The launch of Cloudflare's new 1.1.1.1 DNS service has brought much fanfare and a heap of praise. More choice is always a good thing, and support for both DNS-over-TLS and DNS-over-HTTPS make 1.1.1.1 an interesting option. In this post I'm going to explain why I won't use it yet, and why you might not want to switch either without doing some testing first.

Fastest isn't always best

Cloudflare touts 1.1.1.1 as "the Internet's fastest DNS directory." In terms of pure response time, they might be right. But when dealing with DNS, response time is only part of the equation. Just as important are the replies you get from a DNS server, the IP addresses it hands out in response to domain queries. Responses from centralized DNS services are sometimes unsatisfactory and can lead to service degradation. The answers come fast, but are they the right ones?

I like to use a telephone analogy here. Imagine you dial 9-1-1 and your call is answered so quickly you ne...

Today I saw an interesting IMAP probe. These are usually background noise, occurring by the hundreds each day and mostly trying weak passwords against non-existent accounts. This particular login attempt was made on a valid alias, so I took a few seconds to dig deeper, and found an indicator of attack I hadn't seen before.

Immediately preceding the IMAP authentication attempt, the same IP address had issued one HTTP GET request and two HTTP POST requests for /autodiscover/autodiscover.xml on the same domain (the file doesn't exist). Not being familiar with autodiscover.xml, I looked up the documentation and it's a WPAD-like configuration discovery scheme for Outlook. Aside from people whose own Outlook clients and/or Exchange servers are spamming their own web server logs with requests, I couldn't find many people talking about seeing it in their httpd logs. autodiscover.xml doesn't seem to be commonly scanned, spidered, or ab...

Facebook's data collection tactics make waves

With Facebook and Cambridge Analytica in the news, Facebook's threat to privacy is finally getting the widespread attention it deserves. Beyond the obvious political propaganda concerns, the wider implications of Facebook's data collection are coming to light, and some of the examples are alarming. Multiple users have downloaded their history and discovered that Facebook had records of all of their phone calls and text messages.

In addition to siphoning up phone-related data, much of the web has become infected with Facebook tracking beacons that collect your browsing history on desktop PCs and mobile devices. When you see a Facebook "Like" or "Share" button on a web page, your browser typically loads these directly from Facebook's servers. Some websites without visi...

Let's Encrypt, a leading issuer of SSL/TLS certificates, has taken a big step forward by adding support for Certificate Transparency. This capability, now merged into Let's Encrypt's Boulder CA suite, resolves a long-standing feature request by embedding Signed Certificate Timestamps (SCTs) into newly minted certificates. Because the SCT is attached directly to the certificate, no additional server modules or configuration is needed by site administrators.

Certificate Transparency support allows websites using Let's Encrypt certificates to implement the Expect-CT HTTP header. This header provides additional security by instructing web browsers to verify the certificates they receive against public certificate transparency logs. Forged or otherwise malicious certificates are often absent from these logs, and will ...

If you run a mail server, whether it's for your own personal email or for your company and its employees, one of the biggest challenges you'll face is keeping spam at bay. Fortunately, several organizations maintain DNSBLs available for public use. These blacklists of known spammer servers and networks are the biggest hammer in a mail admin's toolbox, and are easy to configure in most common MTAs.

Used wisely, a good selection of DNSBLs can reject most of your incoming spam early in the SMTP conversation. This prevents your server from having to process those messages through other, more resource-intensive filtering strategies. On the other hand, each blacklist you enable adds another potential DNS lookup for every incoming message, and another opportunity for false positives that discard legitimate mail. To that end, it's a good idea to keep an eye on how the DNSBLs you choose are working on your system.

In this post I'll share some methods for gauging how DNSBLs ...

