh, that explains a lot. Not that anyone else couldn't do such a thing, but I feel like even amongst more "hacker" types it takes a relatively specialized background to pull a trick like this (at least statistically; I'm sure there are outliers).
This is really unfortunate, and I mostly blame Cisco and Juniper. They suffocated an entire academic discipline with obfuscated terminology driven more by their business models than anything resembling the OSI model or open standards. That’s why WireGuard feels like such a breath of fresh air after 20 years of L2TP/IPSec.
I applaud companies like Cloudflare and Fly.io for their openness in sharing techniques and open sourcing so much of their code. It goes a long way toward lowering the barriers to self-teaching and experimenting with the latest networking software. And I’m sure HR is happy about the increasingly large applicant pool of qualified networking engineers – even if some hires do eventually leave by advertising their resume to anyone who sends them an IPv6 trace-route :)
https://github.com/blechschmidt/fakeroute
https://github.com/antifork/hopfake
https://github.com/jprenken/rickroute
https://github.com/sams-gleb/ipv4-traceroute-fake
https://github.com/job/ipv6-traceroute-faker
And so on…
I remember being a 13yo kid sitting on IRC doing exactly this for fun years ago back when IP addresses were cheap and easy to come by. But spoofing military IPs in the traceroute was more fun.
If he's scripted it to do all the virtual nic creation and dns ptr entries, it would be interesting to see.
[1] https://bencane.com/2012/07/16/tc-adding-simulated-network-l...
19. hello 0.0% 14 141.6 140.5 139.1 141.6 0.7
20. my.name.is.louis.poinsignon 0.0% 14 141.9 142.1 141.2 143.3 0.5
21. i.am.a.network.and.systems.engineer 0.0% 14 140.5 140.4 139.7 141.6 0.5
22. this.is.my.resume.over.traceroute 0.0% 14 140.5 140.4 140.0 141.5 0.5
23. o---experience---o 0.0% 14 139.9 140.4 139.4 141.4 0.5
24. 2021.apple.engineer.sf.usa 0.0% 14 140.7 140.5 139.8 141.2 0.4
25. 2018.cloudflare.engineer.sf.usa 0.0% 14 140.8 140.4 139.4 142.8 0.9
26. 2017.cloudflare.engineer.london.uk 0.0% 13 142.2 142.6 141.4 147.5 1.5
27. 2016.cloudflare.engineer.intern.sf.usa 0.0% 13 149.7 141.2 139.1 149.7 2.7
28. o---education---o 0.0% 13 142.1 142.1 141.3 144.1 0.7
29. 2015-2016.drexeluni.exchange.ce.philadelphia.usa 0.0% 13 140.9 140.3 139.5 141.3 0.5
30. 2011-2016.utt.master.ce.france 0.0% 13 143.1 142.3 140.8 143.3 0.7
31. o---skills---o 0.0% 13 140.3 140.9 139.7 146.0 1.6
32. golang.c.python 0.0% 13 142.2 142.4 141.1 146.0 1.2
33. networks.linux.automation.kafka.clickhouse.kubernetes 0.0% 13 139.6 140.5 139.3 142.2 0.8
34. statistics.maths 0.0% 13 141.6 142.1 141.2 142.8 0.5
35. o---various---o 0.0% 13 141.8 142.4 141.8 144.8 0.8
36. swimming.karate.piano 0.0% 13 139.8 141.4 138.7 155.2 4.2
37. o---contact---o 0.0% 13 140.1 140.3 138.6 141.7 0.8
38. mail.jobs.at.poinsignon.org 0.0% 13 141.1 142.5 141.1 145.4 1.1
39. cv6.poinsignon.org 0.0% 13 139.4 140.3 139.4 141.2 0.5Good times.
also, looking glasses... jeez. i haven't heard or thought of those in _years_.
(A bit of a missed opportunity; the author should really set a AAAA record there IMHO)
There's no actual requirement that your PTR records resolve back to the same IP. Historically very little software bothered to check, and most of the Unix-y diagnostic software has never been updated to do so...
I also wonder why not use use the domain, much easier.
A total flop on the last line
mail.jobs.at.poinsignon.org
mail: jobs@poinsignon.orgDoxxing usually implies ill intent but having your personal information broadcast to HN is likely only to result in a few of the hiring managers that haunt here sending a cold offer.
I’m expecting the usual pushback, and will reciprocate. I’ll let you know how it goes.
