RE: https://infosec.exchange/@mnordhoff/116555565439496750

.name may not be popular, but this is a shocking new low and betrayal of the public by ICANN and Verisign.

What is the point of buying a .com or .net domain name if Verisign might get bored one day and cancel it? And ICANN will say "lol, lmao"?

(And I didn't mention shutting down the email forwarding service in my previous post, which is equally unacceptable if anyone still uses it but I don't know what to say.)

What do ICANN and Verisign's leadership think their jobs are?

Verisign operated .name from the beginning and later chose to acquire Global Name Registry outright, but now the original customers can go fuck themselves apparently.

(And .name's lack of popularity itself could, perhaps, be something Verisign could be criticized for.)

RE: https://mastodon.social/@jpmens/116555485080095019

It's one thing to discontinue new registrations, but it's really horrible for a registry to delete existing registrations. You have one job! You're messing up people's lives!

New dream in life: :blobidea: Move to opposite hemisphere.

My birthday's in winter, which I... never used to have strong feelings about, really. But I haven't been enjoying Plague Season since 2020. Bit of an upturn in Plague and a downturn in fun.

Good news: As of yesterday, 15 March, Certificate Authorities are required to validate DNSSEC.

Bad news: That means they weren't before!

It's a potential real improvement to the security of the web PKI. Some CAs validated before (Let's Encrypt always has!) but domain owners couldn't prevent issuance by weak link CAs that didn't validate.

https://cabforum.org/2025/06/18/ballot-sc-085v2-require-validation-of-dnssec-when-present-for-caa-and-dcv-lookups/

DNS Tip: If you use anycast routing to ensure all client traffic is sent to the opposite side of the world, and all of your DNS servers are as slow as possible, you naturally rate-limit busy clients with no software or hardware changes or increased memory use.

If RTT is 300 ms, for example, one individual client won't send more than 3 requests per second!

This optimization method is widely deployed by major ISPs and authoritative DNS providers.

https://www.paypal.com/signin?locale.x=en_US just returns "Please enable JS and disable any ad blocker". That's new!

"Protect against malicious AI and build trusted relationships with verified bots & AI agents. Keep digital experiences free from cyberfraud across websites, mobile apps, ads, and APIs.", their service provider says.

Block real humans, but build trusted relationships with verified bots! So nice to know how much I'm worth.

The benevolent leaders of https://infosec.exchange/ set an 11,000 character limit on posts, if you were wondering.

Lengthy update on https://health.aws.amazon.com/health/status earlier. It begins:

Mar 02 4:19 PM PST We are providing an update on the ongoing service disruptions affecting the AWS Middle East (UAE) Region (ME-CENTRAL-1) and the AWS Middle East (Bahrain) Region (ME-SOUTH-1). Due to the ongoing conflict in the Middle East, both affected regions have experienced physical impacts to infrastructure as a result of drone strikes. In the UAE, two of our facilities were directly struck, while in Bahrain, a drone strike in close proximity to one of our facilities caused physical impacts to our infrastructure. These strikes have caused structural damage, disrupted power delivery to our infrastructure, and in some cases required fire suppression activities that resulted in additional water damage. We are working closely with local authorities and prioritizing the safety of our personnel throughout our recovery efforts.

In the ME-CENTRAL-1 (UAE) Region, two of our three Availability Zones (mec1-az2 and mec1-az3) remain significantly impaired. The third Availability Zone (mec1-az1) continues to operate normally, though some services have experienced indirect impact due to dependencies on the affected zones. In the ME-SOUTH-1 (Bahrain) Region, one facility has been impacted. Across both regions, customers are experiencing elevated error rates and degraded availability for services including Amazon EC2, Amazon S3, Amazon DynamoDB, AWS Lambda, Amazon Kinesis, Amazon CloudWatch, Amazon RDS, and the AWS Management Console and CLI. We are working to restore full service availability as quickly as possible, though we expect recovery to be prolonged given the nature of the physical damage involved.
…

They added "Avoid use in operations." to https://www.example.com/ :blobthinkingeyes:

time.cloudflare.com is also back to its normal accuracy now from my perspective(s).

https://tf.nist.gov/tf-cgi/servers.cgi has been updated to say Gaithersburg is normal.