PHP 7 introduced optional strict typing, which disables the implicit type conversion that PHP is (in)famous for. Strict typing requires that if a function's argument has a declared type, you must pass that exact type of scalar value. To implement strict typing in a given PHP file, you simply add one declare() call at the very top:

<?php
declare(strict_types=1);

I'm not going to argue for or against strict typing here, other than to say that turning it on sacrifices some convenience in exchange for some added security. Instead, this post is intended to catalog any quirks or caveats that I've encountered after enabling strict_types and how I worked around them.

The fgets() pattern

When processing a large file line-by-line to avoid loading its entire contents into memory, I've long used a pattern like this:

if (file_exists('/tmp/foo.txt') && $fp = fopen('/tmp/foo.txt',...

While doing a bit of housecleaning on a system, I hit a subversion error I've never seen before:

[user@host]$ svn ci -m "Replace symlink with hard copy of file"
svn: E145001: Commit failed (details follow):
svn: E145001: Node '/path/to/my/myfile' has unexpectedly changed kind

I'd replaced a symlink, which was already versioned, with a copy of the target file itself. I'm usually pretty good at convincing subversion to accept whatever arcane mangling I've done, but it just wouldn't take this one, and Google was no help. I was able to get things right again with the nuclear option, removing the offending object from version control and then adding it back. Specifying --keep-local removes the file from the subversion repo but leaves it in place on disk.

[user@host]$ svn status
~       myfile
[user@host]$ svn rm --keep-local myfile
D         myfile
[user@host]$ svn ci -m "Remove symlink, will add back as a file"
Deleting       myfile
Committed revision 1602.
[user@host]$ ...

This week I finally took the plunge and upgraded most of the servers I work with from PHP 7.1 to PHP 7.2. (Some of them still can't be brought forward due to dependencies that use mcrypt.) I ran into a few snags with the upgrade to 7.2 and thought I'd document them here. This may be useful if you:

• Run CentOS Linux 6.x,
• Want to install PHP 7.2,
• Need pthreads support in PHP, and
• Prefer to compile PHP from source

Executive summary

In order to build PHP 7.2 with pthreads on CentOS 6, you must upgrade autoconf to version 2.64 or higher, which must be done manually instead of via the yum package manager. You'll also have to first build PHP 7.2 without pthreads, then use this "bootstrap" copy to prepare the pthreads extension before compiling PHP a second time.

autoconf 2.69

Start by installing autoconf 2.69. The latest version available through yum is 2.63, which isn't sufficient to build PHP's configure script.

It's critical that you supply the --prefix=/usr option when...

I hate when a redesign gets in the way of a good thing.

Zap2it.com has been my choice for TV listings for many years. They briefly rebranded as "Screener" in 2016, with a new domain that broke my bookmarks and a bright yellow theme that broke my eyeballs. That venture didn't go very far; the Zap2it name returned after a few months, at which point I updated my TV listings bookmark (again) and went on with my life.

Tonight I went to see what's on TV and my trusty bookmark took me to a 404 page. Compounding matters, visiting the main Zap2it.com page showed me a totally blank "TV Listings Grid" section. This is the unfortunate hallmark of a website that won't work properly if LocalStorage is disabled.

I normally keep LocalStorage turned off, because it presents a bundle of privacy issues and I've found that the simplest w...

Today Bert Huber from PowerDNS announced a new DNS-based geolocation service. Given an IP, it returns the corresponding latitude and longitude coordinates. Using it is simple; to look up the coordinates for IP address 1.2.3.4, just reverse the octets and query the TXT record for 4.3.2.1.geo.lua.powerdns.org. I don't see any official details from PowerDNS yet, just Bert's tweet, but based on the domain, the service appears to be using PowerDNS' Lua capabilities.

The usual caveats about geolocation apply:

$ dig +short TXT 73.52.93.172.geo.lua.powerdns.org
"33.745800 -117.826202"

Despite that server living in Dallas, the coordinates that come back are for Tustin, CA. That's because the ARIN allocation for 172.93.48.0/21 points to a corporate address in Tu...