The DNS angle is nice and I get why using a TXT record was interesting for you as a replacement.
I don't think simply having data returned was the issue. It was more about the kinds of data it exposed and doxxed from the user - to anyone with access. That and of course the vulnerability that caused the worm to propagate.
That said - we're seeing RCEs in Node, Python, and other common tools now and they're not going the way of the dodo. So maybe finger's time was simply up - and Facebook, Twitter, etc just took over.
Something ironic about pure text, status info, cgi-bin being replaced by long form video of tigers chasing men and riots. That's what our brains are being fed these days.
What pulled me to DNS as a replacement was mostly that DNS is distributed, DNS servers get patched quickly as they are expected to be on the internet and people are just connecting to their local resolver vs. connecting to a port on someones workstation or server. Even if the idea never takes off I could see using it as a niche status update for myself even if nobody ever sees it.
Something ironic about pure text, status info, cgi-bin being replaced
The site I hosted this article on is a CGI script. One day small sites devoid of a CDN could make a come-back but that's a bigger topic that may depend on some societal screws to be tightened a bit more.
instant at the authoritative server, but anyone querying through a recursive resolver could still get the old status until the ttl expires. what ttl would you use for this?
The real challenge is not finding another channel for transmitting personal information. It is finding something else for the FINGER protocol to do. (-:
Nice! Very cool personal image board implementation as well,
I have a personal wiki, but I think something like this is better as it has the potential to be collaborative as well.
I don't think this is a generally safe thing to do. DNS is allowed to be unmoderated because it's supposed to be for technical information only. If too many people starts doing this, someone will start forcing DNS infra to censor it, by OP53B or stricter KYC or legally mandated DNS defederation or anything that may or may not even work.
I've put contact info & jurisdiction for my domains in TXT records at the apex since Hover doesn't actually have whois. I publish dynamic status information in the DNS on a special server outside of the ICANN roots, but it's mostly technical information.
I too am using Firefox on Linux. Are you by chance using a VPN hosted in AWS? I normally let VPS through but AWS has some special abusers that got my attention. I moved that out of the way for now. Thus far 2795 real people and 8888 bots. I have some room for improvement on false positives but we are getting there.
If a site has a large set of TXT records, they can be used by clients that spoof packets to request large volumes of answers by DNS servers. This is called an amplification attack. Many tiny spoofed requests in, many large answers out.
Nah. That's just the lazy-ass traffic filtering policies of poorly-run end-user ISPs. [0] Every end-user ISP knows what IP address ranges it has assigned to each customer. It's fairly trivial to note when the source address of traffic coming from a customer's connection isn't in the range that has been assigned to that connection and drop it on the floor. This stops source address spoofing dead.
RFC 2827 (BCP 38) was published in May 2000. There's no good excuse for end-user ISPs to not be doing this for pretty much all of their customers.
[0] For the purposes of this discussion, I'm declaring that "cloud" providers are ISPs. They provide IP addresses and Internet connectivity to their customers, so they count.
Indeed. For what it's worth the spoofing aspect got better for a while then plateaued. [1] bcp84 / bcp38 adoption has pretty much stalled out. No idea what to do with the remaining ISP's.
Old versions of Safari could get that. I am being an opinionated ass and practicing hostile security paternalism because the safety and bot-filtering benefits outweigh the cost of supporting old clients. I do even stranger things.
iCloud private relay was a blind spot. Working out how to let those proxy ranges in. (I blocked all the CDN's but this is more of a surgical carve-out for specific Apple designated ranges) Extracting those carve-outs now.
Edit: Applied carve-outs for Apple's iCloud private relay proxies. (I think)
If anyone is curious why I have to block CDN's, they permit abusive behavior, abuse of their workers (apps) and other layers of their networks. Maybe in a few decades they will get on it.
What is this altchan.org place? Looks very new. Where's the reply button?
Its just a private fork of an open source anonymous image board. I had a static blog for it but I got bored and moved all my blog posts to the image board. Probably a rather unorthodox experiment. The reply button is at the bottom right. I might change that.
