@jtk@infosec.exchange

John Kristoff @jtk@infosec.exchange · 6d ago

Ignoring everything else, seems hard to ignore the latency cost introduced here: "The data center then beams AI results generated by the GPUs to satellites and sends them back to land." https://www.theinformation.com/articles/ocean-powered-data-center-startup-set-double-valuation-2-billion?rc=9btsxw&shared=eacd621056a6e353

0

John Kristoff @jtk@infosec.exchange · Aug 05, 2026

Replying to @miniBill@mastodon.uno

@miniBill@mastodon.uno @badsamurai@infosec.exchange @fullywoolly@mastodon.social @syn_rst@norden.social @gayint@infosec.exchange @spamhaus@infosec.exchange I wouldn't recommend using the first list at all, it significantly overblocks (e.g., 174 runs a root server).

0

John Kristoff @jtk@infosec.exchange · Aug 02, 2026

jackceoai on the latest IP prefix transfer

2

1

0

John Kristoff @jtk@infosec.exchange · Aug 02, 2026

@transfers@social.bgp.tools

Nothing to do with actual birds, not the router software, not even Larry Legend. This of course:

"Communications infrastructure your AI agents operate"

1

0

1

0

John Kristoff @jtk@infosec.exchange · Aug 01, 2026

RE: @botgov@mastodon.social

visas is a state dept name, http-only but no content at the moment

2

0

John Kristoff @jtk@infosec.exchange · Jul 31, 2026

Received email spam from newly registered socialdb [dot] xyz. Some kind of escrow racket for wannabe influencers. Looks like if they find an email associated with your Mastodon account you'lll get subscribed to their mailing list. Platform allows you to create an account using an email without verification and set 2fa via Tor. Just saying.

2

1

0

John Kristoff @jtk@infosec.exchange · Jul 31, 2026

Gemini is hungry?

@transfers@social.bgp.tools

3

0

John Kristoff @jtk@infosec.exchange · Jul 29, 2026

ObThought: We could use the equivalent of a doi.org for news articles that could help arbitrate / aggregate access with stable links and if necessary payment to sources.

A large proportion of articles people link to I try to read are often inaccessible for various reasons such as:

Subscription required
Client access IPaddr is blocked
Any ad-blocking fu

2

0

John Kristoff @jtk@infosec.exchange · Jul 29, 2026

Probably not for $50,000 (US)
@transfers@social.bgp.tools

4

0

John Kristoff @jtk@infosec.exchange · Jul 27, 2026

Replying to @PogoWasRight@infosec.exchange

@PogoWasRight@infosec.exchange Do a significant number of those suspects travel to the U.S.? Restrictions on family members might be slightly the more meaningful message here? I'd guess this is more of a statement, and a relatively small baby step in fighting cybercrime outside the border. It may also just be a political statement to the administration's supporters?

2

0

John Kristoff @jtk@infosec.exchange · Jul 27, 2026

Replying to @jtk@infosec.exchange

Someone bid on it, auction ends in less than 24 hours.

2

0

John Kristoff @jtk@infosec.exchange · Jul 27, 2026

#DNS root servers on an observed June 2026 traffic increase: "[...] a representative from the AS responded on July 3rd. They confirmed that the traffic originated from their networks (i.e., was not spoofed) and was the uninten4onal result of recent recursive resolver software updates." https://root-servers.org/media/news/2026-06-29-increase.pdf

10

1

6

0

John Kristoff @jtk@infosec.exchange · Jul 27, 2026

Replying to @SteveBellovin@infosec.exchange

@SteveBellovin@infosec.exchange Is that original script archived anywhere or maybe any of the next nearest descendants?

0

1

0

John Kristoff @jtk@infosec.exchange · Jul 25, 2026

Replying to @IPngNetworks@ublog.tech

@IPngNetworks@ublog.tech @wrmsr@peering.social You could always announce your prefixes with AS8075 in the path, make them drop it for you >:)

0

John Kristoff @jtk@infosec.exchange · Jul 24, 2026

RE: https://infosec.exchange/@dannyjpalmer/116975079605921576 "Disabling web proxy auto-discovery (WPAD) where not required" Why is wpad even still supported by browsers?!? A 30-year-old mechanism, expired I-D almost as old, and the upward namespace traversal nonsense that might be one of the worst uses of the DNS ever devised.

