Bwahahaha, these security folks have a great sense of humor! :-D Got a phishing test e-mail disguised as an overdue anti-phishing training e-mail:

We receive these test phishing e-mails every now and then at work. When you follow the links and log in at the fake login, you probably get assigned another (real) training.

When I got this e-mail, I immediately thought of such a test. Since I actually do have some stupid training deadlines coming up soon, I wasn’t 100% sure, but still doubted that this was one of them. To make the timing even better, in the team meeting last week, our bosses reminded us to complete outstanding trainings before the deadlines. Ideally well in advance. Notifications about deadlines coming closer are sometimes not only sent to the individuals but also to the bosses and their bosses. And then things can get out of hands when somebody doesn’t read the e-mails properly and mistakes them for deadline exceeded reports.

Anyway, the URL also looked kinda legit. It really doesn’t help a single bit that domain names change all the fucking time. So, still with the test program in mind, I thought, I just give it a quick shot out of curiosity. Since I just had logged in before, the empty SSO username field was totally obvious then. Looking at the e-mail headers confirmed that this was indeed one of security’s field checks. :-)

Telegram’s t.me domain has been suspended | Hacker News Wow 😮

XMPP greatest peak was when Google Talk was around. Being able to chat with thousands, if not millions, of Google users at that time, using your own domain, and your own XMPP server was amazing. Then Google, in all its wisdom, and as it does very often, decided to kill it.

I might be on the minority, but can care less about video calls. Heck, even calls! Text is King. 🤪

there is for example, a user configurable and default instance configuration called only one postponed domain

@prologic@twtxt.net I linked you some of my findings on the twtxt.app on IRC. The main problem is the hashing. Totally broken. But you have got to give it some thought, because GitHub hosting of the feed is tricky (even more so if they are CNAMEing their domain to it). It is also finicky because Pages is auto-enabled on username.github.io, so actions must run each time you twt.

Migrating my home domain off of Cloudflare. I gotta tell you, this is where I appreciate AI. Making this go smooth as butter!

@prologic@twtxt.net I tried custom domains. This works!
Since issuing Let’s Encrypt is my first reference, I see errors there,
but I was able to reference them within minutes.

👋 mbox.blue now support custom domains you can point at your ~/public_html or ~/.mbox/expose app/service. Enjoy! 😉

I just killed the website for my Kirby podcaster plugin. I was keeping it for too long because there were those "support the development" possibilities on the site. I just moved the docs to my site. Now all the plugins are in one place, which makes it easier to maintain the documentation, etc. All the domains (i.e. https://podcaster-plugin.com/) should now redirect to my page, too.

Aha, yesterday’s newly added support for LC_TIME to render localized timestamps also broke the feed parsing with my LANG=de_DE.UTF-8 and LC_CTYPE=de_DE.UTF-8 environment. :-)

Atom feeds make use of RFC 3339 timestamps. They are first converted into RFC 882 timestamp representation, which is the one that RSS feeds use. However, this conversion now results in localized RFC 882 timestamps, which cannot be parsed into Unix timestamp numbers via curl_getdate(…). I bet that it doesn’t know about the localization at all and expects English month and weekday names. Looking at its docs, I reckon that function was selected because of its myriad of supported timestamp formats: https://curl.se/libcurl/c/curl_getdate.html RFC 3339 is not included, though, hence the transformation up front.

The intermediate Item objects in the parser domain use std::string for the timestamp representation. This isn’t all that silly, because Newsboat supports all sorts of different feed formats with different timestamp formats. These RFC 883 timestamps are centrally parsed into time_t.

Speaking of time: It’s time to go to bed after this late bug hunting fun. :-)

@movq@www.uninformativ.de Right, they messed up the signing key rotation: https://blog.denic.de/technische-storung-bei-de-domains-behoben/

@lyse@lyse.isobeef.org Yep, this was a big oopsie at DENIC:

• https://blog.denic.de/denic-informiert-uber-storung-im-dnssec-fur-de-domains/
  
• https://blog.denic.de/denic-informiert-uber-die-behebung-der-dnssec-storung-fur-de-domains/

All sorts of .de domains don’t resolve right now. But not all, movq.de for example still works. All on our server and basically all major other sites are cactus. Maybe some DENIC problem? I’m too tired to investigate, but I’m looking forward to tomorrow to read some report on that. :-) Good night.

The auDA, and some 3rd-party identify service and my Registrar are a joke!

WOW! I just had to share this little story I ran into today.

I tried to register a .AU Domain the other day, only for it to instantly fail.

I emailed support, which took several days to respond, only for them to respond by saying (paraphased):

We’re sorry, but the identify checks failed. The 3rd-aprty service doesn’t tell us why, But, please make sure that the ID you used matches the Full Name, including any Middle name(s).

