Mastodon @ schleuss.online

0 posts0 participants0 posts today

AntonHat hier wer Connections zur IT-Abteilung von aok.de? Die haben gestern das SSL-Zertifikat ihres mx1.aok.de getauscht, aber den TLSA-Record für DANE übersehen...<a href="https://dane.sys4.de/smtp/service.bw.aok.de" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dane.sys4.de/smtp/service.bw.aok.de</a>20:00 Uhr: geht wieder! Danke :)<a href="https://mastodon.social/tags/DANE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DANE</a> <a href="https://mastodon.social/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a href="https://mastodon.social/tags/TLS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLS</a> <a href="https://mastodon.social/tags/aok" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#aok</a>

nan0Does anyone has a contact to the Joint Research Centre (<a href="https://chaos.social/tags/JRC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JRC</a>) [0] or My Email Communications Security Assessment (<a href="https://chaos.social/tags/MECSA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MECSA</a>) [1] (both from the <a href="https://chaos.social/tags/EU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EU</a>)?I find the tool great... if it would parse <a href="https://chaos.social/tags/SPF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SPF</a>/#IPv6 correctly und actually check for <a href="https://chaos.social/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a>...I've tried emailing them, but no response :/Links: [0]: <a href="https://joint-research-centre.ec.europa.eu/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://joint-research-centre.ec.europa.eu/</a> [1]: <a href="https://mecsa.jrc.ec.europa.eu/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://mecsa.jrc.ec.europa.eu/</a>

F. Maury ⏚Bon, bah les ami.es, dans un mois, je suis disponible en tant que freelance pour... plein de trucs, en fait 😅 J'ai un passé de développeur en <a href="https://infosec.exchange/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> et <a href="https://infosec.exchange/tags/Go" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Go</a> (7 ans+). J'ai un passé de <a href="https://infosec.exchange/tags/DevOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DevOps</a> (3 ans). J'ai un passé d'architecture système et réseau (12 ans). J'ai même un passé d'auditeur en sécurité (2 ans) et de chercheur en sécurité réseau avec de la crypto dedans (5 ans). J'ai aussi assuré un certain nombre de formations, notamment en sécurité informatique (<a href="https://infosec.exchange/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a>, identité et authentification, administration sécurisée, sécurité web, git, IPFS...)Je tiens un blog (<a href="https://broken-by-design.fr" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://broken-by-design.fr</a>) et un podcast (<a href="https://pod.broken-by-design.fr" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://pod.broken-by-design.fr</a>).Je bouffe du Terraform au petit dej ; j'adore taffer sur des technologies immuables (notamment Fedora CoreOS mais Flatcar m'a fait beaucoup de pied, récemment) ; systemd, c'est la vie.Voilà, si vous m'avez pas bloqué avec cette dernière affirmation, et que vous avez besoin d'un coup de main sur vos projets, venez on discute !Le boost est doux 💗 <a href="https://infosec.exchange/tags/getfedihired" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#getfedihired</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurite" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurite</a>

Stéphane Bortzmeyer"I don't understand why <a href="https://mastodon.gougere.fr/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> is not yet the default for resolvers on Linux machines."<a href="https://mastodon.gougere.fr/tags/FOSDEM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSDEM</a>

thomascovenantI found out that Traficom, who operate the .fi TLD intends to switch off DNSSEC for two weeks in April 2025 (by asking IANA to remove the DS record for .fi) while they are doing an algorithm roll. Somehow they can't do the algorithm roll while staying DNSSEC signed.Plenty of other TLDs have performed algorithm rollovers while staying DNSSEC signed. This plan is quite careless.Does anyone know any high profile .fi domain that is DNSSEC signed and uses DANE, CAA, the dns01 challenge for ACME (letsencrypt), or SSHFP?<a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/dnssec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dnssec</a>

NLnet LabsWe're in the final stint of our one-year commitment to <a href="https://mastodon.social/@sovtechfund" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@sovtechfund</a> to build a memory-safe library for <a href="https://fosstodon.org/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a>. By the end of 2024, our `domain` crate for <a href="https://fosstodon.org/tags/rustlang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rustlang</a> will feature a caching stub resolver, zone transfers, <a href="https://fosstodon.org/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> validation and signing, request routing and a proxy, along with tooling for DNS inspection (dnsi) and manipulation (dnst). In 2025, we'll continue building at the same pace with the same team and we're eager to hear what you would like to see us build most. Let us know!

