Currently testing this platform to decide whether it's the future of social networking.
Public Key
npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r Profile Code
nprofile1qqsgcpz44uekagyl5dc57st90khtgu2uzm2dhx2vlx8muypjj30gc6cpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qzyrhwden5te0dehhxarj9ekxzmnyrh3hwf
Show more details
Published at
2026-08-21T20:43:12Z Event JSON
{
"id": "a8d02bed3e200af6db25f3dd9fc06c37ed715312a9cd0f7f50b233a5b84f5ed3" ,
"pubkey": "8c0455af336ea09fa3714f41657daeb4715c16d4db994cf98fbe1032945e8c6b" ,
"created_at": 1787344992 ,
"kind": 0 ,
"tags": [
[
"proxy",
"https://westergaard.social/users/kasperd",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "{\"name\":\"kasperd\",\"about\":\"Currently testing this platform to decide whether it's the future of social networking.\\n\\nCurriculum Vitae:\\nPhD degree from Aarhus University\\nWorked at Google Zürich and London\\nPartner at Intempus Timeregistrering - until it was acquired by Visma\\nOperating nat64.net/\",\"picture\":\"https://static.westergaard.social/pleroma/c778a2fa-b3e2-4cc9-a8bd-ce771c3ea4e4/kasperd.png\",\"nip05\":\"[email protected] \",\"fields\":[]}" ,
"sig": "b9411ba3981d29cbd44c79a754218c6a1d780d70f436ef29d48d472b23c5e6dde95d765f0ba6e2cb8c9f77c8ed21a70ce0908a45b4ce52f61567394bec6f6710"
}
Last Notes npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd From today I will enact a zero tolerance policy towards AI crawlers. If I notice even a single request from an AI crawler in my webserver logs, I will immediately block the entire IP range from which it came. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd When using CLAT it doesn’t make a difference whether MSS clamping is done by CLAT, NAT64, or both. I recommend doing it on both sides to ensure it gets done. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Fragmentation combined with any sort of NAT is going to be fragile. For TCP traffic my recommendation is for the NAT64 to do MSS clamping to 1220 or less. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I am wondering what percentage of these vulnerabilities were reported previously and not fixed. Not all developers are equally willing to fix reported vulnerabilities. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Microsoft does not exactly have the best track record when it comes to guarding user privacy. Take for example the 2011 incident where Microsoft was caught snooping on users’ Google searches. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Who promises that a sandwich ordered online will arrive within 24 hours? npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd It could also be somebody is clueless about networking and decided to drop ICMP packets. That can work fine until you need them, and then you break PMTU discovery and get weird timeouts. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Around 10 years ago I filed a feature request for such an integration to be added between Google Slides and Google Hangouts (or whatever Google Meet was called at the time, I have lost track of all the names it has had throughout the years). npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I once had a customer demanding a screenshot showing that a certain security feature was turned on. I told the customer there is no such setting in the application because we don’t offer any way to turn this security feature off. They kept insisting. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I do have a use case where a stronger preference for IPv6 would be relevant. I have a dual-stack host which acts as IPv4 frontend for hundreds of domains hosted on IPv6-only servers. Clients which have IPv6 access should access the IPv6-only server directly rather than through my frontend. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I thought the compression ratio of JPEG was a global setting and not something that could be varied for different parts of the image. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I have noticed an ongoing pattern of GRE packets with seemingly random IP addresses. The only thing they all have in common is that the inner packet is UDP and always have the same length. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Do you really need .exe if you already have .com? npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I think OVH had servers glowing like that a few years ago for a much less pleasant reason. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Client side failover is a necessity if you want reliability. Even when IPv4 is long gone, I predict the failover code is here to stay. The failover code may even get a little bit more sophisticated. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I assume you never operated a public NAT64 service. There are networks between the NAT64 gateway and the client which are completely outside of my control. But I can achieve high availability by running multiple NAT64 gateways in independent locations. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Yeah, ipv4only.arpa exists on authoritative DNS servers and is served essentially like a name would have been served from any other TLD. As far as I recall there is an RFC recommending that DNS recursors hard-code that particular name in order to not need depend on authoritative DNS for that name. But last I checked BIND 9 would query authoritative servers for the name. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd One needs to be able to judge whether the output from an AI is trustworthy or not. Anyone who cannot correctly make that judgement isn’t smart enough to be using AI. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I see. Those are following the /64 mappings in RFC 6052. This is not exactly the purpose that RFC 6052 is intended for. And you already identified the scalability challenges of that approach. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Why would the scope of 192.0.0.2/29 expand beyond the individual host? npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Something is very messed up with the rendering of that page. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I have encountered sales people who will say whatever they think will make a customer buy the product and not care if what they say is true or not. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd What you wrote sounded slightly odd to me. So I did a bit of searching and found this article: https://www.lrqa.com/en/cyber-labs/flaw-in-putty-p-521-ecdsa-signature-generation-leaks-ssh-private-keys/ npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd How does it deal with the increased memory usage from doing breadth-first? npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I am curious about the disclosure timeline. I can see that SSL.com have disabled the buggy validation method, so exploitation should not be possible now. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd The only one of those I know how to read is iptables. And if what you are specifying is your complete firewall configuration, it would definitely not work. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I have definitely heard that advice. I cannot remember when I first heard it and how many times I have heard it. I am pretty sure it was mentioned in the first year programming course at university. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Did you verify that the IP addresses are in fact assigned to those bots? Otherwise it's possible that those requests simply had a forged User-Agent. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd I stopped using it when they broke support for the Ubuntu client. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd When I grew up we were required to be outdoors during the breaks. I think that was completely normal in Denmark at the time. For all I know it probably still is. npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd But how would they know about the allergies of customers currently present as well as those who may have a reservation later on the same day? And how would they know exactly how severe those allergies are? npub13sz9ttend6sflgm3faqk2ldwk3c4c9k5mwv5e7v0hcgr99z7334srg5h6r kasperd Some of the incidents being described sounds like simple lack of understanding while some of the other ones are completely indefensible.