Quoting

Danny Palmer @dannyjpalmer@infosec.exchange

A widespread DNS poisoning campaign is targeting the hotels, conference venues and the hospitality sector with credential harvesting attacks designed to steal corporate login credentials from visitors, researchers have warned. Identified by cybersecurity analysts at ReliaQuest, the campaign begins by targeting routers used to provide public Wi-Fi to visitors to hotels, conference centers and other shared venues frequently visited by corporate employees. These compromised Wi-Fi gateways were identified around the world, including across multiple US cities, India and Saudi Arabia. (Researchers point out that the tactics look suspiciously similar to APT28/Fancy Bear... 👀 ) https://www.infosecurity-magazine.com/news/hotel-wifi-dns-poisoning/ #cybersecurity

Open quoted post

0

John Kristoff @jtk@infosec.exchange · Jul 24, 2026

Weekend Reads

Inside an Internet shutdown https://labs.ripe.net/author/mdkamruzzaman-khan-2/inside-a-shutdown-bgp-evidence-from-an-operator-who-was-there/
Inferring shared IP addresses https://burdantes.github.io/assets/pdf/multi_user_ip-sigcomm.pdf
BGP origin attribute manipulation https://blog.cloudflare.com/bgp-origin-attribute/
IP reassembly congestion DoS attacks https://cispa.saarland/group/rossow/papers/FragJam-usenix2026.pdf
Operators on academic BGP security solutions https://pure.mpg.de/rest/items/item_3719779_1/component/file_3719780/content

#InternetShutdown #NAT #BGP #DoS #RPKI

0

John Kristoff @jtk@infosec.exchange · Jul 24, 2026

Replying to @jtk@infosec.exchange

@benjojo@benjojo.co.uk Found it. The Team Cymru bogon list did have the 192.18.0.0/15 prefix listed up until about 2011 when the error was identified and subsequently fixed. 15 years later it persists!

0

John Kristoff @jtk@infosec.exchange · Jul 23, 2026

Any #PortlandME fedi people involved with #DNS, #BGP, #infosec, or #blues?

0

2

0

John Kristoff @jtk@infosec.exchange · Jul 23, 2026

Replying to @benjojo@benjojo.co.uk

@benjojo@benjojo.co.uk Somewhere there must have been a well-known list with the incorrect /15 a bunch of us copied from. I would have guessed it might have been something we messed up at Cymru, but I can't find an old bogon list to confirm and archive.org seems to returning a lot of 503s today. Older versions of nmap (at least as early as 2013) had the incorrect prefix so this mistake probably was and remains widely deployed. I fixed my old repo and archived just in case. Nice find!

0

1

0

John Kristoff @jtk@infosec.exchange · Jul 22, 2026

Replying to @fanf@mendeddrum.org

@fanf@mendeddrum.org I've used both ivory and icecubesapp. I've found the former to be vastly more stable and reliable compared to the latter. The latter in my experience was unusable for timeline reading due to bugs. Maybe those bugs I care about are gone by now so it's time to reevaluate but updates can be even less frequent than ivory and the open github issues list is very long.

0

John Kristoff @jtk@infosec.exchange · Jul 21, 2026

Replying to @bortzmeyer@mastodon.gougere.fr

@bortzmeyer@mastodon.gougere.fr The firehol lists have been running on autopilot for years. Not really the best data set to use for most serious measurement these days.

0

John Kristoff @jtk@infosec.exchange · Jul 20, 2026

Replying to @nygren@hachyderm.io

@nygren@hachyderm.io Very early in my career the old timers used to complain about things like Ethernet having no debugging and the web having no proper transaction mechanisms. They forgot to complain about the very loosely defined and practiced DNS requirements.

3

0

John Kristoff @jtk@infosec.exchange · Jul 16, 2026

Replying to @paul_ipv6@infosec.exchange

@paul_ipv6@infosec.exchange "The foul-up has been attributed to an end-of-life Symmetricom SyncServer S300 time synchronisation server. It comes as Telstra CEO Vicki Brady revealed the telco had known about a GPS rollover bug with the server, but did not replace it." That is description I've seen so far. Sounds plausible.

2

1

0

John Kristoff @jtk@infosec.exchange · Jul 16, 2026

Replying to @resingm@infosec.exchange

@resingm@infosec.exchange Not the same argument at all. IP address resources are just numbers, but because they are associated with real hosts, domain names, and all the associated traffic they receive or emit, and in the case of v4 not so readily available, their value profile is very different.

3

0

John Kristoff @jtk@infosec.exchange · Jul 15, 2026

Replying to @bms48@mastodon.social

@bms48@mastodon.social Not sure you'll find many shell account providers anymore. Maybe ask a friend with a VM? Or if you want to rent one yourself, 1984 and flokinet are two options in Iceland for starters.

