Hence, DNS Security Extensions, or DNSSEC for short, is vital to ensure that this does not happen. DNSSEC is akin to a vigilant cybersecurity patrol unit that works around the clock to validate the authenticity of the digital addresses you visit, much like a diligent city planner going around the city to ensure that all street signs are accurate and have not been tampered with. DNSSEC provides the assurance that the information the public accesses on the website is legitimate and have not been tampered with, which is especially important even for static websites, as any compromise in their integrity could mean misinformation being disseminated and a loss in public trust.

Earlier in August this year, I had the opportunity to explore how we can enable DNSSEC to over 500 Government websites hosted by the Isomer team at Open Government Products. This was part of an earlier mandate by the Cyber Security Agency (CSA) to ensure compliance with the recommendations outlined in the Internet Hygiene Portal.

Why enabling DNSSEC is so difficult

DNSSEC addresses one of the fundamental flaws of DNS, which is the lack of authentication. When you enter an address in your browser, the computer will utilise DNS to translate that human-readable string into a numerical IP address that is used to communicate over the Internet. As DNS is a distributed system, it is susceptible to malicious attacks such as DNS cache poisoning, in which an attacker may “poison” a particular DNS resolver’s cache by populating it with the wrong DNS entries, thereby redirecting DNS queries to a malicious website. With DNSSEC, digital signatures and cryptographic keys are used to ascertain the authenticity of a particular DNS record, and the computer performing the DNS query will confirm that the site’s security keys matches those on record. If the keys do not match, DNSSEC will flag those discrepancies and the user will be prevented from accessing the malicious website.

However, DNSSEC adoption remains very low among the major Internet websites today, as it is challenging to implement DNSSEC together with Content Delivery Networks (CDNs). CDNs operate by having multiple servers in various different locations serving the same content, and each server needs to respond to the DNS queries as if they are the origin. This conflicts with DNSSEC’s need for consistent, cryptographically signed responses. Given that record signing is slow, CDN providers can’t readily change the IP address of a DNS record and digitally sign the record with each query, leading to the low adoption rate of DNSSEC as many websites depend on CDNs. As Isomer is hosted on various CDN providers like AWS CloudFront, this adds a significant blocker to the adoption of DNSSEC and compliance with the recommendations provided by the Internet Hygiene Portal.

Introducing the DNS indirection layer

As DNSSEC operates on a chain of trust starting from the root servers, having any part of the chain broken means that DNSSEC cannot be enabled for the domain. All .gov.sg domains are DNSSEC-signed, which means that all Government websites have the potential to be DNSSEC-signed, but because we rely on CDN providers, the CNAME to the CDN provider introduces a broken link in the chain and prevents DNSSEC from being enabled for the website.

To work around the limitations that the CDN providers face, we decided to implement a DNS indirection layer to bypass the use of the *.cloudfront.net domain. Typically, this is how an agency would configure their website (response from dig):

;; ANSWER SECTION:
www.agency.gov.sg.		240	IN	CNAME	somegibberishstring.cloudfront.net.
somegibberishstring.cloudfront.net. 60 IN	A	54.192.150.16
somegibberishstring.cloudfront.net. 60 IN	A	54.192.150.73
somegibberishstring.cloudfront.net. 60 IN	A	54.192.150.129
somegibberishstring.cloudfront.net. 60 IN	A	54.192.150.6

Notice that because the somegibberishstring.cloudfront.net domain was used, and *.cloudfront.net is not DNSSEC-signed, it results in the website not being DNSSEC-signed. Instead, we introduced a DNS indirection layer by letting agencies point their domains to a specific domain that we control (and we know is DNSSEC-signed), then pointing that domain to the underlying CloudFront IP addresses. That is (response from dig):

;; ANSWER SECTION:
www.agency.gov.sg.		240	IN	CNAME	agency-gov-sg.hostedon.isomer.gov.sg.
agency-gov-sg.hostedon.isomer.gov.sg. 60 IN	A	54.192.150.16
agency-gov-sg.hostedon.isomer.gov.sg. 60 IN	A	54.192.150.73
agency-gov-sg.hostedon.isomer.gov.sg. 60 IN	A	54.192.150.129
agency-gov-sg.hostedon.isomer.gov.sg. 60 IN	A	54.192.150.6

The hostedon.isomer.gov.sg domain is DNSSEC-signed and hosted on AWS Route 53. Thus, the chain of trust is not broken and the agency domain is DNSSEC-signed! This was all done using a single DNS record change on the agency’s end, with no site downtime.

