Patrick Mevzek

"Do not go gentle into that good night."

Flying in registration and resolution planes since 1997.

Duduk fan.

Public Key

npub1jxl9c9d0xnj5ced3fztk8wkd5pwrrvd4q3hqcpmukwhpfrfprkzs9kz9a2

NIP-05 Address

pmevzek@framapiaf-org.mostr.pub

Profile Code

nprofile1qqsfr0juzkhnfe2vvkc539mrhtx6qhp3kx6sgmsvqa7t8ts535s3mpgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dspx3x98

Publishing to

relay.nostr.bg

relay.damus.io

nos.lol

Author Public Key

npub1jxl9c9d0xnj5ced3fztk8wkd5pwrrvd4q3hqcpmukwhpfrfprkzs9kz9a2

Show more details

Last Notes

2026-02-12 21:08:10 UTC

- reply

@nprofile…2hpy You need `\U`. `\u` can be used only with 4 hex digits hence up to `\uFFFF`. Anything above, like U+1F534 needs `\U` that accommodates 8 hex digits. `python -c 'print("\U0001F534")'` works as expected and displays the character. See https://docs.python.org/3/howto/unicode.html#unicode-literals-in-python-source-code for all details.

2026-02-02 17:07:24 UTC

- reply

@nprofile…ntm0 "It’s so annoying that they basically hand out IP addresses if you want them". No, not the case today. You have to be a member of RIR and prove use of IPs, and certainly not for scarce IPv4 addresses. Plus that space is far from litigation/problems, see the Afrinic saga? "ICANN is a shitty company anyways" but it is not a company at all… ICANN is a late 199X invention. Noone saw needs of regulations there before the Web exploded in use. Alternative would/could have been the UN/ITU…

2025-08-19 19:05:33 UTC

- reply

@nprofile…528n @nprofile…xg7q Because not all #TLD registries joined the #RDAP fiesta 🙂 ? And in theory even a change of registrant, or maybe even DNS provider (or MX records) should trigger a "emails on this domain are not verified anymore" situation. As it should trigger certificates revocation too, which won't happen (hence shorter lifetimes as a solution).

2025-07-16 23:22:58 UTC

- reply

@nprofile…salt Lots of examples from @nprofile…y9me in his recent presentation: https://www.icann.org/en/engagement-calendar/details/icann-webinar-series-for-europe-bizarre-and-unusual-uses-of-the-dns-2025-05-21 and his former study: https://labs.ripe.net/author/pgl/the-joy-of-txt/

2025-07-16 22:12:58 UTC

- reply

@nprofile…8wcz "Hah! I predicted years ago that attackers would leverage DNS like this! " DNS tunnels by TXT records (which is just the same thing as encoding malware inside TXT records) were shown by Kaminsky in 2003, and it was known even before that… See https://www.slideshare.net/slideshow/bh-eu-05kaminsky-5939200/5939200 ; there is really nothing new in this field and I hope it is not the "hexadecimal encoding" (rotfl) that is presented as the novelty there.

2025-07-07 14:32:45 UTC

- reply

@nprofile…fn2v @nprofile…ped7 Do note/remember that validity will decrease. Per public generic rules, in 2029, 47 days will be the max of validity and certificates life will decrease until then progressively. Not sure what LE policy will be, but they also allow/will allow as an option 6-days validity certificates. So, in short, yes, you need to automate.

2025-07-03 22:00:54 UTC

- reply

@nprofile…528n Car les budgets du Pentagone ont été bloqués par DOGE :-) ? Au-delà de la blague, cet article explique comment les rumeurs sur les OVNIS étaient un moyen simple de cacher des recherches secrètes (quand ce n'était pas juste pour le lolz et l'audimat, comme Roswell) : https://archive.ph/2025.06.07-021826/https://www.wsj.com/politics/national-security/ufo-us-disinformation-45376f7e?st=28Hj5L ; et puis 1950 c'est aussi la guerre froide (ce qui a des impacts psychologiques), et de nos jours elle est très réchauffée...

2025-07-02 23:21:51 UTC

- reply

@nprofile…528n Première fois que `mq`, `gp` et `gf` sont potentiellement redélégués (en tout cas ouvert à l'être) ?

2025-05-30 15:34:45 UTC

- reply

@nprofile…528n C'est pour les gens indécis qui ont à la fois les "pro" et les "con" pour tout sujet? (pour et contre en anglais) 🙂 ?

2025-04-24 15:50:26 UTC

- reply

@nprofile…ct7c Une lettre très utilisée dans le français…

2025-04-07 17:12:44 UTC

- reply

@nprofile…528n C'est plutôt la série « on découvre toujours des choses sur bind » car la documentation dit bien que c'est une fonctionnalité spécifique et propriétaire de bind, utilisant en plus un terme prêtant à confusion car ayant un autre sens dans le DNS comme l'autre fil l'a montré.

2025-04-07 14:26:08 UTC

- reply

@nprofile…qtg4 Could be monkey in the middle as well 🙂

2025-03-28 17:37:35 UTC

- reply

@nprofile…fpf4 Like `kp` you mean? 🙂

2025-03-28 01:02:29 UTC

- reply

@nprofile…emwt Yes it is. In less than a month (April 15th) Google Registry will stop providing it, you need to use #RDAP. #ICANN lifted the requirements for it recently, so now all #gTLD registries, and registrars can start decommissioning this 40+ years old service as successor does everything more and better.

2025-03-19 15:10:13 UTC

- reply

@nprofile…ct7c @nprofile…528n "A company bought a TLD and actually uses it. What a day. 🤨" And some go overboard with it: https://domainincite.com/30838-toshiba-goes-all-in-on-its-dot-brand . Next: www.web.toshiba website 🙂 ?

