Kal Feher

I have strong un-researched opinions on the Internet and Security.
 I once worked for a cloud provider and now work for a cloud provider ☁️
 vim, never emacs  
it's always DNS
My CDS observation project: https://kalfeher.com/analysis/cds-charts/

Website: https://kalfeher.com
Github: https://github.com/kalfeher
Location: Australia

Last Notes

2025-10-24 13:32:59 GMT

- reply

that was my experience when applying for PR in SE 15yrs ago.
Although visits to shengen states didnt count bc no departure record.
unfortunately even NZ is a departure from AU and will add time as a result. for now at least.
hang in there Lesley.
on the plus side you'll soon experience one of the most consequential public holidays any state has anywhere. Melbourne Cup day 😆

2025-03-06 21:53:23 GMT

#AWS IAM Access Analyser is a relatively recent service. Why'd they build it on the non dual stack infrastructure? laziness? expediency?
Anyway, it's now on the modern infra so it supports #IPv6
https://aws.amazon.com/about-aws/whats-new/2025/03/iam-access-analyzer-supports-ipv6/

2025-03-02 01:27:48 GMT

- reply

both nih.gov and the reverse zone for the name servers is now lame. parent delegation still there. all three child name servers either offline or very broken

2025-02-12 04:40:27 GMT

- reply

except https always starts with clear text.
The entire enterprise firewall ecosystem is built on those first few in the clear packets.
And yes those packets are enough to cause you harm if they leak or are retained by a dodgy vpn provider

2025-02-11 03:17:14 GMT

- reply

in their pros/cons table they list other trackers as having “unknown security”. I suppose we do know landairseas’ security now, but I’m not reassured by that knowledge.

2024-12-27 14:11:46 GMT

- reply

yes I think that’s well understood.
But I wouldn’t conflate DNSSec which is a protocol extension and a subset of dns packet types, with a FW doing dns security things. Perhaps it was inadvertent or from a sloppy release, but for clarity general dns security, should not be referred to as dnssec. That will def confuse ppl

2024-12-27 13:58:53 GMT

- reply

unless I misread the cve this isnt related to DNSSEC the protocol extension at all. This is just PA checking dns, logging it and dying bc some bad words made it into the logs.

2024-12-24 00:39:45 GMT

the drip feed of #ipv6 support for svc endpoints continues. I'm now fairly certain it's just updating the underlying privatelink the svc is built on, which means #aws could provide an ipv6 roadmap if they wanted.
https://aws.amazon.com/about-aws/whats-new/2024/12/amazon-prometheus-collector-metrics-ipv6-eks-clusters/

2024-12-13 00:51:21 GMT

- reply

disappointed at the lack of #ipv6
props for signing the domain and using CDS for #dns
good to have the content in a single loc. I swap bw YT and podcast, wonder if others do also? that prolly screws with ur stats.

2024-12-10 23:35:25 GMT

#ipv6 has arrived for #AWS IoT Core for LoRaWAN. lots of cludgy deployments that really need the larger address space.
glad I'm not doing the transition tho.
https://aws.amazon.com/about-aws/whats-new/2024/12/aws-iot-core-lorawan-feature-enhancements

2024-12-02 11:18:03 GMT

- reply

wait weren't they supposed to be attacking Aus? I had my doona all ready to hide under.