The Ocean Race 2023 leg 2: Cabo Verde to Capetown

noaano

Anarchist
722
363
You just don't allow access to any unlisted ip addresses, and the router is configured to provide DNS itself (this is the case with most routers, they nearly all provide a DNS resolver) which will lookup from your DNS server, which will only resolve addresses you tell it to.
Then this needs to be a 100% private DNS server which won't resolve anything public.

As the dns server cannot tell if my query to somehost.somedomain.com is a genuine dns query or has hidden message embedded in either the query itself or the payload returned. This is very hard covert channel to block. You simply cannot do it while maintaining ability for the public services to work.

This will break things and most nothing public will work, including most apps.
All traffic goes through a router anyway (by necessity, this isn't additional hardware) which can prevent access except to an allow list of known ip addresses for services, that allow list of known ip addresses can be provided by your own DNS which can be restricted to only lookup allowed services.
Yes, but this pretty much prevents using anything modern like social media or youtube or similar with hundreds of POPs and CDNs and locations all over the globe.

Also the this IP whitelist will need to update real time, and with things like AWS route 53 even this will be not enough, as it can literally change on the fly per request.
Its an option for WhatsApp, it has DNS addresses which you're controlling look up to and that can either drive the allow list or you can fixate which ips are returned.
Its absolutely is not an option for Whatsapp. Its end to end encrypted - if you allow it, then you have zero aka no control what goes inside.

Bottom line is, if you allow any access to internet, you cannot control nor block anything 100%. You can try, but it will never cover everything.

Airgapping is only way to be sure, and even then you might have countless "interesting" possible covert channels, like hidden messages inside gribs / video files / social media post tags / ais destination or eta field etc. You would need to basically control everything.
 

JonRowe

Super Anarchist
2,024
1,168
Offshore.
Then this needs to be a 100% private DNS server which won't resolve anything public.

As the dns server cannot tell if my query to somehost.somedomain.com is a genuine dns query or has hidden message embedded in either the query itself or the payload returned. This is very hard covert channel to block. You simply cannot do it while maintaining ability for the public services to work.

This will break things and most nothing public will work, including most apps.

Thats the point, there are no public services on this hypothetical network. DNS is a distributed system that is designed to work with partial or complete indexes, corporate networks often work in this fashion where the internal DNS server provides routes for internal traffic and then delegates for outside addresses, in this scenario you just wouldn't delegate to another DNS but cache anything you want, then it doesn't matter if the client sends an invalid query, it'll just error as not being an address you wish to resolve.

Yes, but this pretty much prevents using anything modern like social media or youtube or similar with hundreds of POPs and CDNs and locations all over the globe.

Also the this IP whitelist will need to update real time, and with things like AWS route 53 even this will be not enough, as it can literally change on the fly per request.

Yes but this is easy to automate based on your DNS resolver.

Its absolutely is not an option for Whatsapp. Its end to end encrypted - if you allow it, then you have zero aka no control what goes inside.

You misunderstand my point, of course you can't read whats inside, you are just allowing access to it.

Bottom line is, if you allow any access to internet, you cannot control nor block anything 100%. You can try, but it will never cover everything.

Thats my point, your not allowing access to the internet, but essentially a VLAN.
 

noaano

Anarchist
722
363
in this scenario you just wouldn't delegate to another DNS but cache anything you want, then it doesn't matter if the client sends an invalid query, it'll just error as not being an address you wish to resolve.
Then you won't be able to use any public services, really. Why then dns at all - why not just hard coded host files?
You misunderstand my point, of course you can't read whats inside, you are just allowing access to it.
If you allow access to Whatsapp, you essentially allow access to everything, as it can transfer files of any content.
Thats my point, your not allowing access to the internet, but essentially a VLAN.
Yes, thats what I said by airgapping it.

But once you allow any public services, its a lost battle if you cannot control every piece of gear connecting into it with an iron fist policy.
 

climenuts

Anarchist
819
396
PNW
@Herman I'm not sure the 105% Windspeed Scaling is the correct adjustment. My understanding is that boats normalize windspeed readings and polars to 10m windspeeds to match forecasts and so crew have a consistent 'feel' on various boats. Stan Honey talked about crews losing confidence in instruments if they're not calibrated/corrected to 10m, especially with tall masts, because their senses and the instruments don't line up.
 

Schakel

Dayboat sailor
How do you get to Cape Town in these conditions?
My bets are on 11 th hour racing.
Ocean race 8- 2.jpg
 

damien

New member
38
136
Yes nice one :) (but short), they have a patch on the main sail no ? That can be seen at then end 0:59 , that was reported ?
Yes, they made a hole during first leg, the repair was recorded in a video you can see. They don't change anything in Mindelo...
 

damien

New member
38
136
How do you get to Cape Town in these conditions?
My bets are on 11 th hour racing.
View attachment 573410
Tonight's routing...
Situation 17z : the 3 leaders have been taken over by the cold front yesterday and gybe SE in westerlies. They are going south-east, will gybe at 23z if they follow GFS, 6z tomorrow if they follow ECMWF...
None of them will have to cross the ice exclusion zone.
the 10/02 at 0z they will be slowed by a HP ridge from Santa Helena HP. Following boats will get closer to the leaders thanks to another cold front coming from another LP that will push the HP ridge.
This CF will go with the boats to Cape Town. ETA 0830z the 12/02. You can see on the routing Guyot will cut his 500 milles late to just a few milles...

On the pictures : Black : GFS routing&wind, red, ECMWF routing&wind. Wind 110%. Polar : imoca_foil 105% downwind. Software : qtVlM
Pic 1 : satellite picture with current condition
Pic 2 : situation the 10/02 0z CF approaching
Pic 3 : situation the 11/02 0z
Pic 4 : situation the 12/02 0z . wind + rain

Since the doldrums, I found ECMWF has been more reliable that GFS for route planning, boats have often choose the ECMWF routing... Guyot East position was favoured by GFS that predicted a smaller HP when boats were there.

15z.png


10-02.png


11-02.png


12-02.png
 

dg_sailingfan

Super Anarchist
3,578
989
Augsburg
@Schakel
My bet is now on Team Malizia to win this if they have figured out their light wind set up.
Malizia have done a masterful job positioning themselves in between 11th Hour Racing Team and the Finish Line.

Looks like 11th Hour have to jibe soon to avoid the Antarctic Ice Exclusion Zone.
 

giegs

Super Anarchist
1,169
671
Does anyone know how loud (dB) it is on an IMOCA in those conditions? Some damage seems very likely going those speeds for that long, even with protection being worn for the most part.
 


Latest posts





Top