c't Magazinheise+ | DNS-Sicherheit: Automatischer Schutz für Jedermann-DomainsDie Sicherheitstechnik DNSSEC leistet einen wichtigen Beitrag zum Schutz des Internetverkehrs. Ein Berliner Team ergänzt nun die DNS-Spezifikation. <a href="https://www.heise.de/hintergrund/DNS-Sicherheit-Automatischer-Schutz-fuer-Jedermann-Domains-9803841.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.heise.de/hintergrund/DNS-Sicherheit-Automatischer-Schutz-fuer-Jedermann-Domains-9803841.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://social.heise.de/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a href="https://social.heise.de/tags/Internet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Internet</a> <a href="https://social.heise.de/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://social.heise.de/tags/Server" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Server</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a>

JP MensIterations count in NSEC3PARAM record MUST be 0 (zero), says RFC 9276FUCK YOU, say 167 TLDs<a href="https://gist.github.com/jpmens/4032d66bed11cd46674627da942e465d" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gist.github.com/jpmens/4032d66bed11cd46674627da942e465d</a><a href="https://mastodon.social/tags/dnssec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dnssec</a>

Colin Cogle :verified:<a href="https://infosec.exchange/@jerry" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jerry</a> I use Hurricane Electric’s free DNS service. I run a hidden primary that syncs with them, and they provide five named secondaries. Full support for <a href="https://mastodon.colincogle.name/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a>, because it’s not 1998 anymore. <a href="https://dns.he.net" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dns.he.net</a>

IT NewsDNS glitch that threatened Internet stability fixed; cause remains unclear - Enlarge For more than four days, a server at the very core of... - <a href="https://arstechnica.com/?p=2026566" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://arstechnica.com/?p=2026566</a> <a href="https://schleuss.online/tags/domainnamesystem" class="mention hashtag" rel="tag">#domainnamesystem</a> <a href="https://schleuss.online/tags/rootservers" class="mention hashtag" rel="tag">#rootservers</a> <a href="https://schleuss.online/tags/security" class="mention hashtag" rel="tag">#security</a> <a href="https://schleuss.online/tags/biz" class="mention hashtag" rel="tag">#biz</a>⁢ <a href="https://schleuss.online/tags/dnssec" class="mention hashtag" rel="tag">#dnssec</a> <a href="https://schleuss.online/tags/dns" class="mention hashtag" rel="tag">#dns</a>

bert hubert 🇺🇦🇪🇺🇺🇦This is quite rare - the C root-servers are out of sync with the rest of the world by 3 days. Since that time there have been no changes in the root zone, except for DNSSEC signature updates. It appears all C instances (operated by <a href="https://fosstodon.org/tags/cogent" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cogent</a>) are serving an outdated zone. For now this has no operational impact, but that might change <a href="https://fosstodon.org/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> - UPDATE, c-root received an update and now only lags behind by 1 day now. UPDATE2: fixed.

IPFire NewsIPFire protects your DNS requests from being forged by using <a href="https://social.ipfire.org/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a>

cynicalsecurity :cm_2:… so I went off and I read the relevant document at the ISC website¹ to migrate to the new dnssec-policy and am now thoroughly confused.Not only, according to DNSVIZ I am a bad bad sysadmin signing with algorithm 7 (RSASHA1NSEC3SHA1 for those in the know) and I dread having to go through the whole <a href="https://bsd.network/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> setup again.:flan_despair:Is there a guide for the lazy sysadmin who set up DNSSEC following "In-line Signing with NSEC3 in BIND 9.9+ - A Walk-through"² dated 2019 and now have no clue?:flan_piteous: __ ¹ <a href="https://kb.isc.org/docs/dnssec-key-and-signing-policy" rel="nofollow noopener noreferrer" target="_blank">https://kb.isc.org/docs/dnssec-key-and-signing-policy</a> ² <a href="https://kb.isc.org/docs/aa-00711" rel="nofollow noopener noreferrer" target="_blank">https://kb.isc.org/docs/aa-00711</a>

Internet.nl<a href="https://io.mwl.io/@mwl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mwl</a> DANE is more and more used for *authenticated* transport encryption of email. Check: * Test: <a href="https://dane.sys4.de" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dane.sys4.de</a>, <a href="https://stats.dnssec-tools.org/explore/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://stats.dnssec-tools.org/explore/</a>, <a href="https://en.internet.nl/test-mail/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://en.internet.nl/test-mail/</a> * Wiki: <a href="https://github.com/baknu/DANE-for-SMTP/wiki" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/baknu/DANE-for-SMTP/wiki</a> * Howto: <a href="https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md</a> * Blog: <a href="https://blog.apnic.net/2019/11/20/better-mail-security-with-dane-for-smtp/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.apnic.net/2019/11/20/better-mail-security-with-dane-for-smtp/</a>Furthermore, note that MS already supports outbound DANE on Exchange Online and plans to support inbound DANE mid 2024: - <a href="https://techcommunity.microsoft.com/t5/exchange-team-blog/releasing-outbound-smtp-dane-with-dnssec/ba-p/3100920" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://techcommunity.microsoft.com/t5/exchange-team-blog/releasing-outbound-smtp-dane-with-dnssec/ba-p/3100920</a> - <a href="https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694</a><a href="https://mastodon.nl/tags/DANE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DANE</a> <a href="https://mastodon.nl/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a href="https://mastodon.nl/tags/mailsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mailsecurity</a>

