Viewing profile — plagiat0r

Unfortunately bind is as buggy as it always been. I've tried to black hole entire ::/0 but it still eat its query counter without even sending out a single packet. You need dual st…

Your should rather say - it's always bind (bugs). I wrote about bind eating their query counter on IPv6 even if you don't have IPv6 routing: https://szafka.net/blog/bind9-as-resolv…

Unpopular opinion: Maybe the way to go is to create a separate Show HNs only for bots and put some instructions for the bots to follow, identify themselves and give them separate c…

Back in the 90/2000 the was a very popular tool named rrdtool to store metrics in a round robin structure on disk, especially suited for network metrics. The goal of the storage wa…

And the link to vscode is now 404. It's gone.

All I'm saying is that publishing final certificate is not required for the process, so just assuming it will be there is premature. User may end up putting precert on his https se…

Most acmev2 clients create account on certificate request. That is precisely why I wrote this: https://github.com/pawlakus/acmecli This small tool will allow you to just create, re…

Thank you, this draft is literally perfect and I wish we had this years ago. Most people don't know about acmev2 account rekeying either. It is great you decided to use account uri…

X509 certificates published in CT logs are "pre-certificates". They contains a poison extension so you don't be able to use them with your private key. The final certificate (witho…

X509 certificates published in CT logs are "pre-certificates". They contains a poison extension so you don't be able to use them with your private key. The final certificate (witho…

Thanks for the service. Personally I would lower the TTL to 120 or less. Dyndns is used for personal stuff. There is no point caching a FQDN almost nobody use. If anything, low TTL…

Over the years I've used many acme clients, and noticed that a lot of them often lack acmev2 account management functions. It is also non-trivial to migrate between them with keepi…

Duplicate, it is submitted third time.

Duplicate of: https://news.ycombinator.com/item?id=45973177

Given the bind security and functional track record over the last 30 years, I would pick knot/nsd/yadifa/powerDNS/coredns/tinydns in a heartbeat for authoritative dns server.

Windows 10, 11 and most major OSes have ipv6 enabled and it is preferred. There is also a Happy eyeball algorithm browsers use to connect - RFC 8305. However, the most important th…

The thing is, they do not support wildcard TLS, no way to pass acme dns-01 challenge.

Sounds like divorce, you need a lawyer.

Spin up a vps in a different country, and VPN your entire traffic over this vps. Wireguard or OpenVPN.

Authoritative or resolver?

But when setting up a full recursive resolver, you should avoid using root servers directly for queries, but rather mirror the root zone locally: https://datatracker.ietf.org/doc/h…

I've checked the site, it looks very nice on mobile. However, some checks have bugs or they makes no sense: 1. SPF missing ?all is broken, it report missing when it is there 2. Che…

> But up to this point, that's what the author has been doing. They've setup bind to run on IPv4 and IPv6 but not really the latter, instead blackholing all such requests. Well, Li…

This article summarize my findings on what I believe to be a buggy recursive algorithm. Main actors: BIND-9.18, BIND-9.20 and wireshark.