Post by thread:Re[2]: [OT]: ISP-based whitelisting service?

Hi Shawn, Monday, June 26, 2006, 10:16:40 AM, you wrote: > On Monday 26 June 2006 14:12, Patrick Murphy wrote: >> One (remote?) possibility would be to look into becoming our own ISP, >> or a "virtual" ISP, but I know little about it. > i just googled for "Hutterite".. never heard of it before this.. I'm not suprised - our "religious cousins," the Amish, are much more well known. We differ from them in that we allow modern technology, and have a more communal lifestyle and we are few in number in comparison to the Amish. > yes, you could set up your own community gateway and set up your own filtering > rules on the gateway.. however, this would require some knowledge in > networking and firewall configuration.. Are you saying we could have Internet access through an ISP and the ISP would route all traffic through our gateway? If so, are there ISP's willing to work with us to do that? Another question for the list is whether we should do it ourselves, or hire someone to help us. > it's relatively inexpensive as you can just use any old computer as a > gateway.. install a special firewall linux distribution like > http://www.smoothwall.org/.. configure it to block everything except approved > sites.. > then, you'd just need to make sure that all community traffic flows through > this gateway.. Is this easy to accomplish? I'm googling [Internet "community gateway"] and have a lot of hits; the term appears to be used in several contexts. > cheers.. > with metta, > shawn tan. Thanks for your help! -- Best regards, Patrick Murphy James Valley Colony

Hi Alan, Monday, June 26, 2006, 10:35:49 AM, you wrote: >>it's relatively inexpensive as you can just use any old computer >>as a gateway.. install a special firewall linux distribution like > That was my thought as well. With a bit of web programming on it they could > even update the white and black lists themselves, and have a means of > sending updates around the other similar machines at the other communities, > possibly by email or some form of auto-update. This sounds good - but I'd have some learning to do. I still don't have the big picture yet - how do I get the colonies to access that gateway - and no other? I'll do some more searching. -- Best regards, Patrick Murphy James Valley Colony

Hi Shawn, Monday, June 26, 2006, 10:16:40 AM, you wrote: {Quote hidden}> yes, you could set up your own community gateway and set up your own filtering > rules on the gateway.. however, this would require some knowledge in > networking and firewall configuration.. > it's relatively inexpensive as you can just use any old computer as a > gateway.. install a special firewall linux distribution like > http://www.smoothwall.org/.. configure it to block everything except approved > sites.. > then, you'd just need to make sure that all community traffic flows through > this gateway.. Tim explained this setup to me offlist - thanks Tim! It does eliminate the need for a SonicWall or similar device - but it may be hard to find someone at each colony capable of setting it up. I'll look into it as well. I'm still, perhaps unrealistically, still hoping for an ISP-based solution. Since we are multi-family farms, we have young boys; some of them know far more about the computer than their parents, and because of them, the parents would prefer to have the Internet filtered before it arrives on the place. -- Best regards, Patrick Murphy James Valley Colony

Hi Gerhard, Monday, June 26, 2006, 11:51:18 AM, you wrote: <snip!> {Quote hidden}> Patrick, it sounds to me as if you should explain the geographical > situation (how many computers, how far away) better. It seems that some > here think of a local network connected to an ISP, which doesn't sound as > if this was your case. > Basically, it is the network connection that determines who can access > what. If you have only a wire to the local gateway (typical in a LAN), then > that's your only way to connect to the internet. Or if you have only a > wireless point-to-point connection to the location where the gateway sits, > then that's again your only way to connect to the internet. > But if, as you mentioned, every location has their own connection to a > satellite provider, things get a bit more complex, and you can't easily > enforce people to access the internet through a gateway of yours: they are > already connected to the internet through the satellite. (Of course you may > also buy a corporate style point-to-point satellite link and again route > all this traffic through your one gateway, but they probably are more > expensive than straight internet access.) > Gerhard The colonies are located in farming areas of Manitoba, and in farming areas of the Mid-Western US. Each colony may have a dairy, a hog barn, turkey and/or chicken barns and other farm buildings; some may be as far as a mile apart (and downwind, if possible :-)). Most colonies do not have networked computers, and only one or two would have Internet - the farm managers, usually. I just got a reply from a satellite ISP that said it would be possible to become a commercial VNO, or Virtual Network Operator. <http://www.idirect.net/vno.shtml> Her email, which I don't understand fully, states: {Quote hidden}> To establish the VNO (Virtual Network Operator): > > VNO package includes: > 1 Protocol Processor “PP” > 1 Network Management Server “NMS” > 1 RX/TX Line card > $nn,nnnn fee > > For a small additional fee they can purchase Co-Location space to > place a Policy router or other equipment needed to provide them the > content filtering or other routing or filtering they desire. I left out the fee, since she might not appreciate it being published. The satellite bandwith is with VSAT-Systems.com -- Best regards, Patrick Murphy James Valley Colony