0

John Kristoff @jtk@infosec.exchange · Jul 15, 2026

Networking numerology

0

John Kristoff @jtk@infosec.exchange · Jul 15, 2026

Replying to @christopherkunz@chaos.social

@christopherkunz@chaos.social Any 3-digit ASN or less is kind of cool to say you have, but 1) if you weren't the original assignee it is much less cool and 2) there should be relatively little practical value for any number. Maybe someone can come up with some scheme where you'd derive some practical benefit. I can't think of any really good reason. Maybe nets will be more likely to peer with you if you have a low number? Or maybe some nets that never update their configs set LOCALPREF for certain ASNs?. Or threatintel reputation systems have magic/golden/exception rules for certain ASNs? None of these things I can think of seem likely a sufficiently good reason to spend a premium on a magic combination of bits.

1

0

John Kristoff @jtk@infosec.exchange · Jul 15, 2026

IPv4.Global is having an auction for #AS8100, which was used by the now defunct hosting provider QuadraNet. Starting bid $50,000 (US). Some, but very very few ASNs should have a greater than standard RIR fee value for vanity reasons or maybe because of who had it (and you expect to get some value out of that historical reputation). 8100 has no special value imo. I'd also go as far to say, anyone bidding in this auction and ultimately paying a premium for this ASN is a fool.

2

5

0

John Kristoff @jtk@infosec.exchange · Jul 14, 2026

Replying to @rene_mobile@infosec.exchange

@rene_mobile@infosec.exchange DoW is a secondary name now, only an act of Congress can change the primary name which remains the DoD. Presumably a new administration of a different party will rescind the exec order for the DoW name.

0

2

0

John Kristoff @jtk@infosec.exchange · Jul 14, 2026

Replying to @bortzmeyer@mastodon.gougere.fr

@bortzmeyer@mastodon.gougere.fr Letter to investors suggesting weaker than expected profits to be reported.

0

John Kristoff @jtk@infosec.exchange · Jul 14, 2026

Shares of #IBM have dropped about 25% today. Biggest single day drop ever. A generation ago this would be huge news, but we don't talk or think about IBM like we used to in the tech industry.

2

1

0

John Kristoff @jtk@infosec.exchange · Jul 13, 2026

Replying to @jtk@infosec.exchange

And gone from the me. zone. telegram.me WHOIS, which I believe is related, shows the same state, but still resolves. Not a telegram user or fan so I'll defer to others to dig into this more.

3

0

John Kristoff @jtk@infosec.exchange · Jul 13, 2026

whois t.me | grep Status | head -5 Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited Domain Status: serverHold https://icann.org/epp#serverHold Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

3

1

0

John Kristoff @jtk@infosec.exchange · Jul 11, 2026

Weekend Reads

* ICMP tunnel bypass in LTE nets
https://arxiv.org/abs/2607.04783
* Abuse in the standards process
https://sphericalcowconsulting.com/2026/07/07/when-process-stops-protecting-the-work/
* Monitoring DNS registry mutations
https://www.sidnlabs.nl/nieuws-en-blogs/thesis-monitoring-dns-registry-mutations-with-an-ensemble-anomaly-detection-framework
* Why orbital data centers are hard
https://spectrum.ieee.org/orbital-data-centers-heat
* OONI's approach to bad measurements
https://ooni.org/post/2026-faulty-measurements/

#ICMP #Standards #DNS #DataCenters #OONI

7

0

1

0

John Kristoff @jtk@infosec.exchange · Jul 10, 2026

As far as I can tell, United Airlines doesn't have any public #IPv6 space.

https://aws.amazon.com/blogs/networking-and-content-delivery/how-united-airlines-solved-ip-exhaustion-with-private-nat-gateway/

"United Airlines’ existing infrastructure (AWS routing, monitoring, security policies) is built on IPv4 across hundreds of accounts. However, adopting IPv6 is an organization-wide decision at United Airlines."

Translation "We see nails, we love hammers"?

5

4

1

0

John Kristoff @jtk@infosec.exchange · Jul 10, 2026

I've noticed access to fsf.org and gnu.org through Tor (e.g., torify, onion browser) is unreliable. As in the connection is often refused. I'm not sure if this is a recent change at the content end, perhaps due to this: https://www.fsf.org/blogs/community/blocking-botnets-with-reaction The number of sites and content nets that are becoming inaccessible via Tor and what I've used as "jump" hosts (i.e., my personal proxies) seems to only be increasing. Unless someone beats me to it or points me at an existing "blocked via [tor/jumphost]" monitor, I might look at the scope of this problem further and write up some initial findings in a blog.

