8organicbits

How often do you see self-signed certificates that are valid due to DNSSEC/DANE configuration versus certificates were issued by a trusted CA? When I checked two years ago I found that 99.3% of the top 1,000 domains supported STARTTLS and 94.1% used a TLS certificate issued by a CA. I suspect the numbers keep improving, but I don't think we're quite at 100% yet.

This is a good overview of email encryption, but it doesn't cover what Fastmail actually supports which I think makes this misleading.

Fastmail does not enforce MTA-STS for outbound messages. I just checked here (https://email-security-scans.org/view/jktrld5e73b2dyxz0h1swu...). You can see how your email provider compares at https://email-security-scans.org.

Fastmail does support MTA-STS for inbound messages... sort of. For inbound MTA-STS the email provider needs to use a TLS certificate issued by a trusted certificate authority, which Fastmail does. Additionally, the domain name in the "to address" needs to enable MTA-STS using some DNS records. Fastmail does not provide the documentation for setting this up, although they have decent adoption by folks who figured it out on their own. I'm seeing about 0.2% of domains using Fastmail enforce MTA-STS inbound:

    SELECT mta_sts_mode, COUNT(*) AS "count"
    FROM read_parquet('dns-analytics-2026-q3-*.parquet')
    WHERE exchange_suffix = 'messagingengine.com'
    GROUP BY mta_sts_mode
    ORDER BY count DESC;
    ---
    mta_sts_mode  count
    -             174,877
    enforce       354
    testing       313
    none          11

This is about the same as Protonmail (~0.2%), but higher than Outlook (~0.1%) and Google (<0.1%). I suppose this reflects Fastmail's popularity among technically minded folks.

I'd like to see Fastmail improve this by clearly documenting MTA-STS support, setup instructions, and validate MTA-STS in their custom domain dashboard. It looks like they may be adding MTA-STS policy hosting, which is a really promising sign, but I don't see this documented yet so this is probably being tested internally.

    $ curl -k --resolve mta-sts.example.com:443:103.168.172.47 https://mta-sts.example.com/.well-known/mta-sts.txt
    version: STSv1
    mode: testing
    mx: *.messagingengine.com
    max_age: 86400

With that said, I've been extremely happy with Fastmail for several years now and recommend it.

I think this is a clever happy path solution, but it isn't very defensive against problems. If the cloud cron doesn't fire on time or the consumer fails then the queue won't be drained in time. That will cause the events to be batched in the wrong hour.

I don't see how you are building the batches, but there's a lot of complexity around batch sizes, acknowledging that the messages were consumed, etc. Having a single dataset.json.gz per hour feels like a hint this isn't done safely. I'd double check that carefully to avoid losing data.

One tip about compression, I've been really pleased with zstd compression of json/jsonl data.

This looks clever. I've seen PPT to web tools before (https://sparkslides.com/publish/, https://slidehtml5.com/), but I think the slide synchronization idea is new. I can't evaluate more than that as I don't use these.

In the past I have liked marp (https://marp.app/) for technical slides as you write in markdown, can use version control, etc. Powerpoint always felt odd as a developer.

To share public slides I've published to GitHub pages (https://github.com/robalexdev/marp-to-pages). I've seen professors use it for all their slides. But that doesn't synchronize slides, last I checked.

Correct, this is a very specific attack where an attacker can generate UUIDv5 collisions but cannot force a collision of a chosen UUID. If your usage doesn't serve any security functions then its fine to use an insecure hash function.

One thing I find interesting is that we seem to be at the end of the road for secure hash-based UUIDs. SHA-1 was already truncated (I.E. weakened) from 160 bits to 122 bits to fit the UUID width. To fit a SHA-256 hash you'd need to throw away a majority of the bits!

I remember seeing a request to add nip.io to the PSL (they don't approve requests where the subdomains are IP addresses). What do you think the future of these sorts of services are now that Let's Encrypt offers free IP certificates?

The cookie use case is just one use case. Another PSL use case is helping browsers decide what part of the FQDN is most important for the user to notice. On firefox I see "ycombinator.com" in bold, with normal font weight on the news subdomain. On smaller screens the URL bar isn't left aligned, it adjusts the view to prioritize showing the relevant domain name. You don't want an attacker to control how the URL is displayed in that security context.