Hi Mark, Monday, June 26, 2006, 11:59:57 AM, you wrote: > Is there any special reason to block or filter Internet access to people? > Are the users children? Yes, there may be children as users. Our local school board, for example, is asking to put Internet in our colony schools. And, as multi-family farms, we have young children who may be able to gain access to the Internet computer. The Hutterites are a Christian intentional communal group; they accept modern technology, but generally within certain limits. For example, most colonies do not allow televisions on the colony, except perhaps in the school, to watch educational videos; others, considered much more liberal, have few such restrictions, and televisions may be found openly in their homes. None of them, however are so liberal as to want their children to have unlimited access to the Internet; many would rather not have Internet at all. However, the farm managers have made it clear at a recent meeting, that a controlled Internet access solution needs to be considered, rather than no Internet. -- Best regards, Patrick Murphy James Valley Colony

Hi Robert, Monday, June 26, 2006, 1:55:41 PM, you wrote: > First, let me see if I understand the problem correctly: > 1) There are quite a few communities which want to be able to access the > internet in a controlled fashion. Yes. From 20 to perhaps 75+ communities right away, and possibly more. > 2) The local community leadership decides what the community should be able > to access. Yes. > 3) The desired white-list is community specific (although probably quite > similar from community to community) Yes. Some communities are also involved in manufacturing, and may not want to share some of their web sites with other communities who compete with them. > 4) There is some form of inter-community cooperation that would make a > 'global' solution appropriate. Yes. > 5) Each community will have its own physical connection to the internet, > probably through many different ISPs. Right now that is the case, with most colonies on a Dial-up plan or broadband. However, a desired solution would be one where one, or perhaps two ISP's (one for the US, one for Canada, if necessary) would provide pre-filtered Internet. As I wrote in response to Gehard's post, there is at least one ISP offering to provide us with possibly what we are looking for; I just got that email this afternoon. The second solution, should the first be unfeasible, is clearly shaping up to be what you are describing below. > -------------------------------- > If those are the parameters, then this is the solution I see: > 1) The connection to the local ISP is made through hardware only accessible > to the community leadership. Okay. > 2) A simple router be inserted between the community and the ISP connection. > 3) Disable any 'default' routes on the router and establish explicit routes > to the 'whitelist' sites only. > 4) Use remote administration from a central location to manage the routers. That might be something we would hire someone to manage. > 5) Have a standard 'white-list' default of routes that is sent to all the > routers. > 6) Allow each community to establish a private 'white-list' extension and > 'black-list' override using a web tool to the central location. Sounds good. > 7) This central location could also maintain SMTP and POP3 servers to manage > email for all the communities. This would allow virus detection/removal and > spam control to be done centrally. Sounds interesting. Steps four through seven could apply to an ISP-based solution as well. > Bob Ammerman > RAm Systems Thanks Bob! -- Best regards, Patrick Murphy James Valley Colony

On Mon, 2006-06-26 at 14:06 -0500, Patrick Murphy wrote: > Tim explained this setup to me offlist - thanks Tim! It does eliminate > the need for a SonicWall or similar device - but it may be hard to > find someone at each colony capable of setting it up. I'll look into > it as well. > > I'm still, perhaps unrealistically, still hoping for an ISP-based > solution. Since we are multi-family farms, we have young boys; some of > them know far more about the computer than their parents, and because > of them, the parents would prefer to have the Internet filtered before > it arrives on the place. How important is bandwidth? If sacrificing bandwidth is an "OK" solution, perhaps something like this is an option: Colony: Internet Connection -> router -> router with VPN client -> clients Base: Internet Connection -> VPN server -> Filter computer -> Internet Connection I hope this makes sense. Basically every colony doesn't get a connection to the internet, their VPN client connects to the "Base" VPN server. This VPN server could then block out whatever you'd like. The benefit is it's relatively plug and play for the colonies, you set up each box and mail it to them. They can set up their networks any way they want, wired or WiFi. Since the router with VPN is their only connection to the rest of the internet only physical access can bypass it (unless they manage to hack the VPN router, possible, but easy enough to secure). At the base you can use a computer to act as the VPN server, or just buy one. The whitelist filtering can then be done with a Linux or Windows box. Since it's the only point that goes to the rest of the internet it's the only point that needs configuring. You can also reconfigure it remotely if you wish. The bad side of this idea is the all the internet traffic from the colonies will come through the "Base's" internet connection. If you're dealing with just a few emails and web pages that's probably OK. If you're dealing with streaming video or thousands of clients, that won't be OK. Basically you are creating a pseudo ISP that the clients connect to through VPN. Costs shouldn't be too bad. The VPN client routers are getting pretty cheap (since they are in the consumer space now), VPN servers are a little more expensive, but you only need one. TTYL Good luck! TTYL