I used my Passport number. Which of course has my First, Middle and Last Name.

I can only assume at this point that the checks failed on the missing “Middle name”. Why? Because the Registrar I use has a database and user interface for “contacts” that only have support for First name and Last name. NO Middle Name.

🤦‍♂️ This is basically stupid at this point. Systems cannot be trusted at the most fundamental level, no matter how good they are.

Until we figure out how to build a system that allows an individual to prove to another entity that they are who they say they are without a shred of doubt (i.e: cryptographically), we’re stuffed.

There is literally nothing I can do in this case. The auDA are at fault. The 3rd-party identify service (unknown) are at fault. The registrar are at fault. Hell, even the Passport office are at fault for even bothering to or requiring a Middle name.

How has “identity” come to this?

Transferred my last domain over from Infomaniak to Dynadot 🙌🏼

@movq@www.uninformativ.de I still think that your original domain is cool as fuck! :-)

I didn’t change any subscriptions, and I still see your messages, so whatever you did worked fine. :-)

@prologic@twtxt.net Well, you can associate your identity to the apex domain with a bit of Webfinger wizardry, but I don’t. Mine are always attached to the sub-domains. I find it easier to migrate between instances that way without risking borking federation.

@aelaraji@aelaraji.com does that mean your identity gets associated with your Apex domain or your sub domain?

@shinyoukai@neko.laidback.moe yeah, that’s the only reason why I use sub-domains when trying anything federated (I believe Matrix has the same problem), in case things didn’t go as planned I can just migrate and take it down.

I’m kind of tired of late of telling support folks, for example, ym registrar, how to do their fucking goddamn jobs 🤦‍♂️

Hi James,

Thank you for your patience.

There are several reasons why a .au domain registration might fail or be cancelled, including inaccurate registrant information, ineligibility for a .au domain licence, or issues related to Australian law.

For a full list of possible reasons, please see this article: https://support.onlydomains.com/hc/en-gb/articles/6415278890141-Why-has-my-au-domain-registration-been-cancelled

If you believe none of these reasons apply to your case, please let us know so we can investigate further.

Best regards,

Yes, so tell me support person, why the fuck did it fail?! 🤬

@prologic@twtxt.net I am telling you that is extremely easy: https://docs.gotosocial.org/en/latest/advanced/host-account-domain/. Now, if you are putting into account your rather… unique setup, then that’s another story.

@bender@twtxt.net That’s not the problem. The problem is the complex DNS setup and delegation. I’ve gotten it working once before, but it’s not that easy if you don’t intend to run it on the APEX Domain.

Tired to re-enable the Ege route to git.mills.io today (after finishing work) and this is what I found 🤯 Tehse asshole/cunts are still at it !!! 🤬 – So let’s instead see if this works:

$ host git.mills.io 1.1.1.1
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases:

git.mills.io is an alias for fuckoff.mills.io.
fuckoff.mills.io has address 127.0.0.1

PS: Would anyone be interested if I started a massive global class action suit against companies that do this kind of abusive web crawling behavior, violate/disregards robots.txt and whatever else standards that are set in stone by the W3C? 🤔

To everyone previously asking, what my (and other developers) endless complaining about Google, to both every EU body, with a form on their website and every relevant team at Google accomplished…
WE FUCKING WON!!!
“While security is crucial, we’ve also heard from developers and power users who have a higher risk tolerance and want the ability to download unverified apps.”
-source

I was also able to work with my new webhost, to bring back “🐕.fr.to” - everyones favorite vanity redirect domain, for my site, Googles changes to SSL warnings in Chrome, killed at the beginning of this year.

The lesson: I NEED TO COMPLAIN MORE

@bender@twtxt.net Hahaha! :-D But I actually do like their approach. I don’t know what staff should do differently when they are not involved in the channel topic. At least in the general case. Maybe in this specific scenario here they could have cross-checked domains, git repos and stuff like that. But I also reckon that it’s only fair if they treat everybody the same.

@prologic@twtxt.net FWIW, I love the idea and I do the same with my email domains. It’s the most effective way to fight spam, IMO. 🥳

@prologic@twtxt.net hehehe, yeah, it isn’t mine neither. Most obscure TLDs are in small registrars. I like to stick to one register (even though when Google Domains ceased to exist I was forced to have two, as Cloudflare doesn’t support the .ONE TLD).

@bender@twtxt.net Makes me wonder whether somethingarather.zip is a good primary domain for the service I’m building? 🤔

Buscame en Yggdrasil http://dev1ls.ygg.at/ #NixOS #ipv6 #yggdrasil #Domain

Today, I experimented with Linux Capabilities as a continuation to my Unix Domain Sockets research from a few months ago: https://lyse.isobeef.org/caller-information-via-unix-domain-sockets/#capabilities

I learned that I don’t know hardly anything and there is heaps more to explore. Tomorrow, I will do the same in Go and see how that feels.