How the DNS indirection layer works

You might be wondering how I got the IP addresses above, and whether this is a significant maintenance burden due to the changing IP addresses on CloudFront. In reality, this DNS indirection layer does not add any additional complexity for engineers, as it is automatically handled by AWS.

On AWS Route 53, each indirection domain record is created as an ALIAS A and ALIAS AAAA record. This is a non-standard DNS record provided by AWS Route 53 to allow creation of A and AAAA records pointing to a domain name. In this case, two records were created on AWS Route 53:

AWS Route 53 then automatically resolves the somegibberishstring.cloudfront.net record to the underlying IPv4 (for A record) and IPv6 (for AAAA record) addresses, which is then returned to the user upon each DNS query. Thus, no additional maintenance burden was added to the engineers, except to initially create the two records above for the agency to use, and if the underlying CloudFront domain changes. This infrastructure is also handled automatically by Pulumi and changes are tracked using an internal Git repository.

Thus, with this indirection layer, we allow the agency to have their agency website DNSSEC-signed, and yet still benefit from having it hosted on a CDN provider. However, of course, this method requires that you use CloudFront as a CDN. It would not work if you have another CDN provider, as you would not be able to know the underlying IP addresses that the CDN provider uses.

What about CloudFlare?

CloudFlare is another CDN provider that uses a different method for responding to DNS queries, which makes it possible for websites to be both DNSSEC-signed and also benefit from having a CDN. It was an alternative that was considered, but due to the significantly higher costs involved ($300 per month on CloudFlare vs $0.50+ per month on AWS Route 53), the method was not further considered for use by Isomer.

Nonetheless, if you are considering CloudFlare, I recommend using their partial CNAME setup if you do not have your entire domain’s DNS hosted on CloudFlare DNS (as is the case with most Government agencies), although note that it would require you to be on at least their Business plan. When you host your website on CloudFlare, CloudFlare will pull a copy of the site from the underlying source and stores that copy on their servers. Thus, when users visit your site, they would retrieve a cached copy from CloudFlare without ever accessing the underlying source. On the DNS level, CloudFlare abstracts away the source site and will only point users to the CloudFlare servers, an example is shown below (response from dig):

;; ANSWER SECTION:
www.agency.gov.sg.		240	IN	CNAME	www.agency.gov.sg.cdn.cloudflare.net.
www.agency.gov.sg.cdn.cloudflare.net.	300	IN	A	104.21.32.179
www.agency.gov.sg.cdn.cloudflare.net.	300	IN	A	172.67.153.50

The partial CNAME setup works in a similar manner to how the DNS indirection layer works, but this time it is CloudFlare that is handling the DNS indirection layer. Thus, you can set up your partial hosted zone on CloudFlare and direct CloudFlare to pull from the source site that you specify. Since cloudflare.net is also DNSSEC-signed, this allows an unbroken chain of trust and your website would be DNSSEC-signed as well.

However, do take note that you will need to make use of CloudFlare’s Advanced Certificate Manager in order to automatically provision SSL certificates for your partial DNS setup. As of time of writing, it costs about $10 per month per hosted zone, which can be an exorbitant cost if you are managing a large number of sites like Isomer does.

Conclusion

Having DNSSEC is absolutely vital in our inter-connected era where the peace of mind that comes from having this functionality is invaluable, especially for public institutions like the Government. However, having this added security may come at a cost to performance. Nonetheless, there seems to be some developments to DNSSEC, such as using ECDSA to perform live signing. We can only hope that having DNSSEC signing gets less expensive in terms of monetary and computational costs, and move towards a better and more secure Internet.