I am assuming that the expression "have the Internet filtered before it arrives on the place" is intended to ensure that even with physical access to the incoming wire from the ISP the young bucks cannot get to something they shouldn't. I believe the solution I outlined before can handle this, with the following simple notes: 1) Access from the router to the ISP requires knowledge of the ISP password, which would only be stored in the Router and unknown to anyone in the Colony. 2) Access to the router setup is protected by the router's own password, which would not be known by anyone at the Colony either. Thus to get to the internet you have to go through the router, and the router does all the filtering for you. The only way I can see to get around this is to get another account with the same ISP and use it on the same physical connection. Bob Ammerman RAm Systems

Hi Herbert, Monday, June 26, 2006, 8:53:09 PM, you wrote: {Quote hidden}> On Mon, 2006-06-26 at 21:47 -0300, Gerhard Fiedler wrote: >> Herbert Graf wrote: >> >> > Since the router with VPN is their only connection to the rest of the >> > internet only physical access can bypass it (unless they manage to hack >> > the VPN router, possible, but easy enough to secure). >> >> I think this may be a downside of this approach. Patrick talked about young >> boys with technical inclinations... I think it won't be long before one >> finds out how to bypass the VPN router and hook up a computer directly to >> the unfiltered internet on the WAN side of the router. Of course, if a >> password is needed, then this may work. > Obviously, physically securing the hardware is an issue, but I don't see > that as a big issue. That password barrier sould be a good deterrent. I'm a bit uncertain, however, what device would require a password - do modems themselves allow the requiring of passwords? It's been a while since I've tried it, but IIRC, I was able to connect my laptop directly to my broadband modem and surf the net. {Quote hidden}>> This is basically the same as the satellite operator offer, with the >> difference that with the satellite solution, there is no unfiltered >> internet at the individual locations. > But a benefit here is cost and ISP transparency. I'm a big believer in > never setting something up that limits you to a particular ISP. By using > a VPN solution and your own box you are ISP neutral, if they raise rates > you can go to their competition with little issue. Cost is a big benefit > as well since aside from the upfront cost (which isn't trivial, I > admit), there is only the cost of administration, but can be very cheap > since there's only one thing to configure. I like the idea of ISP transparency - some colonies can only get an expensive satellite connection, while others would be able to choose a less expensive connection. The tradeoff is, then, lower bandwidth vs. ISP transparency. -- Best regards, Patrick Murphy James Valley Colony

Hi Alan, Tuesday, June 27, 2006, 3:02:02 AM, you wrote: {Quote hidden}>>> That was my thought as well. With a bit of web programming on it they could >>> even update the white and black lists themselves, and have a means of >>> sending updates around the other similar machines at the other communities, >>> possibly by email or some form of auto-update. >> >> This sounds good - but I'd have some learning to do. I still don't >> have the big picture yet - how do I get the colonies to access that >> gateway - and no other? I'll do some more searching. > My thought was that each colony would have its own gateway - I think that is > going to be the only way you are going to get the filtering you are after, > just as each company has their own firewall. A firewall type arrangement is > effectively what you are setting up. > Then each gateway connects to a convenient ISP, be it satellite, cable or > dialup. You then arrange a convenient way of communicating your black and > white list changes between gateways. This could be as simple as an email > message to the gateway maintainers to say you have found a certain website > to be suitable or unsuitable, and they manually update their lists as > appropriate, to a fully fledged automatic update between gateways, although > this latter method could result in one community setting a site to the white > list, while another community sets the same site to the blacklist, and the > automatic update results in confusion. Okay, now I get it. Thanks for the description. The picture is falling into place. -- Best regards, Patrick Murphy James Valley Colony