Antonio Prado"Since the initial disclosure of the vulnerabilities on November 2, 2023, we have been working with all major vendors on mitigating the problems in their implementations." "We recommend that everyone installs the patches and updates their DNS software. We recommend to continue using DNSSEC, encourage the domains to get signed, and all the resolvers to enforce DNSSEC validation. DNSSEC is the only practical measure to block DNS cache poisoning attacks." <a href="https://labs.ripe.net/author/haya-shulman/keytrap-algorithmic-complexity-attacks-exploit-fundamental-design-flaw-in-dnssec/" rel="nofollow noopener noreferrer" target="_blank">https://labs.ripe.net/author/haya-shulman/keytrap-algorithmic-complexity-attacks-exploit-fundamental-design-flaw-in-dnssec/</a> <a class="hashtag" href="https://social.prado.it/tag/dnssec" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a class="hashtag" href="https://social.prado.it/tag/dns" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a class="hashtag" href="https://social.prado.it/tag/keytrap" rel="nofollow noopener noreferrer" target="_blank">#KEYTRAP</a>

Jan SchaumannReminder that today is the weird gathering of the guardians of the <a href="https://mstdn.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> to break out the "Key to the Internet" (aka the Root Key Signing Key or KSK) to (in this case) sign the 2024Q2 Zone Signing Keys (ZSKs), and if that's your sort of nerdy jam, you can watch the ceremony live starting in a little over an hour:<a href="https://www.iana.org/dnssec/ceremonies/52" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.iana.org/dnssec/ceremonies/52</a><a href="https://mstdn.social/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a>

Ondřej SurýAlso hug your <a href="https://mastodon.rfc1925.org/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> recursive resolver <a href="https://mastodon.rfc1925.org/tags/Developers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Developers</a>, they needed it for past couple of weeks and they couldn’t tell anyone.<a href="https://mastodon.rfc1925.org/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a href="https://mastodon.rfc1925.org/tags/KeyTrap" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KeyTrap</a> <a href="https://mstdn.social/@rysiek/111926495878067817" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://mstdn.social/@rysiek/111926495878067817</a>

heise SecurityDNS-Server: Bind und Unbound stolpern über Sicherheitslücke "KeyTrap" Mit einer präparierten DNS-Anfrage können Angreifer eine hohe Prozessorlast verursachen und den Dienst für legitime Nutzer so blockieren. Patches stehen bereit.<a href="https://www.heise.de/news/DNS-Server-Bind-und-Unbound-stolpern-ueber-Sicherheitsluecke-KeyTrap-9627276.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.heise.de/news/DNS-Server-Bind-und-Unbound-stolpern-ueber-Sicherheitsluecke-KeyTrap-9627276.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege</a><a href="https://social.heise.de/tags/DoSSchwachstelle" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DoSSchwachstelle</a> <a href="https://social.heise.de/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a href="https://social.heise.de/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a>

NLnet Labs🚨 We have released version 1.19.1 of Unbound <a href="https://fosstodon.org/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> resolver, which contains <a href="https://fosstodon.org/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> fixes for CVE-2023-50387 and CVE-2023-50868. ⚠️ Please update as soon as possible in order to mitigate two <a href="https://fosstodon.org/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> validation vulnerabilities that affect all well-known resolvers. <a href="https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/</a>

heise onlineAnalyse: Ausfall von .ru war wohl kein Kriegsopfer oder Zensurfall Die Ausfälle zahlreicher Dienste mit der TLD .ru waren wohl ein technischer Fehler oder menschliches Versagen. Eine Post-mortem-Analyse dazu legt das nahe.<a href="https://www.heise.de/news/Analyse-Ausfall-von-ru-war-wohl-kein-Kriegsopfer-oder-Zensurfall-9617520.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.heise.de/news/Analyse-Ausfall-von-ru-war-wohl-kein-Kriegsopfer-oder-Zensurfall-9617520.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege</a><a href="https://social.heise.de/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://social.heise.de/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a href="https://social.heise.de/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a>

Recent searches

Search options

Administered by:

Server stats:

#dnssec