4

0

John Kristoff @jtk@infosec.exchange · Jul 10, 2026

Replying to @sahil@morii.sahilister.net

@sahil@morii.sahilister.net Some words from recently former Googler @menscher@infosec.exchange says some things things here. He may be able to point to more. https://nanog.org/events/nanog-80/content/2229/

0

John Kristoff @jtk@infosec.exchange · Jul 10, 2026

An edu block to lambda.ai https://social.bgp.tools/@transfers/statuses/01KX52W18SZR1PRDXAPYJANK57

3

0

2

0

John Kristoff @jtk@infosec.exchange · Jul 09, 2026

Replying to @briankrebs@infosec.exchange

@briankrebs@infosec.exchange I'm told that name is retired, cve.org (which it does redirect to) is the one to use instead.

3

1

0

John Kristoff @jtk@infosec.exchange · Jul 05, 2026

Replying to @tubsta@social.bsdlab.au

@tubsta@social.bsdlab.au @hkrn@mstdn.social @stucchimax@social.secret-wg.org @phessler@bsd.network Be careful what you ask for. The IEEE had the foresight to charge $1000 US for OUIs to dissuade every grad student from getting their own, but cheap enough to be essentially inconsequential to real card vendors. There is a real administrative burden on RIRs, arguably much more so than there is for OUIs. Now, probably the bigger concern isn't the grad students, but the potential harm in Internet security and stability. What are reasonable RIR administrative fees to limit pollution, abuse, and bad actors while making the costs a minor part of the budget for serious networks?

1

0

John Kristoff @jtk@infosec.exchange · Jul 02, 2026

Replying to @paul_ipv6@infosec.exchange

@paul_ipv6@infosec.exchange That one has been going around for awhile, since at least 2022 :-)

1

0

John Kristoff @jtk@infosec.exchange · Jun 30, 2026

Replying to @lw@mastodon.bsd.cafe

@lw@mastodon.bsd.cafe Would a virustotal (or similar service) search suffice?

0

John Kristoff @jtk@infosec.exchange · Jun 29, 2026

Small Minneapolis-based #hosting provider MadGenius (#AS55154) is shutting down at the end of July. "[...] we no longer find our hosting services viable to maintain."

0

John Kristoff @jtk@infosec.exchange · May 26, 2026

RE: @jtk@infosec.exchange

I made a final update to the draft. Read the criticism section for more, but this should tell you all you really need to know:

"The author(s) have decided to forgo further work on this document. The ideas expressed herein have been largely deemed unnecessary, redundant, impractical, or undesirable. A Criticism section details this reasoning for posterity"

and

"The following individuals provided an array of feedback to help improve this document, and to help clarify what a dumb idea it is: [...]"

5

2

0

John Kristoff @jtk@infosec.exchange · May 23, 2026

Replying to @kernellogger@hachyderm.io

@kernellogger@hachyderm.io That is my expression of how infrequent it is that old tech is deprecated and functionality removed from service. I'm thinking specifically about some cases (not Linux kernel specific) where the continued existence of code or functionality becomes a liability. I'm happy to see this remain if it is still used and maintained without any consequences for the evolution of the kernel. Poor wording choice on my part.

1

0

John Kristoff @jtk@infosec.exchange · May 23, 2026

Weekend Reads

* Data centers in Utah
https://ricci.pckt.blog/datacenters-in-utah-a-photo-essay-gehy55y
* Encrypted DNS at OARC 46
https://www.potaroo.net/ispcol/2026-05/adox.html
* The Internet runs on names
https://arxiv.org/abs/2605.15646
* IP address geolocation accuracy analysis
https://arxiv.org/abs/2605.21937
* IETF RFC 9969 - IAB AI-CONTROL workshop report
https://www.rfc-editor.org/info/rfc9969/

#DataCenters #Utah #DNS #Geolocation #AI

5

1

9

0

John Kristoff @jtk@infosec.exchange · May 22, 2026

RE: @greynoise@infosec.exchange

The "strongest" list referred to in this article has been effectively unmaintained for about eight years. :-)

6

0

John Kristoff @jtk@infosec.exchange · May 22, 2026

RE: @kernellogger@hachyderm.io

This is kind of too bad. The natural decay of things in tech can take a very long time before we can say they are truly gone and are free from us having to support them. Never underestimate the installed base.

3

2

0

John Kristoff @jtk@infosec.exchange · May 21, 2026

"The company has less need for middle managers, operations jobs and other ‘measuring’ positions." - Matthew Prince, #Cloudflare

https://www.wsj.com/opinion/how-i-choose-which-cloudflare-employees-to-replace-with-ai-40a197e5?st=wfuf1k

3

0

1

0

John Kristoff @jtk@infosec.exchange · May 19, 2026

Replying to @paul_ipv6@infosec.exchange

@paul_ipv6@infosec.exchange @campuscodi@mastodon.social Maybe they are trying to be cute, but I wouldn't be surprised to hear a Nathan Thurm response "I know that. You don't think I know that?!" :-)

1

0

John Kristoff

Posts

Remote instance

Media