Hi Bob, Tuesday, June 27, 2006, 11:04:14 AM, you wrote: >> Patrick Murphy wrote: >> >>> Hi everyone, >>> I have been asked to help come up with a "content-managed" Internet >>> solution for a few dozen Hutterite colonies in southern Manitoba, >>> Canada, and also for colonies in the midwestern USA; a total of >>> perhaps 50 to 75 colonies in North America. The Internet use would be >>> to have access to email and to a specific, limited list of sites. <snip!> {Quote hidden}> I believe that this can be done by writing a Perl script and running it > on an Apache server. The script > could restrict access to acceptable sites and email only. It will have > to be well-written to prevent bogging > down the server. > For those few users, a small server site, say in a home or church could > do the job, as long as a T1 was > available, with as few as two UNIX PCs. In essence, people would dialup > or access that server only, > and it would provide that service. But in my opinion, such a server > would do well financially, as the open > web is a cesspool of filth. > The reason I say this is that a few years ago, a small office complex > had its own servers & ISP, and it > totally rejected porn sites automatically for everyone in the office > complex, and I saw it work, down in > a Melbourne, FL suburb. > Carrying this further, there ARE ISP's that might perform this service > for you, creating, running and maintaining > the script, for an extra fee. Ask around, especially servers that are > managed by Perl programmers. > --Bob Okay, please pardon my slowness. Your first suggestion is setting up a server, and routing all the traffic through that server - much like Herbert's VPN server but using a Perl script rather than a VPN server? As to the second, if anyone has any contacts, I would appreciate them. I did respond off-list to Dave Lag regarding his contacts as well. I will try to google "Perl server ISP" and see what comes up. I have to go to a meeting, and won't be able to respond much more today, but I expect to be back tomorrow. -- Best regards, Patrick Murphy James Valley Colony

Hi Aaron, Tuesday, June 27, 2006, 10:33:47 AM, you wrote: {Quote hidden}> Patrick Murphy wrote: >>Hi everyone, >>I have been asked to help come up with a "content-managed" Internet >>solution for a few dozen Hutterite colonies in southern Manitoba, >>Canada, and also for colonies in the midwestern USA; a total of >>perhaps 50 to 75 colonies in North America. The Internet use would be >>to have access to email and to a specific, limited list of sites. >> >> > Patrick, > I read your posts and the subsequent follow-ups with great interest. > I have a backgroup with a group of Christain 'plain-people' that is also > seeking to understand how to deal with the internet. If you are > interested, I would like to discuss this in greater detail off-list. > Aaron You are welcome to contact me off-list; I'll gladly share what I can. Perhaps we can come up with or find a solution together; as Bob mentioned, there is a need for this type of arrangement, so perhaps someone has already come up with a suitable solution; or we can try setting up one of the already mentioned solutions. -- Best regards, Patrick Murphy James Valley Colony

On Tue, 2006-06-27 at 10:25 -0500, Patrick Murphy wrote: > > Obviously, physically securing the hardware is an issue, but I don't see > > that as a big issue. > > That password barrier sould be a good deterrent. As long as the password is set to something OTHER then the default, you wouldn't believe how many times I've found devices with the default password still set. > I'm a bit uncertain, > however, what device would require a password - do modems themselves > allow the requiring of passwords? It's been a while since I've tried > it, but IIRC, I was able to connect my laptop directly to my broadband > modem and surf the net. The password would be in the VPN box. The only connection you supply to the clients is a connection to the VPN box. The VPN box would be connected to the modem, and would be the only thing at the colony with a free connection to the internet, hence the need to physically secure it. The VPN box's configuration would have to be passworded. > I like the idea of ISP transparency - some colonies can only get an > expensive satellite connection, while others would be able to choose a > less expensive connection. > > The tradeoff is, then, lower bandwidth vs. ISP transparency. Absolutely. That said, if email and a few webpages are the only things the clients are using bandwidth shouldn't be much of an issue. TTYL

Hi Tim, Gerhard, Wednesday, June 28, 2006, 7:18:23 AM, you wrote: {Quote hidden}> Good advice. I have one site that uses a Direcway "Business Class" > connection. The throughput is horrible during certain times of the day > and there are only three users with email at the location. > Using a VPN connection from there to our main office for certain apps > is very slow. I believe the nature of the encryption algorithms used > to make the VPN secure really messes with the satellite equipments > ability to efficiently compress the data. > Tim > Gerhard Fiedler wrote: >> I'd advise to test anything satellite before committing to it. Satellite >> internet connections don't necessarily behave like other connections. >> You're not even allowed to open a VPN channel over some of them. Thanks for pointing this out! I'm supposed to talk to a satellite ISP wholesaler this morning, and I'll bring this up. -- Best regards, Patrick Murphy James Valley Colony