[0]: https://github.com/johnnydecimal/resume/blob/main/resume.md
(Yeah I shamelessly inserted my own résumé.)
unzip resume.docx; cd resume; dd if=/dev/random of=crap.tax bs=1M count=19;cd ..; zip resume.docx resume
traceroute cv6.poinsignon.org | pandoc -o whywhywhy-o-why.docxIt's silly that ISPs have messed up their IPv6 deployment so badly that there's a "shortage" of IPv4 addresses now. Of course, IPv4 was never going to be enough; there are too many people on earth.
Normally wouldn't bother to mention, but, you know, CVs
For the history books, IIRC proff (Julian Assange) presented this hack in 1997, shortly after he wrote strobe.c (1995; AFAIK the first TCP half-open scanner). Here's a 1998 public posting of the code: https://packetstormsecurity.com/files/12995/fakeroute.c.html
At that time, the running joke was to provide inbound traceroutes spoofed next hops which implied you were working for a government agency (the Australian Federal Police, the Defence Signals Directorate (now Australian Signals Directorate) or the Defence Science and Technology Organisation (now the Defence Science and Technology Group)).
Free Julian.
How long will it take, until someone gains access? I consider this an intentional security leak.
telnet towel.blinkenlights.nl % traceroute6 -w1 cv6.poinsignon.org
traceroute to cv6.poinsignon.org (2001:bc8:3eff:c0::ff), 30 hops max, 80 byte packets
1 2a01:x:x:x::1 (2a01:x:x:x::1) 0.794 ms 0.913 ms 0.737 ms
2 * * *
3 2001:bc8:3eff::1 (2001:bc8:3eff::1) 39.555 ms 39.668 ms 39.560 ms
It works for me once I enable “WARP” from my 1.1.1.1 app on iOS.
ALARM ~ $ tracepath 2001:bc8:3eff:c0::ff
1?: [LOCALHOST] 0.015ms pmtu 1500
...
...
2: ALPHEUS-COM.edge1.Washington1.Level3.net 15.966ms
3: ae5-3828.edge1.Washington1.Level3.net 4.011ms
4: 2001:1900:2::3:18 77.693ms
5: 2001:1900:5:2:2::4a0a 78.469ms asymm 4
6: 2001:bc8:400:1::8a 78.737ms asymm 7
7: 2001:bc8:400:1::13a 78.635ms asymm 6
8: no reply
9: no reply
10: no reply
11: no reply
12: no reply
13: no reply[edit]
Note that "tracepath -m60 bad.horse" works just fine.
Also shame on Microsoft for no full IPv6 support in WSL2.
(The CV posted above is outdated, this is what the traceroute shows today)
8 37 ms 36 ms 36 ms hello [2001:bc8:3eff:c0::1]
9 32 ms 32 ms 31 ms My.name.is.Louis.Poinsignon [2001:bc8:3eff:c0::2]
10 33 ms 32 ms 31 ms I.am.a.network.and.systems.engineer [2001:bc8:3eff:c0::3]
11 35 ms 36 ms 35 ms This.is.my.resume.over.traceroute [2001:bc8:3eff:c0::4]
12 37 ms 35 ms 36 ms o---Experience---o [2001:bc8:3eff:c0:ee::]
13 36 ms 35 ms 35 ms 2021.Apple.Engineer.SF.USA [2001:bc8:3eff:c0:ee::714]
14 33 ms 34 ms 31 ms 2018.Cloudflare.Engineer.SF.USA [2001:bc8:3eff:c0:ee::cf3]
15 32 ms 34 ms 33 ms 2017.Cloudflare.Engineer.London.UK [2001:bc8:3eff:c0:ee::cf2]
16 38 ms 36 ms 35 ms 2016.Cloudflare.Engineer.Intern.SF.USA [2001:bc8:3eff:c0:ee::cf1]
17 36 ms 35 ms 34 ms o---Education---o [2001:bc8:3eff:c0:ed::]
18 36 ms 35 ms 34 ms 2015-2016.DrexelUni.Exchange.CE.Philadelphia.USA [2001:bc8:3eff:c0:ed::1]
19 37 ms 32 ms 32 ms 2011-2016.UTT.Master.CE.France [2001:bc8:3eff:c0:ed::2]
20 37 ms 34 ms 35 ms o---Skills---o [2001:bc8:3eff:c0:51::]
21 36 ms 36 ms 34 ms Golang.C.Python [2001:bc8:3eff:c0:51::1]
22 36 ms 34 ms 36 ms Networks.Linux.Automation.Kafka.Clickhouse.Kubernetes [2001:bc8:3eff:c0:51::2]
23 33 ms 33 ms 33 ms Statistics.Maths [2001:bc8:3eff:c0:51::3]
24 31 ms 32 ms 31 ms o---Various---o [2001:bc8:3eff:c0:7a::]
25 34 ms 35 ms 35 ms Swimming.Karate.Piano [2001:bc8:3eff:c0:7a::1]
26 36 ms 34 ms 35 ms o---Contact---o [2001:bc8:3eff:c0:c0::]
27 32 ms 34 ms 31 ms mail.jobs.at.poinsignon.org [2001:bc8:3eff:c0:c0::1]
28 33 ms 35 ms 30 ms cv6.poinsignon.org [2001:bc8:3eff:c0::ff]All kidding aside, IPv6 isn't even required for their website or this traceroute trick. He just set up an in-addr.arpa reverse DNS zone to reverse resolve particular IP addresses to specific values. If you had a block of 20 IPv4 addresses, I don't see anything stopping you from doing the exact same thing.
