John Kristoff

UIC PhD candidate | Dataplane.org | Verisign
#BGP #DNS #infosec and bit mechanic
#Blues / #Chicago / #tfr / #fedi22
Views are my own

Homepage: https://dataplane.org/jtk

Public Key

npub1hrhc2vw07plyvcaj3knv6a4s0xf7txx98wyhufvg33hha7arr7nsu2jqnu

NIP-05 Address

jtk_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqst3mu9x88lqljxvwegmfkdw6c8nyl9nrznhzt7ykygcmm7lw33lfcprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntvv6ta3

Publishing to

relay.momostr.pink

Author Public Key

npub1hrhc2vw07plyvcaj3knv6a4s0xf7txx98wyhufvg33hha7arr7nsu2jqnu

Show more details

Last Notes

2026-07-27 19:48:31 UTC

#DNS root servers on an observed June 2026 traffic increase:
"[...] a representative from the AS responded on July 3rd. They confirmed that the traffic originated from their networks (i.e., was not spoofed) and was the unintentional result of recent recursive resolver software updates."
https://root-servers.org/media/news/2026-06-29-increase.pdf

2026-07-15 15:58:10 UTC

Networking numerology
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/924/809/543/276/898/original/f9bf59f51b438a5e.png

2026-07-10 18:54:24 UTC

As far as I can tell, United Airlines doesn't have any public #IPv6 space.
https://aws.amazon.com/blogs/networking-and-content-delivery/how-united-airlines-solved-ip-exhaustion-with-private-nat-gateway/
"United Airlines’ existing infrastructure (AWS routing, monitoring, security policies) is built on IPv4 across hundreds of accounts. However, adopting IPv6 is an organization-wide decision at United Airlines."
Translation "We see nails, we love hammers"?

2026-07-09 19:25:31 UTC

- reply

I'm told that name is retired, cve.org (which it does redirect to) is the one to use instead.

2026-05-27 17:52:30 UTC

#Hosting provider just.hosting (aka justhost.ru and baxnet #AS26383) is abruptly shutting down 10 geographical diverse locations and moving customers to the next nearest location. Upstream connectivity in at least some locations was run through WorkTitans, maybe you've heard of them?

2026-05-17 15:34:12 UTC

- reply

My condolences. I wish I had the opportunity to have met him in person, what an extraordinary life.
Lauren, as an outsider and only having observed from a distance, I had kind of assumed you might be the natural successor to take over the digest. No idea if that is practical, but your many valuable contributions to it have been noticed.

2026-05-08 03:17:20 UTC

- reply

Reports in the last hour that logins were working again.

2026-04-25 11:04:27 UTC

- reply

This was the interesting bit:
"My previous router had IPv6 disabled, and all my firewall rules were configured for IPv4. I switched to a new router, and it had IPv6 turned on by default."

2026-04-02 19:52:28 UTC

You might not like this one, I believe this is an AI training org and has been spreading IP4 prefixes around to be announced and originated by big broadband providers.
https://social.bgp.tools/@transfers/statuses/01KN7R98TTMGET2E47SCND67FJ

2026-03-23 21:30:39 UTC

In case people block my recent boost, thought it worth repeating:
An update to the FCC list of equipment and services that "pose an unacceptable risk to the national security" now includes:
"Routers produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS."
https://docs.fcc.gov/public/attachments/DA-26-278A1.pdf

2025-11-27 03:02:59 UTC

New (very minimal) Internet-Draft submitted: ASN Prefix-based Addressing for IPv6
"This document describes a method and policy for ASN prefix-based addressing for IPv6."
If this goes anywhere I expect it will change, and grow, markedly.
https://datatracker.ietf.org/doc/draft-kristoff-v6ops-asn-based-addressing/
#IPv6

2025-11-08 01:51:00 UTC

- reply

There's another way. Upstreams and neighbors could depeer and refuse to accept BGP routes. Remember nets like McColo or InterCage didn't go away because of sanctions.

2025-11-03 20:39:23 UTC

- reply

That .su was the #2 TLD between .com and .net last week tells you all you need to know.
https://radar.cloudflare.com/tlds?dateStart=2025-10-26&dateEnd=2025-11-01

2025-09-12 13:13:04 UTC

Weekend Reads
* Fingerprinting DPI devices
https://arxiv.org/abs/2509.09081
* Exportation of China's GFW
https://interseclab.org/research/the-internet-coup/
* SSH client signature security
https://arxiv.org/abs/2509.09331
* IPv6 scanning and IoT reachability
https://arxiv.org/abs/2509.04792
* Measuring Explicit Congestion Notification
https://www.potaroo.net/ispcol/2025-09/ecn-measure.html
#Fingerprinting #China #SSH #IPv6 #ECN

2025-07-31 10:45:47 UTC

- reply

Tom, are you aware of the new book "Other Networks: A Radical Technology Sourcebook" by @npub1w9z…8ple? It is quite something I think you'd enjoy if you've not seen it.

2025-07-18 12:13:00 UTC

- reply

There are not many actively using it as the Google plot supports, but anecdotally I hear about people using them regularly.
About 6 years ago HE.net told me the traffic levels on the 6to4 gateways were steady for the past 5 years, I can't imagine things have changed all that much.
There remains a sizeable number of 6to4 endpoints, ~750,000 by my estimation, that can potentially be abused as proxies and relays.

2025-07-14 12:47:30 UTC

- reply

If only we could convince HE.net to finally stop announcing the 6to4 relay prefixes. Maybe that would at least help encourage those power users to put pressure on their access nets for native v6.

2025-05-24 20:55:13 UTC

- reply

I'd guess it isn't as high as some stats published by Google, for example. Since Google probably includes a fair bit of mobile, whereas git users are more likely on corp or home broadband links where native v6 links are less common?

2025-04-30 13:54:05 UTC

- reply

You can monitor new .gov names as they appear in the zone by following @npub1p25…nr7a
I usually highlight new ones specific to this administration in a quote toot as does the bot's author @npub18fz…34vn

2025-04-02 02:20:24 UTC

- reply

I don't know of anyone in my tech/infosec circle that thinks this is no big deal. And if any do, they shouldn't say so. I won't be able to help losing a lot of respect for them if they do.
We participate in lots of secret handshake clubs, and while we occasionally screw up, the opsec failure here is so egregious and the lack of acknowledgment of it so glaringly disappointing, it would be career-altering.
In fact, a good question for future infosec interviews might be simply to ask "What did you think about the Houthi pc small group Signal chat story?" And if the answer is anything in the vicinity of "No big deal" then it will be "Thank you for your time, we'll be in touch." *plonk*

2025-01-14 23:16:32 UTC

- reply

Thanks for doing it.