Hi Gerhard, Wednesday, June 28, 2006, 8:37:04 AM, you wrote: {Quote hidden}> Tim N9PUZ wrote: >> Using a VPN connection from there to our main office for certain apps >> is very slow. I believe the nature of the encryption algorithms used >> to make the VPN secure really messes with the satellite equipments >> ability to efficiently compress the data. > Hadn't thought of that one. Sounds plausible. > There's also the fact that many apps you run over VPN are designed for a > LAN environment with very low latency. So they use many short data > exchanges in a row -- quick on a LAN, but deadly slow on a satellite link > with its 700+ ms latency. You can try that with Windows Explorer: barely > workable over a VPN link between standard broadband locations in the US, > almost not workable over a VPN link between standard broadband locations in > the US and Brazil, and not workable if there's a satellite link it between. > Gerhard I just got off the phone with a Skycasters rep., a Satellite ISP. She told me their latency is 1/3 of the satellite industry average, and that VPN's, and VoIP are well supported. I didn't ask for the latency. I don't see how VoIP would work well with 700+ ms latency, which, IIRC, I've read is the industry standard for satellite transmission. -- Best regards, Patrick Murphy James Valley Colony

Hi, Wednesday, June 28, 2006, 9:02:23 PM, you wrote: {Quote hidden}> On Jun 28, 2006, at 10:19 AM, Robert Ammerman wrote: >> 1) At each colony have the LINKSYS router running LINUX >> with the following pieces in it... > I'll be interested in hearing whether the linux software > replacements for the linksys boxes include the sorts of > filtering capabilities that you're looking for. Open source > software authors tend to support a political agenda that > doesn't approve of anything that smells like censorship. > (unless of course it's censorship of spam!) > BillW I just got a phone call from Galaxy Broadband, a Canadian Satellite ISP, and they are recommending SnapVPN. I'm not sure I understand it - I've sent them an email asking for clarification, but the list of content filtering features seems appropriate: <http://www.clearpathnet.com/snap/content_filtering.asp> Standard features include: * White List filtering: web access is restricted to specific URL addresses * Black List filtering: free web surfing access, except to specific URL addresses Productivity enhancements include: * Usage limits by the time of day (example: during regular business hours) * Usage limits by how much time per day (example: limit personal surfing to 1 hour per day) * Wildcard key word blocking (example: block all sites with "sex" in the address) * Flexibility to establish rules at individual user level, or by user group (example: managers provided wider access) * Block downloads by file type (example: exclude .MP3 downloads) And their overall feature set includes: * Antivirus * Firewall Protection * Intrusion Prevention * Content Filtering * VPN * Remote Access VPN * Network Management * Network Reporting * Device Monitoring <http://www.clearpathnetworks.com/SNAPVPN/> They also offer a "Network-based" solution. <http://www.clearpathnet.com/services/vpn/default.asp> -- Best regards, Patrick Murphy James Valley Colony

Hi Gerhard, Wednesday, June 28, 2006, 7:54:49 PM, you wrote: {Quote hidden}> Patrick Murphy wrote: >> I just got off the phone with a Skycasters rep., a Satellite ISP. She >> told me their latency is 1/3 of the satellite industry average, > Now that is strange :) See, the satellite latency is limited by the time > the signal needs to get to the satellite and back. Since you want to be > able to point an antenna to the satellite, it has to be a stationary > satellite. The distance of a stationary satellite is pretty much fixed. So > the only way she can claim a shorter latency is when she compares a > satellite that's straight over your head with one that's just a bit above > the horizon... Don't know where their satellites are, and I don't know > where the "industry average" satellites are. But "1/3 of the industry > average" sounds like marketing speak :) Ask for latency in milliseconds. Okay, I will. She did say something about proprietary compression algorithms, but I'll ask her about milliseconds, next time. Lower latency should result in faster uploading and downloading, if a large file was being sent, right? So I could ask each ISP how long it should take to send, say a 100 MB file? >> and that VPN's, and VoIP are well supported. > Ask which VPN protocol if you're interested in VPN at all. A common one is > PPTP (Microsoft), another common one is IPSec (not sure who came up with > this, but it seems wider supported). Which one to use depends mostly on the > router equipment that you're planning on using. I see. One more important consideration added to my list. >> I don't see how VoIP would work well with 700+ ms latency, > Not well, but possible. Probably not very attractive in the USA, with the > possibilities you have through standard POTS lines. This can be different > in other locations where sometime international phone service is much more > expensive. > Gerhard Oh, okay. Being satellite-based, they do think globally. -- Best regards, Patrick Murphy James Valley Colony

