tonyb

This doesn't surprise me. Most providers that are deploying DOCSIS 3.1 today are only doing OFDM in the downstream and the upstream is still doing ATDMA (same as DOCSIS 3.0). I'm sure there are some but I don't know of anyone doing 3.1 in the upstream yet.

If they did upgrade all their actives then 3.1 upstream is likely in the works. DOCSIS has some pretty amazing diagnostics and troubleshooting - I can look at a modem and say "approximately 71 ft from the modem there is a break in the cable causing an RF impairment" or "These 14 modems in the same neighborhood show the same impairment - there is likely a fault at this specific segment of cable". DOCSIS 3.1 expands on that even more and as more 3.1 CPEs get deployed operators are able to leverage that additional data to get the plant ready for 3.1 upstreams. OFDM frequencies are also not backwards compatible with 3.0 CPEs but a 3.1 CPE can bond both types of channels, so as the ratio of 3.1 CPEs increases that allows operators to shift more frequencies from legacy modulation to newer 3.1 modulation.

Because of the equipment out in the plant.

There are passive devices out in the field that split the upstream and downstream (such as directional couplers). Passive devices are favored over active devices whenever possible because they are much less likely to fail, are less expensive, and require less maintenance.

Yikes! I mostly work with small providers that don't have the same resources as the big guys so I'm dealing with networks that are Node + 7 or more actives (vs the N+0 or N+1 the big guys do now) and anything about about 200 modems is when we start planning for node splits.

I do quite a bit of DOCSIS consulting.

There are both technical and business reasons for the gap between upstream and downstream speeds

There are a few technical reasons. There is less upstream frequency available in the upstream. 42 MHz is the standard upstream/downstream split, 85 MHz is a midsplit, 200 MHz is a high split, and the downstream goes up to 1Ghz or even 1.2Ghz. The upstream modulation runs at 64 QAM (~27Mbs) and downstream modulation runs at 256 QAM (~38 Mbps). The upstream is also more sustainable to interference and impairments. So the technology is inherently imbalanced.

From a business prospective it is very difficult to cost justify. Moving the upstream/downstream split and/or upgrading to DOCSIS 3.1 is very expensive. The reality is that the typical customer use very little upstream bandwidth. It isn't uncommon for me to see a node with 24 or 32 downstream channels at 80% usage and 4 upstream channels are at 25% utilization or less. We see a downstream to upstream usage ratio of about 15:1. If you move the US/DS split that means you are taking away from available downstream frequency which means less DS data bandwidth or fewer video channels. It's hard to make a business case to invest in increasing upstream bandwidth when the data says people aren't going to use it.

Newer technology like DOCSIS 3.1, Docsis FDX, Remote PHY and modern plant designs like N+0 or N+1 (which means fewer customers per node) will bring higher upstream bandwidth, but it will be awhile before we see anything close to symmetrical speeds.

I have the latest version of the app (on iOS) installed and this literally just happened to me. I run into it nearly every time I open the app.

I also see if it the app is running in the background and I switch back over to IG. I can be in the middle of my feed and scrolling and after a few seconds it refreshes and I lose my spot.

Fiber to the home/GPON is also a shared medium. One OLT (the fiber device in the headend) port generally goes out to a splitter in the field that then goes to 128,64,or 32 customers which has about ~2.5 gbps of downstream speed that is probably also shared with the video service. That is generally more capacity than DOCSIS but it isn't a fiber straight from the customer house back to the provider network.

Modern DOCSIS networks are much more capable than the linked diagram. The general guideline is that your top speed package shouldn't be any more than half of the node capacity (which ends up being similar to GPON that often does a 1gbps service on a shared ~2.5gbps network). The video portion of a HFC network also doesn't share the bandwidth that has been assigned to Data.

The diagram shows a node of 500-2000 homes - that is a HUGE number, I've worked on networks with nodes much larger than they should be and about 250 is the biggest node. ~100 customers per node is more common and in newer or upgraded HFC networks the goal is normally N+1 or N+0 (Node plus one active device or zero active devices - the linked diagram is N+10) those numbers get down to the 32-64 customers/node range.

I do work on DOCSIS networks for small providers but some of the tools the big guys use to monitor the RF quality is pretty amazing. They are able to read the RF Spectrum of every modem in the network and find common impairments in the cable plant and they can also assign individual modems different modulation profiles, so if your inside wiring and drop cable are capable of it your modem gets a higher modulation profile (and higher speed) than your neighbors that have crappy radio shack cable (the inside wiring has a huge impact on the signal quality). Traditionally you would have to set the service to work for the lowest common denominator but the emerging technologies are changing that. That doesn't necessary mean the big guys don't have capacity issues in other places (example: Netflix peering) but there is quite a bit of work and technology behind the last mile delivery.