And why do we want finger to exist?
There were discussions in the past about the finger service and how hardly anyone runs it any more and even less likely to be found on the open internet. DNS seemed like a good replacement for it to me as more and more people have domains now and authoritative DNS servers are likely to be more secure and distributed I think. Maybe one day specific groups of people do something like this in place of sites like X. half kidding
Now instead of having a special purpose client, one need only query a DNS record. In this case I use "dig" as the example but there are other DNS tools people might prefer to use.
Just found out macOS has it too. Created a .plan file and used finger on my user name and it showed the plan. There's no fingerd or anything listening on the port though, but it worked locally. Neat.
It's just a shell function so in this case if one had a terminal app that has a shell one could add the function. No idea how feasible that is on a phone.
I've really not written as much as I used to - at least not on my personal blog, but I covered finger there and my nostalgia back in August last year. It also did the rounds on here: https://blog.alexellis.io/the-90s-unix-command-fell-out-of-f...
The DNS angle is nice and I get why using a TXT record was interesting for you as a replacement.
I don't think simply having data returned was the issue. It was more about the kinds of data it exposed and doxxed from the user - to anyone with access. That and of course the vulnerability that caused the worm to propagate.
That said - we're seeing RCEs in Node, Python, and other common tools now and they're not going the way of the dodo. So maybe finger's time was simply up - and Facebook, Twitter, etc just took over.
Something ironic about pure text, status info, cgi-bin being replaced by long form video of tigers chasing men and riots. That's what our brains are being fed these days.
What pulled me to DNS as a replacement was mostly that DNS is distributed, DNS servers get patched quickly as they are expected to be on the internet and people are just connecting to their local resolver vs. connecting to a port on someones workstation or server. Even if the idea never takes off I could see using it as a niche status update for myself even if nobody ever sees it.
Something ironic about pure text, status info, cgi-bin being replaced
The site I hosted this article on is a CGI script. One day small sites devoid of a CDN could make a come-back but that's a bigger topic that may depend on some societal screws to be tightened a bit more.
Fun. But a status needs to be updated semi-frequently and my dns service only offers api mgmt for bigger customers.
I guess I could delegate a zone to another provider who does.
I guess I could delegate a zone to another provider who does.
That's a good idea. One could delegate to a stand alone instance for instant updates.
instant at the authoritative server, but anyone querying through a recursive resolver could still get the old status until the ttl expires. what ttl would you use for this?
what ttl would you use for this?
Something low like 60 to 90 seconds should be fine unless they are an influencer, then we could monitor their live stream.
I don't need it.
* https://news.ycombinator.com/item?id=44916853
The real challenge is not finding another channel for transmitting personal information. It is finding something else for the FINGER protocol to do. (-:
Nice! Very cool personal image board implementation as well, I have a personal wiki, but I think something like this is better as it has the potential to be collaborative as well.
I don't think this is a generally safe thing to do. DNS is allowed to be unmoderated because it's supposed to be for technical information only. If too many people starts doing this, someone will start forcing DNS infra to censor it, by OP53B or stricter KYC or legally mandated DNS defederation or anything that may or may not even work.
Entirely possible. Which countries do you think would be the first to demand censorship?
I've put contact info & jurisdiction for my domains in TXT records at the apex since Hover doesn't actually have whois. I publish dynamic status information in the DNS on a special server outside of the ICANN roots, but it's mostly technical information.
Page does not seem to work with Firefox on Linux, or maybe its just down.
I too am using Firefox on Linux. Are you by chance using a VPN hosted in AWS? I normally let VPS through but AWS has some special abusers that got my attention. I moved that out of the way for now. Thus far 2795 real people and 8888 bots. I have some room for improvement on false positives but we are getting there.
Late response, but I was not using a VPN nor do I have one installed on my system. I was also on my home (Verizon) internet.