One of the complications that gets discussed is that there are way too many use cases with different requirements on what it means for domains to be related. The cookie problem is something browsers need to solve, so its perhaps reasonable that Mozilla (and volunteers) manage a list that focuses on that user case. But that's poorly suited for other use cases.

There's a lot of people thinking about this though. One somewhat related example is https://datatracker.ietf.org/doc/draft-manelidis-dnsop-domai..., which has a double-opt-in DNS TXT record mechanism. That draft and forthcoming discussions on the mailing list are a good place to understand the complexities here.

I've used FreeDNS on occasion for test domain names, one-off experiments, and similar. I'm very appreciative this exists, but there are some pain points that similar services handle better.

The domains are missing from the public suffix list. This impacts how cookies are handled by the domain names, with concerns the browser will allow software to set the cookie on the shared domain name instead of the subdomain. This can be a security problem. Getting added to the PSL may not happen: https://github.com/publicsuffix/list/pull/79

It can be difficult to get a free HTTPS certificate for your subdomain. Let's Encrypt applies per-domain name rate limits and these domain names see lots of issuance requests. There's a process to lift those limits, but last I checked FreeDNS didn't use it. You can still, of course, pay for a certificate.

There's tons of abuse on free domains so you may find that your domain is blocked on various lists.

Here are some compelling alternatives I use now, which manage these issues better:

- https://messwithdns.net/ - Exceptionally well-made DNS console for learning DNS

- https://open-domains.com/ - Uses Cloudflare, great Discord group

- Even more: https://free.hrsn.dev/#/?id=domains

Hey author here, thanks for reading the post. I haven't seen UUIDv5 used very often but I'll have to think about the idempotency angle more.

One thing that concerns me is that UUIDv5 is based on SHA1, which is an insecure hashing algorithm. I generated a pair of colliding UUIDv5s in an earlier post in this series (https://alexsci.com/blog/uuid-oops/#insecure-hash-functions). So I don't think you can use UUIDv5 for security critical functions.

This is a really good time to do a head-to-head comparison of different search engines. The last time I checked Google does not provide search results above the fold, instead showing AI overview, ads, and YouTube search results. Try a different search engine to see which one is giving you the highest signal results and what other junk they put on the page. Personally I use duckduckgo with AI turned off in settings, but it's best to try the experiment for yourself.

One concern about accuracy of the diagrams. In the example, there is a transition back to the session service labelled "wait for release" after the "no" decision. I'm not seeing that in the shown diff.

Looking at the code the "no" seems to relate to the context expiring, so you wouldn't want to wait more if the context already expired, you'd want to stop. Is there a reason that label exists?

I'm pretty wary of LLM development tools hallucinating and wasting my time, is that whats happening in the lease broker example?

The Kanopy model is fascinating. Library members get free views but there are limits as the library has to pay for those views. Our county library system has a Kanopy subscription at each library and county residents are eligible to become members at every location. Kanopy supports adding multiple library cards, so you can boost your limit.

The platform is quite open, so you can build whichever tests you want. Personally I run a dockerized ooni via scheduled GitHub actions, which shows blocks impacting GitHub runners. You should be able to see logs from that here, which shows three blocked websites https://github.com/robalexdev/ooni-unattended-action/actions...

You can build your own lists and share them using ooni run: https://run.ooni.org/

Many of the partners are country focused but the Tor Project, Citizen Lab, and Internet Society are well known to me.

For some of that, you don't need to crawl. Wikipedia offers database dumps which you can download in one go. Lots of programming docs are managed in repos, so you can clone the repo instead. Even stackoverflow seems to have a snapshot dump (https://archive.org/details/stackexchange).

How did I miss zstd?

Here are my benchmarks for 2.3 GB of jsonl, on a laptop. Compressed size, compress time, decompress time; using defaults.

    gzip  7.3%  21s  9s
    bzip2 4.6% 251s 50s
    bzip3 3.3%  82s 69s
    zstd  6.9%   2s  3s
    lzma  4.7%  51s  3s

I was processing compressed .jsonl files recently (JSON lines format). I found that lzma gave a much better compression than gzip or bzip2, which helps for archival costs, but it's challenging to work with as software support is lacking. I do duckdb processing which supports gzip transparently. There's an extension for bzip2, but not for lzma or bzip3.