@zvava@twtxt.net @bender@twtxt.net At first I added it without thinking when planning the possible fields based on other UIs I was researching.

I was about to discard it but after thinking about it a bit I noticed that the services allowing to have a separated nick and display_name could unlock some good uses.

For example some added context or at-a-glance information like pronouns or statuses (like Artist [Accepting commissions] or App Name (v2.5)) while other used a more readable version of the nick (blog.domain.com became Person Name's Blog).

Of course it is absolutely optional and it can be safely ignored, but with my vision of being able to build more that a pure twtxt clients, giving it a first-class support just like the other known fields felt right to me.

Here is just a small list of things™ that I’m aware will break, some quite badly, others in minor ways:

1. Link rot & migrations: domain changes, path reshuffles, CDN/mirror use, or moving from txt → jsonfeed will orphan replies unless every reader implements perfect 301/410 history, which they won’t.
   
2. Duplication & forks: mirrors/relays produce multiple valid locations for the same post; readers see several “parents” and split the thread.
   
3. Verification & spam-resistance: content addressing lets you dedupe and verify you’re pointing at exactly the post you meant (hash matches bytes). Location anchors can be replayed or spoofed more easily unless you add signing and canonicalization.
   
4. Offline/cached reading: without the original URL being reachable, readers can’t resolve anchors; with hashes they can match against local caches/archives.
   
5. Ecosystem churn: all existing clients, archives, and tools that assume content-derived IDs need migrations, mapping layers, and fallback logic. Expect long-lived threads to fracture across implementations.

@kat@yarn.girlonthemoon.xyz Ahh what do you mean by images don’t embed? They definitely should! By default however all domains are blocked, so you might want to either allow some domains or just put in a .* entry to allow all/any domsins. Screenshot attached

I hear you, @movq@www.uninformativ.de! :‘-(

At work, too. For a few weeks now when I try to log into this horrible Outlook web intershit (Because why would they fix the Evolution integration?! It’s cactus for well over a year now. Probably more like two.), it forwards me to the corporate weblogin, I enter my credentials, even do the bloody MFA crap and get redirected back to Outlook. “Loading mailbox…” “Please wait for us to log you out, do not close this window while this process is underway.” Fuck you! I have to delete the cookies for this damn domain each and every fucking time. Otherwise, this goes in circles forever. I tried the game for 15 minutes, no joke.

But wait, there’s more! Why just fuck it up only a little bit? This week I get logged out at the middle of the day. Every. Single. Day. Not even close to eight hours since I started, no. What the hell!? I reckon I just don’t even bother reauthenticating anymore in the arvo. No more e-mails for Lyse after lunch. Fuck it. It’s just distraction, anyway, right?!

Woops, sorry if my Pod was offline for a few days, I hadn’t checked and needed to renew the domain xP

Domain-Specifc Google News RSS Feeds ?~L~X https://thenewleafjournal.com/b/7uu

@bender@twtxt.net Maybe one day I’ll take back over my prologic.blog domain from µBlog and redoit with my handy zs tool with some nice CSS 🤣

@bender@twtxt.net Muting on a domain level would be an option.

i have found my ultimate domain name 😄

it match exact my first, last & middle name in a way that satisfied me.

would lovely to see your creative nickname & brand tie to a nice domain name, rather than some threads.net or x.com 😝😝

that isn’t mine, a newly made friend bought the domain & code that simple site for me, i find it’s hilarious to have so i put it in the front

thank you!!!

Archaea
⌘ Read more

@kat@yarn.girlonthemoon.xyz Ahh but you’re like one of a very few that actually own domains and do interesting things 😅

wish i could join in on the domain age discussion but i registered my first domains last year

@anth@a.9srv.net happy birthday, “youngster!”

Domain Name: NETBROS.COM
Registry Domain ID: 1193243_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.cloudflare.com
Registrar URL: https://www.cloudflare.com
Updated Date: 2025-03-29T04:08:33Z
Creation Date: 1998-04-29T04:00:00Z

@anth@a.9srv.net 24 years is quite a long time. 😳 My blog domain is from 2006 (still, almost 20 years, oof).

@anth@a.9srv.net Congrats, that’s pretty cool! Quite some time, I’m impressed.

@prologic@twtxt.net You’ll sometimes find the “Creation Date” in whois. Our domain was registered in 2009. Woah. That’s also been a while, crazy.

According to a very old email one of my more personal family domains was registered in 2013 making it 12 years old, so I was closed 🤣 my public facing one is much much older 🤣

@anth@a.9srv.net I actually don’t have a clue how old my public-facing domain is 🤣 I have another more personal one that’s probably around ~15 years, but I’m not even sure how to check tbh 😅

My main domain name turned 24 years old today. That feels weird.