You also can't ignore the business aspects - there is significant capital investment in upgrading any last mile network. I can take a group of 200 customers at 50mbps and upgrade them to 200mbps and the overall traffic pattern doesn't hardly change at all. That makes it hard for operators to justify to shareholders why spending hundreds of thousands or millions of dollars to go from 500mbps to 1gbsp is a good investment.

This is spot on. I do quite a bit of DOCSIS engineering work and this is a very good explanation.

It is going to vary quite a bit depending on your MSO and location but the "neighborhood" in modern DOCSIS deployments is getting smaller and smaller with Remote-PHY and N+1/N+0 deployments. What was traditionally 200+ customers on a node is shrinking down to much smaller numbers (dozens vs hundreds).

One guideline that is often thrown around is that the node will have at least twice the bandwidth of the highest speed tier and capacity is often added in excess of that based on usage and node size. You can also get fancy with dedicating channels to specic packages, so some of that bandwidth might only be "shared" with other customers on the same tier service as you.

As a counterpoint, yet completely anecdotal, point of view, I've had none of the issues you describe.

Once I install a Z-wave light switch and add it to my hub (a very simple process) there is virtually no maintenance. I rarely use the phone app to control things but I reliably get push notifications for things I want to know about (forgot to lock the front door, garage door being opened unexpected, door unlocked by specific people, etc.).

Most of my interaction happens via Alex and it basically just works.

I used to do sysadmin work as a web hosting company and security nightmare is exactly the phrase I think of when I think of WordPress.

Many mom and pop type businesses find the lowest cost web designer they can find to build them a WordPress site then get upset with the hosting company when "the server gets hacked" and their site is redirecting to a malicious site.

WordPress is certainly a powerful platform but the fact that it is so easy for someone to get started is also a weakness because those people don't understand it isn't just set it and forget it.

There is a very big factor that the article missed - license fees.

A good chuck of that fee is goes to licensing. The guide software, guide data, DVR, VOD, etc. often have per-box licensing fees the provider has to pay.

The $250 also seams low to me. I’ve seen numbers in the $600-$900 range. Cable STBs are also much more expensive than IPTV devices because they have tunners, upstream modulators, MOCA (for whole home DVR), switched digital video, etc. vs a IPTV box that has an Ethernet port and basically just decodes mpeg4 multicast streams. The cost of STBs is one of the reasons MSOs like the idea of network based DVR.

It will show you everything coming out of the switch port but only traffic to/from the connected device will come out the switch port.

You have to use ARP poisoning or some other trick to get other network devices to send ethernet frames to your mac address in order for the switch to forward them out your port.

Is a disk image of one of these available anywhere?

I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server.

Plugging a device into your network doesn't make it magically see all the traffic. It would have to be doing ARP spoofing, DHCP hijacking, or hacking the router config/firmware. Is it possible that it is doing some or all of those things -- sure. But why? That could all be done via a malicious client executable that would give you access to the network and much more and is much more discrete than a physical box, so why would someone go through the trouble of shipping out a box + paying the recipient? The more simple explanation is the sender of the device is doing nefarious actions on the internet and needs a bunch of IPs for cheap so when they get blocked they can just move on to the next IP.

Would I put one of these on my home network - hell no. But if one of my friends tells me they had one plugged into their network I wouldn't immediately assume that their entire digital life was compromised. I would tell them to unplug it though.

Going "cash-less" is a growing trend in the restaurant world. I know several restaurant owners that are moving that direction for the reasons you listed. Time is one of the biggest ones, you have to have someone (normally a manager) dedicated to cash management before opening and after closing.

It varies greatly depending on the local jurisdiction but the two most common factors for if you need a health permit are - Are you charging for the food? or Is the size of the portion over a specific size (commonly 2oz).

I have a line of BBQ rubs and sauces. In my area, if I got to a retailer and hand out free samples of product (for example BBQ sauce on pulled pork) then there is no health permit required. However if I sell BBQ sandwiches then a health department permit (and the associated inspections) are required.

In some areas I would be able to sell samples without a permit as long as they were 2oz or less. That is how many chili or "people's choice" type competitions work.

This is quite an over simplification but a large amount of the filtering, if placed close to the client, is a single line of config.

"ip verify unicast source reachable-via rx" in the Cisco world.