Disclaimer: The views and opinions expressed in this blog post are solely those of the author and do not necessarily reflect the official policy or position of any Singapore Government agency or entity. The content provided is for informational purposes only and is not meant to be an endorsement or representation by any government entity or otherwise. While every effort has been made to ensure the accuracy and completeness of the information presented in this article, the author acknowledges that there may be errors, omissions, or inconsistencies herein. Feedback and corrections are very much welcomed.

Orientation camps

Orientation camps are the highlight of the freshman year and is certainly not to be missed! It is probably the first chance that you will have in being exposed to the new environment and for you to form new networks with people that you probably have never met before. Here are some tips that I managed to gather along the way.

Tip 1: Sign up early

Whether or not you are working or have other commitments before university starts, it is advisable for you to find out the different faculty camps that are available for you to sign up. Some of the camps can start as early as June and if you have only started finding out about university life only a month before school starts, you would probably have missed out on a lot of opportunities to meet new friends!

Also, many of the camps are unable to accommodate a large number of people, so there will certainly be many people who will be placed in a waiting list if the response is great. Sign up early for the camps to guarantee your precious slot in the camp!

Tip 2: Be proactive

I have managed to encounter many different types of people along the way during my Freshmen Orientation Week (FOW) camp and along the way, I managed to make many new friends which would be of great help when school starts. Most people are shy to make friends at the start, so if you are not proactive from the start, you will certainly miss out on a lot of fun during the camp.

If you are naturally shy, just remember: you paid quite an amount for the camp, so make that money worth it! It’s not about winning the best OG or the best house, but rather it’s about having the most fun. My OG was the overall last OG in terms of points, but I daresay that we had the most amount of fun compared to the other OGs.

Tip 3: Prepare beforehand

Orientation camps are also a good time for you to ask more about university life. As your OGLs are likely to be seniors, they bring with them a good amount of experience with them. Ask your questions to them, find out what modules to take and what modules to avoid. Keep in touch to ask for their notes. Never be too shy to ask!

Module bidding

Approximately 1 week before you start school, you will be involved in the module bidding process. There are many other guides out there for you to have a look at with regards to the whole module bidding process of NUS, so I will not be repeating it here. However, here are some tips that I managed to pick up along the way and did not manage to see it mentioned elsewhere.

Tip 1: Avoid dropping your pre-allocated modules

This tip is especially relevant to people in NUS Business School. The modules that you will be allocated are in something called a basket. For illustration, I will place modules A to I in the following 3 baskets:

1. Basket 1: Modules A, B and C
2. Basket 2: Modules D, E and F
3. Basket 3: Modules G, H and I

All the modules A to I represent the modules that you have to take as part of your core requirements. So, when the school pre-allocates you with modules, they will pre-allocate you with either Basket 1, 2 or 3. This means that you can be allocated modules A, B and C while your friend can be allocated D, E and F, but you cannot be allocated modules A, D and G because they are from different baskets of modules.

Hence, if you choose to drop the pre-allocated modules, you will have to bid for another module from another basket. As a result, in subsequent semesters, you will not be allocated the module that you have dropped in this semester, which means that you will have to bid for that module that you have dropped in subsequent semesters.

Also, core modules tend to get quite expensive as there are not many quota left after all the pre-allocation has been done.

Tip 2: Non-home faculty members got to actually bid for modules

This tip mainly affects people in the double degree programme. If you are taking a DDP in BBA and Computing and your home faculty is School of Computing, you will NOT be pre-allocated any business modules in your first semester of study. This is different from those DDP students with home faculty in business where they will be pre-allocated modules from business AND computing schools.

Simply put, if your home faculty is School of Computing, you will only see the computing modules being pre-allocated to you (wait until at least round 1C starts if nothing shows up for you). You will then have to bid for the core modules that you want to take (bearing in mind that some modules might get quite expensive). There might be some modules that are not biddable (such as GER1000 if you have not gotten it pre-allocated to you), then you will have to appeal through CORS.