Hi Tim, Wednesday, June 28, 2006, 1:29:42 PM, you wrote: {Quote hidden}> Patrick Murphy wrote: >> I just got off the phone with a Skycasters rep., a Satellite ISP. She >> told me their latency is 1/3 of the satellite industry average, and >> that VPN's, and VoIP are well supported. I didn't ask for the latency. >> I don't see how VoIP would work well with 700+ ms latency, which, >> IIRC, I've read is the industry standard for satellite transmission. > Ask a LOT of questions. I notice on one web page that mentions them > that for some of their solutions they are re-selling Direcway > services. Their VSAT service sounds interesting though. I want to mention your negative experience with Direcway to them. > Do you have a budget in mind for monthly operating expenses? > Tim Assuming some sort of broadband solution, I hope to have monthly operating expenses of no more than $100, unless the solution satisfactorily supports VoIP, which should then justify the costs of a higher speed connection. However, I hesitate to consider VoIP via satellite, as the latency must make for noticeable, and for some, unacceptable delays. I'll ask the sales rep. to call me via VoIP for a demonstration. If no other connection is available besides dial-up, then for those communities, higher monthly fees should be expected. I'm guessing, it would depend on the solution - if we could get, say 75 colonies to form a virtual, satellite ISP, Skycasters tells me the cost would be $160 a month each. But that would depend on the bandwidth necessary - perhaps we could feasibly go much slower - that quote is based on a symmetric :-) connection, sharing one Meg up and one Meg down. One tower-based ISP is already offering the colonies in Alberta VoIP, whitelisted Internet, and email for $400 a month. I estimate that colonies pay between $300 to $500+ a month for long distance telephone service, so they are getting some colonies to sign up, and such a solution is attractive to us. However, as I see it, the land line, long distance market is rapidly changing. We are paying 4.5 cents a minute to call within Canada, but the competition (i.e. http://www.telehop.com) is offering as low as 3 cents (and only a flat $10 fee for residential!), so how much we should pay monthly for a land-based, broadband Internet connection should take this into account. Another way to consider costs is to look at what some colonies are already paying for Internet access and the use of a SonicWall or FortiGate device. I assume broadband access at at least $40 a month, and the maintenance fee for those devices at around the same amount, but I could be wrong. Those already set up with such devices would likely not want to pay more to switch. If we were to go to a Dial-Up connection solution, then, of course, the monthly expenses should be much lower. I'm still interested this possibility, but haven't gotten very far yet. It may be that more than one solution may be necessary - some requiring broadband, and others just email. -- Best regards, Patrick Murphy James Valley Colony

Hi Tim, Wednesday, June 28, 2006, 1:23:06 PM, you wrote: > Patrick Murphy wrote: >> If I use a computer running Linux, that should be a good deterrent by >> itself, as there are very few in the colonies that have any experience >> with Linux. > Never under estimate the ability of a bright, inquisitive teenager to > learn new things! That's a good point. A fingerprint scanner was suggested to me as a way to handle passwords. It is not that much trouble to duplicate a fingerprint to bypass the scanner. The web has a number of easy to find articles describing the process. If they can make their own pcb's as one site suggested: digitize a fingerprint, invert it with software, etch it onto a copper board, mix up some gelatin and pour it over the etched board, and just like that, an edible, gelatin fingerprint capable of bypassing a scanner. An article I read said those implementing fingerprint scanners should also incorporate a written password; should someone obtain your fingerprint, at least you can change the password. > I would not overlook Linux in general either. If your organization > does not absolutely require a product that runs on a Microsoft or Mac > platform a Linux distribution that puts Open Office, Firefox (Web), > and Thunderbird (Email) on the desktop of a modest machine could save > you substantial money even if you opt for a distribution of Linux that > lets you purchase some outside support if required. > Tim I'd like to do more with Linux at the colonies, actually. As a start, I've been installing Open Office on our Windows machines. It works well enough for us, and the cost savings adds up fast. Another way I've been saving money is by buying older, Windows 2000 machines. A 933Mhz, 20 GIG, 128MB RAM box is $125 CAD, without the hard drive, its $60 CAD. -- Best regards, Patrick Murphy James Valley Colony

Latency: How long it takes a tiny packet to get from one end of a connection to the other. Bandwidth: How many bytes per second you can push through a connection. Compression can improve bandwidth, it can do nothing for latency. High latency can really kill you when what you are doing requires a lot of round trips between you and the other end. Unfortuanately this can happen with a lot of web pages. If you think about it, a GEOSYNC satallite is 23,000 miles above the equator. Depending on your latitude, and the relative longitude of the "bird", you are probably somewhere around 30,000 miles from it. At the speed of light (186,000 miles per second) a simple round trip to the satellite is about 320 ms. Since it takes two such roundtrips (one from you to the satellite and one from the satellite to the ground station) you are looking at a round trip latency of 600+ ms before you take into account any latency in the ground based equipment. Bob Ammerman