> many large TXT records can be abused for DDoS purposes. dig -t txt ebay.com for a DDoS Example used today
What does this mean, I see a bunch in the lookup but I don't understand the ddos part
If a site has a large set of TXT records, they can be used by clients that spoof packets to request large volumes of answers by DNS servers. This is called an amplification attack. Many tiny spoofed requests in, many large answers out.
That's just the braindeqd design of DNS, responding to arbitrary UDP packets without authenticating the IP address of the sender.
Nah. That's just the lazy-ass traffic filtering policies of poorly-run end-user ISPs. [0] Every end-user ISP knows what IP address ranges it has assigned to each customer. It's fairly trivial to note when the source address of traffic coming from a customer's connection isn't in the range that has been assigned to that connection and drop it on the floor. This stops source address spoofing dead.
RFC 2827 (BCP 38) was published in May 2000. There's no good excuse for end-user ISPs to not be doing this for pretty much all of their customers.
[0] For the purposes of this discussion, I'm declaring that "cloud" providers are ISPs. They provide IP addresses and Internet connectivity to their customers, so they count.
Indeed. For what it's worth the spoofing aspect got better for a while then plateaued. [1] bcp84 / bcp38 adoption has pretty much stalled out. No idea what to do with the remaining ISP's.
[1] - https://spoofer.caida.org/summary.php
Seems like I get served gibberish bytes in the response body when visiting this site! I promise I’m not a bot :(
Yep. Doesn't work. Just a bunch of garbage. This is anti-accessibility and user hostile.
[dead]
Old versions of Safari could get that. I am being an opinionated ass and practicing hostile security paternalism because the safety and bot-filtering benefits outweigh the cost of supporting old clients. I do even stranger things.
Doesn’t work on mobile Safari latest version either. At least not when using iCloud private relay.
iCloud private relay was a blind spot. Working out how to let those proxy ranges in. (I blocked all the CDN's but this is more of a surgical carve-out for specific Apple designated ranges) Extracting those carve-outs now.
Edit: Applied carve-outs for Apple's iCloud private relay proxies. (I think)
If anyone is curious why I have to block CDN's, they permit abusive behavior, abuse of their workers (apps) and other layers of their networks. Maybe in a few decades they will get on it.
What is this altchan.org place? Looks very new. Where's the reply button?
And why do we want finger to exist?
What is this altchan.org place? Looks very new. Where's the reply button?
Its just a private fork of an open source anonymous image board. I had a static blog for it but I got bored and moved all my blog posts to the image board. Probably a rather unorthodox experiment. The reply button is at the bottom right. I might change that.
And why do we want finger to exist?
There were discussions in the past about the finger service and how hardly anyone runs it any more and even less likely to be found on the open internet. DNS seemed like a good replacement for it to me as more and more people have domains now and authoritative DNS servers are likely to be more secure and distributed I think. Maybe one day specific groups of people do something like this in place of sites like X. half kidding
Now instead of having a special purpose client, one need only query a DNS record. In this case I use "dig" as the example but there are other DNS tools people might prefer to use.
Because it allows for an easy interface to see what someone else is up to without needing to load a JS-heavy page.
Assuming you have this finger app installed. My Android store does not seem to have one, for example.
Finger is a protocol. It's older than IP.
You can read about it in RFC 742.
Unix, Linux and BSD have finger built in.
Just found out macOS has it too. Created a .plan file and used finger on my user name and it showed the plan. There's no fingerd or anything listening on the port though, but it worked locally. Neat.
If it has a shell and telnet/nc it has finger:
echo user | nc example.com 79
Lynx works too over gopher:
lynx gopher://graph.no:79/0/london
It's just a shell function so in this case if one had a terminal app that has a shell one could add the function. No idea how feasible that is on a phone.
A terminal emulator is more heavy than a dedicated app is
I will leave writing an app to someone else. I've watched others go through all the challenges of getting into app stores and it's just not for me.
Fortunately some phones allow you to install apps, not just get them through the overpriced shit store.
[dead]
[dead]