mjl-

7 ms·

31.
by mjl- 2y ago
i develop on linux, on various projects. i'm mostly concerned with all the tools, build scripts and tests that may read sensitive data, or accidentally destroy data. so i'm limiting access to files when working on a project with l
32.
by mjl- 2y ago
Yes, so you use multiple strings (in a single record) if you need longer values: "first 255 bytes" "second 255 bytes" "etc" DNS clients combine the 255-byte strings back into a single string.
33.
by mjl- 2y ago
DKIM records are just DNS TXT records. Do they have a limit on the size of TXT records? Or are they going out of their way to try to parse the TXT records you're adding that look like DKIM records, failing on them, and then refusing to
34.
by mjl- 2y ago
As more mail servers use domain reputation to classify (accept/reject) incoming deliveries (helped with dmarc-like policies), messages from gmail.com will get a harder time getting delivered to mail servers they also try to deliver spa
35.
by mjl- 2y ago
Indeed it's not a great idea to rely on 3rd party services for allow/block-listing. You're giving power to those 3rd parties, and it centralizes email. Ironically, quite some people running their own mail servers use blocklis
36.
by mjl- 3y ago
Wondering what prompted the blog post. The recent publication of RFC 9539? It would be interesting to hear how often the google dns servers see attempts to poison their cache. The mitigations probably prevent folks from even trying, but he
37.
by mjl- 3y ago
this is a long standing problem with mailing lists. they are often configured to add a "[...]" prefix to the subject or add a footer, breaking the dkim signature. this leads some more recently updated mailing lists to always rewri
38.
by mjl- 3y ago
indeed very annoying. my understanding is they don't want to give spammers any signal whether their messages was recognized as ham or spam. i would love some insights in how smart spammers are in actually leveraging such information. m
39.
by mjl- 3y ago
yes, this is a pain. the blocklist operators either seem to be not so good at vetting abuse reports, or cause collateral damage to get network operators to take action (while i don't like getting on a blocklist, perhaps it is having a
40.
by mjl- 3y ago
at least gmail.com has a dmarc policy p=none, so a failing dmarc check is not a reason to reject email. i don't think it's that common for small-scale installs to enforce dmarc policies. there are other signals to use though. plen
41.
by mjl- 3y ago
> The fraction of validating queries is misleading because practically all validation happens in the recursive resolver, which doesn't provide security all the way to the client. At least as far as browser clients goes, we're a
42.
by mjl- 3y ago
> providers managing and custodying keys for their customers, which is security theater isn't that similar to providers managing/having access to the tls keys? well, dns is a bit more essential. but plain dns isn't more s
43.
by mjl- 3y ago
fwiw, i live in a country where rolling out dnssec apparently had some financial incentives for providers, which apparently helped adoption: https://stats.sidnlabs.nl/en/dnssec.html adoption still growing, more than 60
44.
by mjl- 3y ago
You are correct that it is not needed for security. It is also not required for plain DANE. But it is for DANE for SMTP. The reason is interoperability. Apparently, some DNS servers would not respond at all to requests for TLSA records (pro
45.
by mjl- 3y ago
I would also suggest https://www.email-security-scans.org/ for testing outgoing emails.
46.
by mjl- 3y ago
First, DANE requires that your DNS is protected with DNSSEC. Your MX records need to be DNSSEC-protected because otherwise any attacker that can give a sender fake MX records can cause an email message to be delivered to a mail server of th
47.
by mjl- 3y ago
To protect my email with DANE, I ended up running DNS myself. I used to be at AWS Route53. It supports DNSSEC (but quite user-unfriendly). But it does not support TLSA records (!). I'm still curious why, though Route53 is giving off a
48.
by mjl- 3y ago
Interesting thanks. I can imagine that an email sending service wants to be in control of message-id's (would still be interesting to hear the actual rationale). Perhaps SMTP could use an extension with a new (pipelined) command after
49.
by mjl- 3y ago
Why would the Message-ID (that you assign) not work for this purpose? Perhaps the SNS notification doesn't include the message-id?
50.
by mjl- 3y ago
Pitching my own: https://github.com/mjl-/mox has a "mox localserve" subcommand that runs a mail server on localhost for testing, including a pedantic mode and special addresses that cause failure conditions y
51.
by mjl- 3y ago
good point. had me looking for a transparency log for dnssec, arriving at https://www.huque.com/2014/07/30/dnssec-key-trans.html . it seems there hasn't been activity on that topic in years. an attack wou
52.
by mjl- 3y ago
no, scram is all about not exchanging and not storing plain text passwords. the plus variants add tls channel binding.
53.
by mjl- 3y ago
you could run your own dnssec servers (not too hard). and monitor the DS records for your domain at the TLD. have there been any reported cases of law enforcement changing DNSSEC (e.g. adding a DS record)? i agree there's probably no w
54.
by mjl- 3y ago
DANE (with DNSSEC) may be an option to look at too, with public keys in DNS. though probably client support isn't universal (i have no (recent) experience using jabber). the CA was one weak point here. checking for new public keys in c
55.
by mjl- 3y ago
i'm "underdotting" anything that has a tooltip (simple css style). most buttons have a tooltip with a sentence explaining what it does/how it works. but this is in webapps that people use relatively intensively, so they
56.
by mjl- 3y ago
why? screen space. "37h" is much short than the date and time of 37 hours ago. of course, if you write out the age like "37 hours ago", that isn't as useful. software doesn't _have_ to do it badly. the most rec
57.
by mjl- 3y ago
Does anyone know of a tool that guides you with making DNS changes? Before starting it would analyze the current settings (SOA, parent/child NS, DS, DNSKEY, RRSIG, etc and their TTLs), possibly suggest reducing some TTLs, show the when
58.
by mjl- 3y ago
Does anyone know if DNSSEC-validating recursive resolvers will retry (fetch new records) if their cached DNSSEC-related records (e.g. DS) are a certain age and they are seeing a validating error? If they would, problems could autocorrect fa
59.
by mjl- 3y ago
Interesting indeed. What kind of classification would you have in mind? Separate out different types of senders, e.g. friend groups, or professional clients? Or more the personal email, transactional email, newsletter? For bayesian junk fil
60.
by mjl- 3y ago
Sieve seems not powerful enough. I had this though experiment a few days ago: What if you could run code in a sandbox on the server (javascript, webassembly?) with api's (provided by the server) to access mailboxes/messages and to

More ›