News for hackers. Stuff that matters.

pjf

pjf on Hacker News

Re:Ask HN: What are you working on? (June 2026) on Monday June 15, 2026 @04:20AM (#48538195)
I'm pushing the https://bgpipe.org/ project, bringing one of the first BGP ASPA route path validators to the open source world - see:

- https://bgpipe.org/stages/aspa/

- https://www.ripe.net/manage-ips-and-asns/resource-management...

Re:Revocation of X.509 Certificates on Monday April 27, 2026 @09:59AM (#47921685)
There are situations [1] where you could reliably BGP-hijack the IP prefix of the target domain authoritative nameserver, and obtain your own domain-validated cert for the target (by effectively controlling the zone file contents). And yeah, CAs do have their BGP protections, but still there's at least partial assumption BGP is secure enough to run DNS-based validation for new SSL certs, in our world where DNSSEC is still rare.

  [1] https://www.ietf.org/proceedings/104/slides/slides-104-maprg-dns-observatory-monitoring-global-dns-for-performance-and-security-pawel-foremski-and-oliver-gasser-00.pdf (see slide 15; yeah, it's already a bit old, yet still the case from my practice)
Re:Revocation of X.509 Certificates on Monday April 27, 2026 @06:48AM (#47919933)
On the other front (Chrome), their crlset-tools [1] just fetched me 64k (~1.1MiB) of revoked certs just fine, contrary to the article (quote: "After retrieving and running this tool, I was surprised to see a total of 1,081 revoked certificate serial numbers in this list. This seems oddly low.")

[1] https://github.com/agl/crlset-tools

Re:Revocation of X.509 Certificates on Monday April 27, 2026 @06:33AM (#47919843)
Good that at least BGP is secure.
Re:IPv6 Traffic Crosses the 50% Mark for the First Time on Thursday April 16, 2026 @05:42AM (#47790799)
NB: this is not "IPv6 traffic crosses the 50% mark" but "availability of IPv6 connectivity among Google users", which is a very important difference. This means roughly half of Google users have IPv6 capability, which does not 1:1 correspond how much traffic is actually transferred over IPv6, which is what this submission says in the title.
Re:How far can you go with IX Route Servers only? on Monday March 16, 2026 @05:21AM (#47396717)
great post! key points for me:

1. 100 IXes alone would get 56% IPv4 and 61% IPv6 prefixes, but ~14% reachability

2. little uniqueness between exchanges: not many new prefixes after the top 5

3. for outbound-heavy networks IXes are great, but to attract traffic they are not (edit: applies to automatic peering via route servers)

Re:The Day the Telnet Died on Wednesday February 11, 2026 @08:57AM (#46975007)
Kind of "funny" affected service is BGP RouteViews CLI access, still running over telnet: https://archive.routeviews.org/ (scroll to bottom of the page)

Isn't this one of the remaining, "legit" uses of the Telnet protocol on TCP/23 port over the public Internet?

Show HN: Bgpipe – pipe live BGP sessions through Python, add RPKI, etc.

Posted by pjf on Tuesday February 10, 2026 @10:49AM
from the show-hn dept.

https://bgpipe.org/

bgpipe sits between BGP routers as a transparent proxy. It can work as a firewall for the Internet control plane. You build a pipeline of composable stages - connect, listen, grep, exec, rpki, write - and BGP messages flow through them, optionally being filtered, modified, or logged.A few things you can do: # Monitor global BGP for your prefix in real-time (via RIPE RIS Live) bgpipe -g --...

( Read More... | no comments | 2 points | on HN )
Re:BGP Network Browser on Saturday January 17, 2026 @02:38PM (#46661302)
One reason is there already was exabgp, written in Python, which in my experience is slow and resource hungry. Golang is much faster, easily portable, and produces static binaries (easy to deploy).

Another thing is bgpipe speaks JSON to background (or even remote) packet processors, so basically you can use whatever language you want with it to drive your BGP routers.

Re:BGP Network Browser on Friday January 16, 2026 @04:18AM (#46644613)
I'd advise to first compare with:

- https://bgp.tools/ - https://bgproutes.io/ - https://bgp.he.net/ - https://radar.qrator.net/ - https://github.com/nttgin/BGPalerter

...all of which are (usually) free. IMHO you should have a competing product + money strategy before you continue. Many people have tried (and failed) to make money off BGP.

BTW, author of https://bgpipe.org/ here, an open-source BGP data tool

Re:Ask HN: What Are You Working On? (Nov 2025) on Sunday November 09, 2025 @06:00PM (#45870106)
https://bgpipe.org/

I'm working on a man in the middle proxy for BGP, which can fix and inspect routing sessions on the fly. Like a firewall for the BGP control plane.

Re:Google 8.8.8.8 is getting 27M ping requests per second on Wednesday August 13, 2025 @08:52AM (#44887838)
...prepare your pagers for an April 1st "experiment"

Older »