Why is it like this, I have no idea. I managed to learn about this tip only when round 1C actually started, so hopefully this tip helps in reducing the amount of anxiety that you are facing.

Tip 3: You cannot overload in the first semester

I personally received a lot of questions on this even though I am a freshie myself. Simply put, you cannot overload in the first semester of matriculation, no matter if you are aiming to graduate in 3 years, or want to take up a double degree, etc.

The normal workload is 5 modules, total 20MCs. You cannot take a total of 23MCs and above if you are a single degree student in the first semester, so you technically can still take 6 modules if the 6th module is a 2MC module (yes, there are many of such modules out there). If you are a double degree student, you can take up to 27MCs in the first semester, but you cannot go beyond 23MCs until round 3A of bidding starts.

Conclusion

Hopefully this small amount of tips are able to provide some of the answers that are not commonly found on the Internet. These tips might also become irrelevant when the new module registration system kicks in during Semester 1 of AY19/20. If you still got any questions to ask, feel free to write to me in the comments below. Cheers.

University studies

As this post title suggests, I will be gearing up to enrolling in university education in the coming few weeks. I have been accepted into the National University of Singapore (NUS) School of Computing. The course I will be studying is the Business Administration & Computer Science double degree programme and I will be starting my university studies in Semester 1, AY 2018/19.

To provide more context, majority of undergraduates in NUS take up a single degree. That is, you will be studying a single course and graduate with a single degree scroll certifying that you have studied that course in NUS. However, for my case, a double degree programme allows you to graduate with two degree scrolls certifying that you have studied two different courses in NUS, as if you took the two course individually. It would thus have taken you 7 to 8 years to graduate with two degrees as compared to the 5 years that a double degree student would have taken.

I was not expecting to be granted a place in this double degree programme. While my results were somewhat decent (is 86.25 rp considered decent?), it was one that barely allowed me to enter my home course in Information Systems, let alone this double degree programme. It is understandable why the double degree programme is hard to get in, as only about 10% of undergraduates are under this programme, and your workload will be slightly higher compared to your peers taking a single degree programme (especially if you wish to sign up for additional programmes such as the Student Exchange Programme, SEP). Also, with lesser number of level 1000 modules (a.k.a foundation modules) to take up during the course of your studies, it is easy to understand why being a double degree student would be stressful.

Nonetheless, I got myself into this trouble, so let me make the best out of it then.

Blog-related matters

As you would have noticed by now, this blog is now live under a different URL. The motivation behind this change was due to my successful acquisition of this domain name under the GitHub Student Developer Pack. If you are currently a student, you should sign up for this pack as it provides many freebies that you may find useful during the course of your studies.

Also, as I embark on my journey into university studies, this blog will see more frequent updates about my time in NUS (and hopefully provide you with more insights as to what to expect when you enter NUS as a freshman). It may also contain things that I have learnt from both my courses in Information Systems and Business Administration.

Be sure to bookmark this blog and follow me in my journey in NUS!

Despite being of strategic importance to the transportation of Singapore, this area also boasts a large collection of food and heritage which is often overlooked by busy commuters. I thus decided to take a night walk down this area starting on 9 February 2017 at 2300 hrs, starting from Admiralty MRT station and ending at the junction of Thomson Road and Moulmein Road, walking for almost 20 km and taking a total time of 6 hours. Geared with 2 litres of water and a determined mind, I began documenting this journey.

When I first got to Admiralty MRT station at about 2300 hrs (pictured), it was not very packed, but many people were seen walking home. Most of the people have ended their day’s work and are carrying the usual tired face around. From the MRT station, I proceeded to walk east towards Woodlands Ave 7.

Walking along Woodlands Ave 7, I spotted the Woodlands Park Connector and decided to follow along its trail, since it was also the same path that I was supposed to take to Gambas Ave. The ambiance was comforting, especially since the area was rather dark and that there were very little people on the streets after I left the MRT station, thus allowing me to immerse myself in my own thoughts. There were also interesting sights I saw along the way, especially near a pop-up building for the new NorthWave executive condominium, which I have included pictures in the album below.