Bonus: They also added IPv6 to time-f-g.nist.gov.

I think NIST fixed the Gaithersburg, MD, US NTP servers. Or at least time-d-g.nist.gov, I didn't check the others.

UTC time and offset:

2025-12-09 21:59:52  10 ms
2025-12-09 22:00:56  10 ms
2025-12-09 22:02:00  2 ms
2025-12-09 22:03:05  0.5 ms
2025-12-09 22:04:09  -0.9 ms
2025-12-09 22:05:14  -0.9 ms

The status page said (and still says) "ETA repair 9 Dec 2025" but I didn't want to, like, apply pressure by publicizing it.

This is, by the way, less than a month after the time servers hosted at JILA/University of Colorado were turned off due to failure of the atomic clock there.

https://groups.google.com/a/list.nist.gov/g/internet-time-service/c/y0smqm7W1J4

So NIST is down to 2 sites at the moment, also in Colorado.

USNO (the military) also has public stratum 1 NTP servers in two other locations (one of which is in Colorado because everyone loves Colorado), and of course there are many other stratum 1 time servers in the United States (probably mostly using GPS/GNSS).

RE: https://infosec.exchange/@mnordhoff/115675202677067879

https://groups.google.com/a/list.nist.gov/g/internet-time-service/c/Zd7VaR-vqV4

On Saturday, 6 December 2025 at approximately 21:13 UTC, the atomic time source (a single cesium beam atomic clock) for all the internet time servers at the NIST Gaithersburg campus failed and exhibited a time step of approximately -10 ms.

Oh.

time.cloudflare.com suddenly 5-10 ms off the real time in the eastern US.

I'd guess probably something boring, like network asymmetry near the top of the tree (bottom of the tree?).

(When the service was new, the accuracy was routinely worse than this.)

oh hey, DNS4EU has been added to Google Chrome's built-in DoH server list. Just the main "protective" endpoint, not the ad-blocking one, in case you were wondering.

https://source.chromium.org/chromium/chromium/src/+/84aec82132ee71a486fe7c26e62682f989343003

https://issues.chromium.org/issues/441896736

The documentation says something is "not supported at this time".

I wrote a forum post asking, "If I try it and it works now, can I count on Hyrum's Law to ensure it continues working"?

If any of the engineers ever see the post, I'm sure they will love it and me, and not delete my account.

https://domainnamewire.com/2025/11/17/pir-org-tax-return-new-identity-digital-contract-about-1-per-domain/

Wow.

Piggybacking on that to pivot to my favorite rant, I love how registry backend operations are ruthlessly competitive, and the domain registration industry is partly ruthlessly competitive, and then people turn around and lie that there's nothing sus about extremely profitable monopoly registry contracts.

Identity Digital, backend operator, is now making $1/year on .org domains. Identity Digital, registry and backend operator, is making $25/year on .social domains. I wonder what the difference could be.

(I'm not criticizing PIR here.)

https://health.aws.amazon.com/health/status

Oct 20 2:01 AM PDT We have identified a potential root cause for error rates for the DynamoDB APIs in the US-EAST-1 Region. Based on our investigation, the issue appears to be related to DNS resolution of the DynamoDB API endpoint in US-EAST-1. We are working on multiple parallel paths to accelerate recovery. This issue also affects other AWS Services in the US-EAST-1 Region. Global services or features that rely on US-EAST-1 endpoints such as IAM updates and DynamoDB Global tables may also be experiencing issues. During this time, customers may be unable to create or update Support Cases. We recommend customers continue to retry any failed requests. We will continue to provide updates as we have more information to share, or by 2:45 AM.

Wellp, they are blaming the DNS. 💀

https://status.linode.com/incidents/42qhqghw7y1f

I don't want to be mean to these folks in particular, but the Internet is so cursed.

"Akamai deployed a configuration change to a router in our Oslo data center (DC) at around 10:30 UTC on August 27, 2025. Following this change, Compute and CDN services across multiple geographic regions started experiencing availability issues since the change resulted in certain congesting points in the Akamai network."

"CDN disruptions were most prominent in Australia..."

Australia?! The source of the problem was in Oslo!