A block isn't necessary at all, even on IPv4. Traceroute can easily show internal address or just be lied to. Just recently we've seen a different example of this on HN:
If your ISP doesn't block ICMP, you can get IPv6 capabilities using tunnels like https://tunnelbroker.net/. Especially useful if you have a router you can configure this stuff on so all of your devices get IPv6 for free. Completely free of charge and with minimal latency if you live somewhere near a data centre.
All of the links just go to Wikipedia and the traceroute is as shown (minus the initial hops of course)
For some reason, most IRC servers tend to do this.
Especially when the breed has "died"
It'd probably be a lot safer to just have the line be "jobs.at.[...]"
Edited to add: Oh also - from the same line you can infer that a dot means a dot - the ".org" at the end confuses the meaning. Perhaps it'd be clearer if they went 100% slashdot and had ".DOT.org"
It took me a minute to realize it wasnt some form of "mail+jobs" or "mail.jobs". It wasnt until I wrote the last line of my comment that it was "mail jobs@"
You can see there is more than a few replies of people who are confused about the email.
"Ah yes, here is a thing thats a big filter, so let me make the email yet another filter but instead of just (EASILY) fixing it I will just use that as an excuse to leave it"
How about... (huge surprise here......... wait for it)....... one just makes it better, such as:
jobs.AT.domain.DOT.com
I quite honestly cannot even understand the mental processes some people here go through. It's so clear, yet you're also not the first arguing for a retarded justification instead of just "fix it by making it less ambiguous" which is the ONLY correct answer. That is... unless you don't care about getting emails to your resume.
Apple has been slowly but surely adding IPv6 to their public network services - App Store and OS downloads come over IPv6, and their NTP resolver just added IPv6 support.
I guess the department that controls that apple.com -> www.apple.com redirect just hasn't bothered, which is interesting because such a simple, dumb redirect service is one of the easiest things to dual-stack (as in it probably doesn't store IPs or have to worry about blocking at all, it just responds with a 301)
Next to that he set up a DNS server configured with PTR records that map these forged IP addresses to arbitrary hostnames of his choices.
Specifically timed latency might be fun to delineate sections for the viewer though.
As a 13 year old, if I had access to internet instead of buying Slackware floppies from local software "pirates" (they also had all the DOS stuff like Wordperfect and games), I'd probably be hanging around IRC.
I don't think there was much to be concerned about me back then.
(Mhm, embarrassingly out of the loop)
I'd have to do a lot more research and testing to verify though, not something I've played with in practice, and obviously my terminology isn't even right above, so take it for what it's worth.
>> There is no need to do "table lookups of hop count"
>> If you see a TTL=1 you send back the forged response as coming from $IP_1, if you see a TTL=2 you forge the response as coming from $IP_2
You're describing a table lookup of the forged address using the hop count.
Know any offhand? Search is a bit tough for a common number like 24. The concept sounds interesting
“BGP” is a signal-yielding search [1]. And any post from benjojo’s blog [2] is always a must-read.
[0] https://news.ycombinator.com/item?id=15727115
[1] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
I think they're doing some really cool stuff on the network optimization level. As an example, Solana recently implemented QUIC in its latest release: https://github.com/solana-labs/solana/projects/74
So how does Solana introduce a concept of "time" without relying on a central authority?
Solana uses a "hash that runs over itself continuously with the previous output used as the next input". Performing a hash over and over again takes some time. Then, someone can quickly verify that this "time" has occurred. The verification of the hashes can be parallelized on a GPU, which makes the verification extremely quick.
https://medium.com/solana-labs/proof-of-history-a-clock-for-...
You can verifiably be assured of a temporal ordering between transactions that were hashed in different slots because the output of a slot/block is hashed and used as an input for the next block/slot.