Those people don't share your IP address. That traffic is separate from customer traffic and encapsulated into a GRE tunnel back to Comcast.

As someone that has a few commercially produced products (BBQ Rubs and Sauces) I never cease to be amazed by how much work the packaging piece of the puzzle is.

I easily spend as much time worrying about bottle, closures, labels, etc. as I do about the actual product.

Many cable TV providers put leakage detection equipment on their trucks. RF leaks are also a point of noise ingress on the cable plant so they want to fix it to improve the cable plant.

I think this all that extra stuff is a standard 3D Secure transaction (Verified by Visa/Mastercard SecureCard). Apple has replaced the complicated multi-step authentication process with TouchID

I don't think that is quite correct. There is per-transaction stuff going on but it isn't being tokenized for every transaction.

The token is stored in the secure element but is generated by the Token Service Provider (for example Visa Token Service).

After reading the EVM token spec linked in the post[1] and the developer guide I think I'm able to answer my own question.

The card is only tokenized once (or at least not per-transaction). For in-app purchases it is using 3-D Secure and for NFC is it using EMV, both of which provide some per-transaction security. Unlike a standard card the token will only work with 3-D Secure or EMV. For example a standard Chip&Pin card could still have it's mag-strip data extracted by a malicious POS system and used at a merchant that only uses magstripe terminals. With Apple Pay (and any other network token based system) a copied token would be worthless because it can't be used at a magstripe terminal.

Basically the phone is acting both as an automated 3-D secure checkout (it is processed by the processors just like 3-D secure but the authentication process is automated) and as a contactless EMV card without the downside of also having a magstrip with the PAN on it.

[1]http://www.emvco.com/specifications.aspx?id=263

The part I'm not quite following is when the tokenization takes place.

If it takes place per transaction then the PAN must be saved in the phone somewhere and the phone would have to be online to do the tokenization in real-time.

If it is a one-time tokenization that happens when the card is added isn't that token just as valulable as the PAN since the token can be used across merchants? Maybe the 3-D secure piece of the puzzle protects the token but I think this still means the phone has to be on-line to use the NFC payment feature.

"Forward Deployed Engineer". It is a title Palantir uses for software engineers that are customer facing.

It is a small world. I was the president of The Ohio State paintball team for a few years. I also helped the NCPA with a website refresh back in the day. I would have never though that topic would come up on HN.

I spent more money on paintball in college than I care to think about. I has one of the first "new" shockers. It was one of the first red ones, the serial number was below #50 if I remember correctly.

And the two are also not mutually exclusive. You can have an OpenConnect appliance that is populated via peering. Someone like Verizon/Comcast/etc could add OpenConnect appliances and then peer with a single 10Gbps link vs the multiple 10Gpbs transit links they are using now.

I have two business and both have legal protection. I have ownership in our IT Services company (S-Corp) and have an LLC for a Food Truck/BBQ business. (Although our CPA has advised us we may want to convert the LLC to a S-Corp).

Unless it is just the occasional side project there isn't much reason to NOT form some sort of legal entity to protect yourself.

How is this "set it up and never fuss" if the ice has to be replaced every 35 days? I would think delivering a small propane tank would be much easier than delivering ice.

I wonder why they don't use propane powered refrigerators. They use very little propane and a single 20 lb tank would last much longer than 35 days. I'm guessing it would be smaller and lighter than these too.

With DOCSIS cable modems only the provider can update the firmware. And end user doesn't have the ability to update the firmware, even if they own the modem. That is part of the DOCSIS standard.

This doesn't help you at all.

The provider is able to change the settings through two primary methods.

1. DOCSIS configuration file - this is the file your modem downloads when it comes online and includes settings like your speeds (Upstream/Downstream service flows) and it also includes the SNMP settings (used for #2).

2. SNMP - The MSO can also remotely monitor and change your modem via SNMP. There is a large number of DOCSIS MIBs that every cable modem must support in order to get certified and there are also vendor specific MIBs that a modems manufacture will add to support specific features of that modem.

Without SNMP it would be very difficult to maintain a cable network. Other types of access networks have similar features.

"Who really thought they'd go to US service and hardware companies and ask them to implement backdoors"

To this point has there been any evidence that a company has add in a "backdoor" at the request of the NSA?

The media keeps using the term "backdoor" when they talk about covert access but that doesn't mean that some company added a "NSA Access" feature to their product. It is possible (I would even say probable) that the NSA has exploited unknown vulnerabilities rather than used built in backdoors.

Covert access is only effective if it remains covert. If companies are building in these features then a lot more people know about it and it reduces the likely hood of staying covert.