Top all-time · #4116
SIDN
Company blog · sidn.nl/en/news-and-blogssecuritysystems
SIDN is the company blog at sidn.nl, writing about security and systems. Since 2018, 19 different Hacker News readers have linked it 21 times, most often “Are we past peak IPv4?”. No feed was found, so read it on the site itself.
Too few sampled comments (14) to say how often HN recommends it.?
Why HN links it
HN commenters link SIDN's posts, from the .nl registry, on DNSSEC, DANE, IPv4 pricing and IPv6 adoption, mostly as supporting references for their own points about email security and DNS.
Summarised by Claude from a sample of 14 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Bij SIDN check je de beschikbaarheid van een .nl-domeinnaam. Wij bieden je ook securityoplossingen, zoals SIDN Merkbewaking.
Most-linked posts?
- Are we past peak IPv4?2 people · 2 mentions · first linked 2024-01-28
- SIDN .NL Registry New ICT Strategy2 people · 2 mentions · first linked 2024-01-30
What Hacker News says?
I have also been self-hosting email for 15 years and only had couple of problems at the beginning, mainly until my IP got enough reputation. I have been hosting it on a bare metal Supermicro server in a proper datacenter, though. It has reverse-DNS, SPF, DKIM, TLS, MTA-STS and even DANE with DNSSEC (on a self-hosted BIND but that's another story). It is implemented using Exim, Dovecot, SpamAssasin, DNSBL and Roundcu…
Comment linking /en/news-and-blogs/hands-on-implementing-dane-in-exim
on “After self-hosting my email for twenty-three years I have thrown in the towel”Submitted CGNAT frustrates all IP address-based technologies (2019) as a story · 54 points
HN discussionIPv4 can be addressed from an IPv6 only device when an ISP configures their network with the feature, many mobile phone providers already have fully IPv6 networks: https://www.sidn.nl/en/news-and-blogs/australias-telstra-swi...
Comment linking /en/news-and-blogs/australias-telstra-switches-mobile-users-to-ipv6-only
on “IPv4 pricing”Submitted Are we past peak IPv4? as a story · 46 points
HN discussionHaving cryptographically signed DNS records that can’t be forged and can be validated is good thing, which is what DNSSEC provides. Right now, DANE is the only way to mitigate downgrade attacks with SMTP and TLS connections. Apparently use of DANE for email is growing [1]. DANE hasn’t taken off with browser vendors because of their concern about additional DNS lookups when making TLS connections. [1]: “Number of DAN…
Comment linking /en/news-and-blogs/number-of-dane-enabled-mail-domains-growing-exponentially
on “Stop Using Encrypted Email”Submitted Big rise in IPv6-enabled .nl domain names as a story · 37 points
HN discussionI like how the .nl tld in the Netherlands is managed by the non-profit SIDN [0]. They are dedicated to an open internet, and they make sure that I can very easily move my domain between (hosting) providers for example (and indeed it was easy to transfer from transip to vimexx for me). They are truly independent. It's how it should be if you ask me. When I read about the .org issues and now .io, I'm happy with my .nl…
Comment linking /en/about-sidn/what-we-stand-for
on “Price increase on .io domains on January 1, 2022 (Renewal: $55.00)”Submitted SIDN .NL Registry New ICT Strategy as a story · 7 points
HN discussionI've heard this claim too: apparently Facebook tested a lot of routers, and they consistently routed v6 ~500us faster than v4. v6 has no checksum, so routers don't need to recalculate it when they decrement the TTL header, and it does make sense that removing a step would help. Unfortunately my source for this is "I heard it from someone that works at Facebook". In practice this is only a small part of final perform…
Comment linking /en/news-and-blogs/apple-connections-established-40-per-cent-faster-with-ipv6-than-with-ipv4
on “India is leading IPv6 migration with 61.67% adoption”Submitted Outdated DKIM keys are easy to crack as a story · 4 points
HN discussionThe market price for IPv4 addresses has peaked: https://www.sidn.nl/en/news-and-blogs/are-we-past-peak-ipv4 Amazon’s move seems to be motivated by pure greed and quasi-monopoly complacency.
Comment linking /en/news-and-blogs/are-we-past-peak-ipv4
on “Free data transfer out to internet when moving out of AWS”Submitted Registration system for all .nl domain names migrating to Amazon as a story · 2 points
HN discussionFor .nl, the whois information for individuals is hidden except for a) interested parties (manually approved) b) investigative/enforcement authorities c) CAs (need to validate ownership). It's all explained in English at https://www.sidn.nl/a/nl-domain-name/sidn-and-privacy?langua... The organization handling .nl, SIDN, has worked like this for a pretty long time. It's pretty much a solved problem. The data is avail…
Comment linking /a/nl-domain-name/sidn-and-privacy?language_id=2
on “German court issues first GDPR ruling”Submitted DNS protocol is too complex, and software implementations need to be better as a story · 2 points
HN discussionI'm really not interested in whatever technicality you're trying to argue here. I'm talking about whatever words you want to use for this phenomenon: https://www.sidn.nl/en/modern-internet-standards/dnssec Meanwhile: the graphs I posted in the preceding comment are pretty striking. If you haven't clicked through yet, you should. I've pointed out previous, minor drops in DNSSEC deployment in the US. The current one i…
Comment linking /en/modern-internet-standards/dnssec
on “Just want simple TLS for your .internal network?”It's still registered though. Check any .nl domain on https://sidn.nl/en (you could try to put 'rop' in the 'check domain name' box), you just need to set a checkmark and agree to the Google terms of service to resolve their captcha and off you go.
Comment linking /en
on “What Is the Most Free TLD?”It should be automateable, yes. Different RIRs (regional internet registries), which all operate their own WHOIS databases, might handle this differently but generally you should be able to get an abuse contact in an automated fashion for exactly this reason > most of the scanner firms seem to be creating their own maps of as much of the internet as they can get their grubby hands on, and then sell API access to the…
Comment linking /en/news-and-blogs/new-system-for-logo-based-detection-of-malicious-domain-names-successfully-piloted
on “Mullvad exit IPs are surprisingly identifying”That's the approach that DANE takes https://www.sidn.nl/en/modern-internet-standards/e-mail-secu...
Comment linking /en/modern-internet-standards/e-mail-security-standards
on “DNS-Persist-01: A New Model for DNS-Based Challenge Validation”I work for SIDN, the ccTLD registry for .nl. Around 2022, we came up with an idea together with some of our registrars: to add a "for sale" button to the WHOIS page for domain names that are for sale. We soon realised that the underlying method could be useful beyond .nl as well. So at SIDN Labs, we decided to turn the idea into an RFC and take it through the IETF process. https://www.sidnlabs.nl/en/news-and-blogs/a…
Comment linking /en/forsale-from-a-pilot-scheme-to-a-growing-universal-system
on “RFC 10023: A DNS signal for domains that are for sale”This was first done by SIDN I believe, the company that orchestrates the .nl domains. They however, do not implement most of the spec. When searching their online whois[1], they'll tell you if a domain is for sale and link to the for sale page. They don't use any of the info you put in the DNS though. The URL comes from their internal system. You need to register it separately. They also don't use the price, txt or…
Comment linking /whois
on “A domain can now say it is for sale, in DNS”DANE is a great idea in theory, botched by a bad practical implementation and low deployment (how much of that is related to the influence of the CA mafia is left as an exercise to the reader). There is some hope for the future: https://www.sidn.nl/en/news-and-blogs/new-opportunity-for-da...
Comment linking /en/news-and-blogs/new-opportunity-for-dane-for-web
on “Add Honest Achmed's root certificate (2011)”