2025-03-13 14:38:45 UTC

- reply

@nprofile…ct7c @nprofile…nnj9 @nprofile…528n Mais il y a `whois.nic.xn--tckwe` en tout cas d'après l'IANA à https://www.iana.org/domains/root/db/xn--tckwe.html

2025-03-13 13:44:01 UTC

- reply

@nprofile…nnj9 @nprofile…528n @nprofile…ct7c 仕手株.コム but 0 clues what the website is telling about.

2025-03-10 20:48:53 UTC

- reply

@nprofile…ct7c @nprofile…528n Plié par l'IETF depuis longtempts grâce a PRECIS. Qu'apparemment personne ne connaît :-( . Mais peut-être trop abstrait.

2025-02-27 13:42:08 UTC

- reply

@nprofile…528n Cloudfalre a pourtant souvent des certificats avec des dizaines de noms (dans leur offre gratuite il cumule des noms épars). Là tout de suite sur `orange.fr` je ne récupère qu'un certificat avec 4 noms dans le SAN, donc c'est "corrigé". Un lien vers un certificat spécifique ?

2025-02-27 13:28:15 UTC

- reply

@nprofile…528n @nprofile…adlu GitHub fait pareil: toute tentative pour laquelle on n'a pas les droits suffisants (accès à dépôts privés) donne une page 404, je suppose pour "cacher" l'existence (enfin l'information de l'existence ou non) du-dit dépôt. Ca casse un peu le modèle HTTP mais c'est pour la "sécurité" 🙂

2025-02-24 14:43:31 UTC

- reply

@nprofile…528n @nprofile…seqg @nprofile…lvw7 @nprofile…ud6s @nprofile…g8zh "Cela n'est vrai que tant que les autres serveurs continuent à s'alimenter sur A". En cas de "problèmes" sur quoi d'autres pourraient-ils s'alimenter :-) ? D'autant que 3/4 des autres opérateurs sont des entités américaines de toute façon aussi. C'est de toute façon aussi théorique que les plaintes dans procès sur du terrorisme qui avaient demandé en rétribution de récupérer le contrôle du `.ir`.

2025-02-24 14:29:59 UTC

- reply

@nprofile…seqg @nprofile…lvw7 @nprofile…ud6s @nprofile…g8zh "il aura à coeur de controler les serveurs racines des noms de domaines". Trop tard. Il n'y a qu'un serveur à contrôler, le A, géré par une société américaine (Verisign).

2025-02-16 18:34:55 UTC

- reply

@nprofile…lx5n "For example, a client certificate has to be signed with a key stored on the server." So each "certificate" is specific to one server? That doesn't scale, plus is possible today trivially already. Certificates can be issued by any private/local/limited CA, that just has to be trusted on each side. You seem to infer protocol problems from bad implementations, so the outcome will be rehash of what exists today... just without implementations 😞 Also see PSK mode of operations.

2025-02-16 18:24:20 UTC

- reply

@nprofile…lx5n So what is presented to the server then from the browser? Precisely. I suspect you are just reinventing TLS...

2025-02-14 15:35:22 UTC

- reply

@nprofile…lx5n "The browser presents the public key to the server on request." Hence each browser can then impersonate every user on every other server!

2025-02-12 20:34:40 UTC

- reply

@nprofile…528n IMHO, dans l'exemple `dig @k.root-servers.net g.root-servers.net AAAA` ne serait-il pas mieux d'utiliser une adresse IP plutôt que le nom du résolveur car sinon ca ressemble plutôt à un cercle vicieux (dig doit déjà résoudre `k` ou le connaître avant même de pouvoir chercher `g`)

2025-02-11 17:15:13 UTC

- reply

@nprofile…ct7c Et ils sont audacieux dans la combo fatale wildcard + CNAME + DNSSEC.

2024-07-31 14:20:18 UTC

- reply

@npub19lt…qfjk The registry lists `com.ss` as 2nd level, not `co.ss`, see "What are the various .SS third levels?" in https://nic.ss/faqs/

2024-03-20 21:02:38 UTC

- reply

@npub1jw5…9fry It is already dubious, if it appears (and is authoritative there) in DNS, why it has to be in RDAP, as this seems to have more drawbacks (DNS and RDS have no reason to be publishing updates synchronously and at same frequency) than benefits. I doubt the TTL extension will be offered by lots of registries (probably none I would bet - there are already parts of secDNS extension about signature lifetimes NOT offered by any registry), so the point will be mostly solved that way.

2024-03-05 00:40:35 UTC

- reply

@npub1qw7…q0ue If you look at current live statistics, #ECDSA-P256 is used far more than #Ed25519. See https://stats.dnssec-tools.org/#/?dnssec_param_tab=0 and https://stats.dnssec-tools.org/#/?dnssec_param_tab=1 ; as for guidance, if not known, RFC 8624 should be a good start.

2024-01-06 17:43:49 UTC

- reply

@npub1836…8jp6 "actual real domain registrars whose whole business is just domain names." Happy to be proved wrong but I don't think there is anymore any ICANN accredited registrar that solely sells domains names and nothing else by the side. Might be different in ccTLDs, but I doubt it.All do webhosting, emails, etc. But otherwise your point is indeed very solid and that advice should be followed. However people also want the convenience of only one provider and one bill so will let one do everything.

2023-08-04 15:13:39 UTC

- reply

@npub1jw5…9fry A priori c'est possible avec n'importe quel flux HTTP, dès 1.1 (HTTP Pipelining). Si le serveur n'est pas fracassé évidemment. Ca existe même en EPP :-)