Notices by Matt Nordhoff (mnordhoff@infosec.exchange)

@GossiTheDog Are you sure that's current? Search results for (part of) that quote come up with an incident from July 2021.

Lines can be commented out by starting the line with a hashtag character (#).

💀

So, yesterday's thing was, DigiCert is dumping IPv6 support after their current CDN, Edgio, went bankrupt.

(2 longstanding companies merged and rebranded onto a colonial .io domain and filed for bankruptcy 2 years later, eh?)

But DigiCert also recently acquired the oft-DDoSed DNS service UltraDNS (to go with the other DNS service they acquired before), which uses Edgio for DDoS protection!

(traceroute an UltraDNS nameserver like pdns196.ultradns.com or b.cctld.us, you may see AS22822/llnw.net near the destination.)

Wonder how that's gonna go.

https://social.elizabeth.cat/notes/a2m7w4bjk1e3newm

The .fun TLD has been a bit broken for a month now. 👍

https://dnsviz.net/d/fun/ZzsFkg/dnssec/

They use a secondary DNS service -- but don't list it in the root zone, so it doesn't really make the TLD more reliable -- and it stopped updating the zone around 2024-10-18 for some reason.

And the three companies involved have yet to fix it for some reason.

So under certain circumstances a small percentage of DNS queries for .fun domains just randomly fail. 🤷

https://vercara.com/news/digicert-completes-acquisition-of-vercara

!?!?!? First DigiCert acquired DNS Made Easy/Constellix, now they acquired Vercara (UltraDNS).

Real loss for competition in the US enterprise DNS market. Now it's just like NS1 (acquired by IBM instead), Akamai, *sigh* Cloudflare, and non-traditional services like Amazon.

(Defining a "traditional" DNS service as roughly one that supports zone transfers, arbitrary record types and static DNSSEC.)

(Meanwhile I continue to lament the non-enterprise-budget personal or small business DNS market.)

Popular controversial hosting company Cloudflare has been reenabling Encrypted Client Hello (ECH) recently. They had announced it with fanfare and then disabled it again with less fanfare.

Almost all of the popular domains with it enabled look NSFW. :blobshrug:

(That domain is not NSFW. Probably.)

Apparently someone noticed and Cloudflare confirmed it 3 weeks ago.