As I travelled along Sembawang Rd near Yishun, I encountered Chong Pang City and saw a Cai Shen “guarding” the gates to it (pictured). The Chinese New Year spirit is still there from the looks of it, and it did warrant a photo to be taken.

Just down the road after Chong Pang Camp, it was the famous Chong Pang Nasi Lemak. The food looked great, but I did not get the opportunity to try it as I was not having an appetite for it. Nonetheless, I did take a photo of the food available for my reference in the future before I headed down for some McDonald’s instead.

After a refill of food, I got going again, heading along Sembawang Rd before entering Upper Thomson Rd. Majority of Upper Thomson Rd was forest, with the occasional rows of shophouses near road junctions. Along the way, I managed to encounter the construction site of Springleaf MRT station and Upper Thomson MRT station as part of the new Thomson-East Coast Line. Around Springleaf MRT station was the Springleaf Nature Park (pictured).

Behind the Springleaf MRT station, there was also a row of shophouses which seemed to be selling some good food, but I did not manage to go down and have a look due to time constraints. Nonetheless, the journey down south continued, occasionally hitting places such as Sembawang Hills Estate and the area around Upper Thomson MRT station before ending the journey of Upper Thomson Rd at the junction with Lornie Rd and Thomson Rd.

I then continued on with exploring Thomson Rd, first with the florist area outside MediaCorp and continuing on after Balestier Rd until I reached my destination of NS20 Novena MRT station at 0500 hrs. Along the way, there were more shophouses, especially at the stretch opposite Novena Church, though I did not explore further than taking a photo of their signboards.

As pictures speak a thousand words, here’s the album that contains all the photos I have taken throughout this whole journey. Feel free to add your comments here, on the album or the individual photos.

To conclude, this journey has been one of the longest late night walks I have embarked on, and it is a drastic difference compared to the usual route that I would have taken (which is mostly urban areas). Nonetheless, this journey was made in celebration of the end of my RCC in the Army and the start of a new chapter as a commander. Here’s to the next 1 year in service!

Mr Lee Kuan Yew passed away on 23rd of March, 2015 at 3.18am at the Singapore General Hospital due to worsening pneumonia. The Singapore Government has thus declared a national mourning period from 23 March to 29 March 2015 in the mark of respect for him.

I am deeply saddened by the news of his passing, in which I am unable to use words to describe. My condolences goes out to Mr Lee and his family. His contributions to building modern-day Singapore will forever be remembered by Singaporeans, both young and old alike.

This blog post was posted in memory of Mr Lee Kuan Yew.

Travelling from Bayshore was no easy feat. NS28 Marina South Pier was approximately 2km away from Bayshore MRT, and a significant distance to travel there was needed. The only bus service that operates at Marina South Pier is 402, whose frequency might be rather irregular.

The walk was worth it. Occasionally glancing at the Marina Bay skyline and accompanied by the natural landscape of the area, it was simply a mixture of Singapore’s urbanisation and nature. It is no wonder why Singapore is widely recognised as a Garden City.

I finally reached my destination, NS28 Marina South Pier, which I did not manage to take pictures of the train platform. Platform A was only available for boarding towards Jurong East whereas Platform B was for arrivals from Marina Bay. If you ever wished to have a ride to Marina South Pier just to get seats from the terminus, you probably have to get off when you reach the station and board it again when it arrives at Platform A.

Walking this stretch from Bayshore MRT to Marina South Pier was simply amazing and breathtaking for me. While I have heard much about how the Marina Bay skyline was like, it was certainly different from experiencing it first-hand. The wealth that Singapore has built up was no easy feat and it is important to treasure whatever we have now.

I would just come to this place to relax and enjoy myself, basking in the glory of what our forefathers have done for us and serve as a motivation to study harder. So then, why would you despise such a beautiful country?