plagiat0r

10 ms·

1.
by plagiat0r 4mo ago
Unfortunately bind is as buggy as it always been. I've tried to black hole entire ::/0 but it still eat its query counter without even sending out a single packet. You need dual stack network and routing to both, or run it with -4
2.
by plagiat0r 5mo ago
Your should rather say - it's always bind (bugs). I wrote about bind eating their query counter on IPv6 even if you don't have IPv6 routing: https://szafka.net/blog/bind9-as-resolver.html Run bind with -4 arg
3.
by plagiat0r 6mo ago
Unpopular opinion: Maybe the way to go is to create a separate Show HNs only for bots and put some instructions for the bots to follow, identify themselves and give them separate category. Similar to moltbook. If we can't stop it, mayb
4.
by plagiat0r 6mo ago
Back in the 90/2000 the was a very popular tool named rrdtool to store metrics in a round robin structure on disk, especially suited for network metrics. The goal of the storage was to have a fixed size and cover only last NNN days, ci
5.
by plagiat0r 7mo ago
And the link to vscode is now 404. It's gone.
6.
by plagiat0r 7mo ago
All I'm saying is that publishing final certificate is not required for the process, so just assuming it will be there is premature. User may end up putting precert on his https server and find the hard way. Happy to see LE publish bo
7.
by plagiat0r 7mo ago
Most acmev2 clients create account on certificate request. That is precisely why I wrote this: https://github.com/pawlakus/acmecli This small tool will allow you to just create, rekey and deactivate your acmev2 accoun
8.
by plagiat0r 7mo ago
Thank you, this draft is literally perfect and I wish we had this years ago. Most people don't know about acmev2 account rekeying either. It is great you decided to use account uri instead of public key thumbprint. Recently I wrote a s
9.
by plagiat0r 7mo ago
X509 certificates published in CT logs are "pre-certificates". They contains a poison extension so you don't be able to use them with your private key. The final certificate (without poison and with SCT proof) is usually not
10.
by plagiat0r 7mo ago
X509 certificates published in CT logs are "pre-certificates". They contains a poison extension so you don't be able to use them with your private key. The final certificate (without poison and with SCT proof) is usually not
11.
by plagiat0r 8mo ago
Thanks for the service. Personally I would lower the TTL to 120 or less. Dyndns is used for personal stuff. There is no point caching a FQDN almost nobody use. If anything, low TTL is a benefit for recursive resolvers like 1.1.1.1 or ISPs.
12.
Show HN: Tiny acmecli for ACMEv2 account mgmt and for DNS-persist-01(github.com)
2 points by plagiat0r 9mo ago|0 comments
13.
by plagiat0r 10mo ago
Duplicate, it is submitted third time.
14.
by plagiat0r 10mo ago
Duplicate of: https://news.ycombinator.com/item?id=45973177
15.
by plagiat0r 10mo ago
Given the bind security and functional track record over the last 30 years, I would pick knot/nsd/yadifa/powerDNS/coredns/tinydns in a heartbeat for authoritative dns server.
16.
by plagiat0r 10mo ago
Windows 10, 11 and most major OSes have ipv6 enabled and it is preferred. There is also a Happy eyeball algorithm browsers use to connect - RFC 8305. However, the most important thing you need to understand are fundamentals. Today we have t
17.
by plagiat0r 10mo ago
The thing is, they do not support wildcard TLS, no way to pass acme dns-01 challenge.
18.
by plagiat0r 1y ago
Sounds like divorce, you need a lawyer.
19.
by plagiat0r 1y ago
Spin up a vps in a different country, and VPN your entire traffic over this vps. Wireguard or OpenVPN.
20.
by plagiat0r 1y ago
Authoritative or resolver?
21.
by plagiat0r 1y ago
But when setting up a full recursive resolver, you should avoid using root servers directly for queries, but rather mirror the root zone locally: https://datatracker.ietf.org/doc/html/rfc8806
22.
by plagiat0r 1y ago
I've checked the site, it looks very nice on mobile. However, some checks have bugs or they makes no sense: 1. SPF missing ?all is broken, it report missing when it is there 2. Checking SOA records makes no sense in 2025. Their serial
23.
by plagiat0r 1y ago
> But up to this point, that's what the author has been doing. They've setup bind to run on IPv4 and IPv6 but not really the latter, instead blackholing all such requests. Well, Linux kernel is dual-stacked for more than 30 yea
24.
Is BIND9 suitable as a recursive resolver in 2025?(szafka.net)
22 points by plagiat0r 1y ago|7 comments
25.
by plagiat0r 1y ago
This article summarize my findings on what I believe to be a buggy recursive algorithm. Main actors: BIND-9.18, BIND-9.20 and wireshark.
26.
by plagiat0r 2y ago
The problem I have with the article is that gravity is not a force. Magnetic is a force, but gravity is not a force.
27.
by plagiat0r 2y ago
The best document to properly run a private root zone dns server is this: https://datatracker.ietf.org/doc/html/rfc8806 Just read it quickly and you're good to go.
28.
by plagiat0r 2y ago
This article looks like being generated with the LLM model.
29.
by plagiat0r 2y ago
Focus on Linux, Linux networking (NAT), containers and kubernetes and basic git understanding. DNS, well, don't invest to much in it. If anything, DNS is just a networking helper, allowing most protocols to connect "to a string&qu
30.
by plagiat0r 2y ago
Very surprised to see that bind9 did the best job picking the fastest NS and to abandon query within 10 seconds. Very disappointing unbound results, as all servers falls into 400ms round trip time, so it just pick NS randomly. As for public

More ›