I ended up using gzip because it's best supported by the software I use and most likely to have support in software I adopt. But it gave the worst compression results of the options I tried. These bzip3 numbers certainly give me FOMO...

That's a bummer.

It looks like they are open to adding the feature and open to outside contributions: https://github.com/desec-io/desec-stack/issues/579

> simply permanently end all service to the concept of subdomains at all

That doesn't sound simple at all.

I think DMARC works well because email tends to blindly trust DNS (opportunistic encryption). On the web we expect authenticated TLS, often strictly enforced (organization policy, HSTS). So it would feel weird if a website changes how it handles HTTPS cookies based on an insecure DNS record, perhaps delivered by the resolver on an untrustworthy WiFi router.

Specifically, if I register subdomain attack.co.uk and set up a malicious WiFi router, I trick some *.co.uk cookies to get set on co.uk and then steal them from attack.co.uk by tampering with the (proposed) SVCB record.

I think the signal needs to be secure, which means DNSSEC. Adding a hard requirement for DNSSEC validation in all web browsers is a huge change from where we are now.

There are limits to how accurate you can make this. Zones like .xyz renew at 18%, so you'd expect 0.2% of those domains to expire without renewal each day. The tranco list is based on a 30 day look-back and I've seen a small percent of those domains lack name servers, even for the latest list.

Similarly, domains can be registered since the last time you downloaded your lists. So you never have a complete or accurate list.

I think it's perfectly reasonable to suggest names that have recently expired or domains that could have been recently registered. The alternative requires an NS lookup.

Official docs cover those:

https://docs.docker.com/engine/network/firewall-iptables/

https://docs.docker.com/engine/install/linux-postinstall/

> Here's a stream of standard.site blog posts coming in over a firehose hosted in Chennai. Every single one.

This stream lacks any blog posts that haven't been specifically published to atproto. Conversely, I see RSS feeds for the content in the stream, like https://bsky.app/profile/did:plc:byf7jvh3yvhffackiumpddtf/rs... (if RSS feeds exists for every profiles then I'd argue that atproto is a strict subset of RSS, but I'm not certain how that feature works). The stream may give you every blog post that was published to atproto, but that's already a small subset of long-form content on the web.

> Notably this is not possible with RSS,

The web supports blog discovery so well that people forget it exists. A simple Google search can find a very large amount of content, much available over RSS/Atom. Many web-based feed readers index the subscriptions across all their users to help with discovery. Here's the Feedland firehose, for example: https://feedland.com/?everything=true

I don't think its helpful to argue how complete the Google index is vs a bluesky firehose though. Most users are drowning in content and discovery is about search and filtering. There's lots of interest right now in vouching for the content of others: https://susam.net/wander/wander.js, https://codeberg.org/robida/human.json, https://www.manton.org/2024/03/11/recommendations-and-blogro..., etc.

I wouldn't say the others lack that feature, they do it differently.

https://docs.joinmastodon.org/user/moving/#move

> more ease of exploration

Absolutely. One good thing going for this approach is that anyone can grab the OPML export (the URL is stable) and build their own frontend, I'd love to see more.

Could be a fun weekend project for frontend folks.

For blog posts, I'd look to RSS instead. That's where that content is traditionally published. Instead of SELECTing from bluesky's index, you can use OPML subscription lists. There are a bunch of places that curate feed lists, so it's significantly less likely to face API death like twitter did.

There are multiple sites that support follower semantics over RSS. Feedland tracks subscriptions publicly, so you can see the blogs I read (https://feedland.com/?username=robalexdev), and who reads my blog (https://feedland.com/?feedurl=https%3A%2F%2Falexsci.com%2Fbl...).

I run another variant which collects OPML blogrolls via crawling, so you can find out who else likes your favorite blog and what else they recommend. Here's the page for Simon Willison's blog (https://blogroll-network.alexsci.com/discover/feed-a34ee2a88...). Thinking of RSS and blogrolls as a network feels much more resilient than blueskys Jetstream api endpoint.

I'll recommend dnscontrol as well, although the post is an unseasonal April fools joke, so helpful suggestions may be out of place.

The is-a.dev project uses dnscontrol to manage a subdomain registration service in GitHub, which is really clever. See https://github.com/is-a-dev/register