On Thu, 2006-06-29 at 09:24 -0500, Patrick Murphy wrote: > Okay, I will. She did say something about proprietary compression > algorithms, but I'll ask her about milliseconds, next time. Lower > latency should result in faster uploading and downloading, if a large > file was being sent, right? So I could ask each ISP how long it should > take to send, say a 100 MB file? Actually no, latency by itself has little impact on how long large files take to transfer. Latency affects the "feel" of the internet to your user, a long latency will make even a high bandwidth connection feel like it's crawling. It will also slow down small file transfers in quick succession, something like opening a web page with lots of small thumbnails will take much longer then with a connection with a short latency. Downloading many emails at once or articles from a newsgroup is another area where latency can have a profound impact. Other areas where latency is critical is online gaming (I know, not an issue for you) and VOIP (where a high latecy can make a VOIP call unbearable due to the delay in responses from the other end, and possible echos due to the echo cancelers not being able to cope). TTYL

> -----Original Message----- > From: spam_OUTpiclist-bouncesTakeThisOuTmit.edu On Behalf Of Patrick Murphy > Sent: Thursday, June 29, 2006 12:22 PM > > Assuming some sort of broadband solution, I hope to have monthly > operating expenses of no more than $100, unless the solution > satisfactorily supports VoIP, which should then justify the costs of a > higher speed connection. However, I hesitate to consider VoIP via > satellite, as the latency must make for noticeable, and for some, > unacceptable delays. I'll ask the sales rep. to call me via VoIP for a At the large latency of satellite broadband I think everyone will find VoIP performance unacceptable. IME, latency over 300ms in phone calls is noticed by just about everyone. Paul <snip> > -- > Best regards, > Patrick Murphy

On Jun 29, 2006, at 7:24 AM, Patrick Murphy wrote: > ower latency should result in faster uploading and downloading, > if a large file was being sent, right? No, it SHOULDN'T. However, given the sorry state of TCP implementations in user end system (esp windows), it probably will. (longer explanation: TCP uses a sliding window algorithm that should make transfer rate independent of delay, as long as bandiwidth*RTDelay < windowsize. TCP normally handles windows of 64kbytes, and adds the "window scaling" option to get larger windows. But much PC software defaults to 4kbyte windows, and I hear that the microsoft implementation of window scaling doesn't work much...) (high latency will probably make on-line gaming particularly painful. Perhaps that would be a feature in some cases?) BillW

At 06:53 PM 6/29/2006 -0400, you wrote: >Re: VOIP and Satellite: > > >My daughter is on a mission trip in China this summer and calls us via VOIP >from her computer to our POTS phone. I assume the link is goinig over a >satellite (even if it isn't its still about 12,000 miles+). The latency is >very noticable, and irritating, but we are more than willing to put up with >it to talk with her. > >Bob Ammerman >RAm Systems Bob, what's involved with getting that up and running? I just got the cell phone bill from my last trip to China, and at a rate exceeding >$10K/year it would be a bit financially painful to sustain that for a relatively long duration... and my family isn't as comfortable with e-mail as I am, so something that interacts with POTS at this end would be very nice. Best regards, Spehro Pefhany --"it's the network..." "The Journey is the reward" .....speffKILLspam@spam@interlog.com Info for manufacturers: http://www.trexon.com Embedded software/hardware/analog Info for designers: http://www.speff.com ->>Test equipment, parts OLED displys http://search.ebay.com/_W0QQsassZspeff

{Quote hidden}> At 06:53 PM 6/29/2006 -0400, you wrote: >>Re: VOIP and Satellite: >> >> >>My daughter is on a mission trip in China this summer and calls us via >> VOIP >>from her computer to our POTS phone. I assume the link is goinig over a >>satellite (even if it isn't its still about 12,000 miles+). The latency >> is >>very noticable, and irritating, but we are more than willing to put up >> with >>it to talk with her. >> >>Bob Ammerman >>RAm Systems > > Bob, what's involved with getting that up and running? I just got the cell > phone bill from my last trip to China, and at a rate exceeding >$10K/year > it > would be a bit financially painful to sustain that for a relatively long > duration... and my family isn't as comfortable with e-mail as I am, so > something that interacts with POTS at this end would be very nice. > > Best regards, > > Spehro Pefhany --"it's the network..." "The Journey is the > reward" I use http://www.sipphone.com . I have an "ethernet phone" here at work, an ATA adapter at home that connects between ethernet and POTS phone wiring, and "The Gizmo Project" on my linux laptop. Harold -- FCC Rules Updated Daily at http://www.hallikainen.com - Advertising opportunities available!

Hi Tim, Thursday, June 29, 2006, 11:47:55 AM, you wrote: {Quote hidden}> Patrick Murphy wrote: >>>Ask a LOT of questions. I notice on one web page that mentions them >>>that for some of their solutions they are re-selling Direcway >>>services. Their VSAT service sounds interesting though. >> >> I want to mention your negative experience with Direcway to them. > We had seen a demonstration of the system before we bought it so we > knew what we were getting into. At the time it was the least costly > alternative. We did not want to pay for a dedicated data line each > month to serve a few users. The nearest town is about 18 miles away > and the installation and ongoing costs would have been very high. A second satellite ISP has called back, selling Direcway, although the name is apparently changing to Hughesnet. Galaxy Broadband is a Canadian reseller (partner?) and is now willing to allow us to rent space on their site to run a "private gateway." This private gateway is similar to the community gateway that Shawn brought up earlier, but hosted at the ISP (for around $1,000 a month). They are willing to route all of our communities through that gateway, and we and/or they would maintain it. Unlike the first Satellite ISP, they don't have a five figure setup fee, and also, each user would have a separate account, so we wouldn't be sharing bandwidth. After the setup costs, they want $70 a month per user, and $1,000 per month for the housing the equipment. Assuming 40 users, that amounts to $25 each, for a total monthly fee of around $100.00. They said if users located in the US also wanted to be routed through our gateway, they would allow it. They are also looking into whether a single content filtering device, such as the FortiGate I mentioned, or another they favor called a SnapVPN could be used at their location. He has offered to cooperate in setting up a pilot site. <snip!> {Quote hidden}>> However, as I see it, the land line, long distance market is rapidly >> changing. We are paying 4.5 cents a minute to call within Canada, but >> the competition (i.e. http://www.telehop.com) is offering as low as 3 cents >> (and only a flat $10 fee for residential!), so how much we should pay >> monthly for a land-based, broadband Internet connection should take >> this into account. > It is a wild business. The one thing is to try and keep capital > equipment costs low and avoid long term commitments if you can so > changing as new things become available is easier financially. Good point. I'll have to find out what commitment, if any, we have with our current long distance provider, and what commitment the competitors are requiring. -- Best regards, Patrick Murphy James Valley Colony

Hi Tim, Thursday, June 29, 2006, 11:32:24 AM, you wrote: {Quote hidden}> Patrick Murphy wrote: >> Okay, I will. She did say something about proprietary compression >> algorithms, but I'll ask her about milliseconds, next time. Lower >> latency should result in faster uploading and downloading, if a large >> file was being sent, right? So I could ask each ISP how long it should >> take to send, say a 100 MB file? > Latency refers to the amount of time between when a character or > packet of data leaves your network, travels up through the satellite > and back to Earth and is put back on the rest of the public Internet > by the satellite service provider. You will probably notice longer > latencies more in situations where many smaller packets are sent like > checking email, filling out web forms, etc. Note that if you are doing > something where you get a result it takes at least 2 x latency--one > for your mouse click, etc. and the other for your result to be returned. > The compression algorithms used are usually more effective when > sending big blocks of data like files. There's a certain amount of > "overhead" bytes associated with each packet of data sent. If the > packet contains only a few characters or a single mouse click there's > not much to compress. Most humans feel that they have received an > instantaneous response from a machine or system if they get some form > of feedback or result in under 100mS. Longer than that and the delay > begins to become perceptable without actual measurement. > I would stick to asking for an actual time in milliseconds as well as > information on how they arrived at the figure. In my opinion the more > open and forthright they are about their benchmark information the > higher the probability you would be pleased with the results. > On our Direcway system no sophisticated measurements are required to > tell that it is much slower for certain applications like checking > email. When your connection is through a terestrial network > downloading a hundred emails appears like a continuous stream where > they come one after another. Through the satellite connection it's > readiliy apparent that each one is being received and acknowledged > individually. > None of this means you should not use any satellite based system. I > would look carefully at any claims of my satellite is significantly > faster than brand X. > Tim Thanks to all of you for helping me understand latency and bandwidth. The more I learn, the more I realize how little I know. And it's good to know how inaccurate my assumptions can be. :-) -- Best regards, Patrick Murphy James Valley Colony

{Quote hidden}>>My daughter is on a mission trip in China this summer and calls us via >>VOIP >>from her computer to our POTS phone. I assume the link is goinig over a >>satellite (even if it isn't its still about 12,000 miles+). The latency is >>very noticable, and irritating, but we are more than willing to put up >>with >>it to talk with her. >> >>Bob Ammerman >>RAm Systems > > Bob, what's involved with getting that up and running? I just got the cell > phone bill from my last trip to China, and at a rate exceeding >$10K/year > it > would be a bit financially painful to sustain that for a relatively long > duration... and my family isn't as comfortable with e-mail as I am, so > something that interacts with POTS at this end would be very nice. > > Best regards, > > Spehro Pefhany --"it's the network..." "The Journey is the > reward" Very simple: See http://www.skype.com Bob