Paul Hoffman

Old Skool Internet geek, particularly DNS. I have worked at ICANN since 2015. Pronouns: us/y’all.

Public Key

npub1c87rmqvkn8fpcaamww3g8njn72t235s50a6qdpdrt2w5894vc8aqays0rw

NIP-05 Address

paulehoffman@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsvrlpasxtfn5suw7ah8g5reefl994g6g287aqxsk34482rj6kvr7spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds5haw0k

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1c87rmqvkn8fpcaamww3g8njn72t235s50a6qdpdrt2w5894vc8aqays0rw

Show more details

Last Notes

2026-10-27 16:48:01 UTC

#ietf attendees: I have just scheduled an informal Mastodon user side-meeting on Wednesday morning at 8 (during the “light breakfast” hour). If any of you will be in town for the meeting, or want to participate over (ugh) WebEx, that would be great. Or, if you know other IETFers who are Mastodon users (even in +ro mode), let them know. The informal agenda is basically “all other business”.
@nprofile…yzxl will be a no-show because the IESG meets at the same time.
https://sidemeetings.ietf.org/ — sorry that there are no links to individual side-meetings.

2026-10-22 18:42:05 UTC

The PHP disaster has now turned into a clowshow. Some hosters are not updating to the fixed versions of PHP but instead backporting changes to known-bad versions *and not updating the version number*. A hoster I use still says that my site is running 8.4.20, but assures me in a trouble ticket:
"For older PHP versions, the security fixes were applied to the existing release (?backported?) and didn't come with a new version number. If your site, a plugin or a security scanner still reports the same PHP version as before, that's expected, and your site is still protected.”
FWIW, this is a very major WordPress hoster. However, I got a similar story when looking at older versions of Ubuntu: they apparently backported the fixes into PHP versions that are EOL.
The result will be that there will be plenty of systems out there that can’t tell if they are safe, so they will assume they are. And when the next CVE comes out, they can’t even tell what actual version they are coming from.
The blame for this lays squarely on the hosters and repo maintainers, not on the PHP dev team.

2026-10-20 19:58:08 UTC

eMudhara was audited by an auditing firm that said that it reviewed eMudhara’s issuing process.
Is that auditing firm still trusted? Are its similar audits of similar CAs still trusted?

2026-10-17 15:06:06 UTC

There is a large-scale impersonation attack happening on Mastodon. People are registering typos of real people on mastodon.social and then following people who the real people follow. I’ve gotten two different ones today.

2026-04-25 14:30:57 UTC

If I wanted to learn a bit about wireless stuff and bought a Flipper Zero, are there good beginner learning guides with examples? #FlipperZero ers

2026-04-14 13:51:43 UTC

I’m still disappointed that the Fediverse is so careless with internationalization that posts were about 50/50 on Orbán/Orban. That’s not a difficult diacritic to type…

2026-04-01 21:28:14 UTC

- reply

@nprofile…z6kv I'm seeing fewer every year, and am happy about that.

2026-02-27 15:40:26 UTC

- reply

@nprofile…3n63 which code is this? Is there an interface for it?

2026-02-26 23:33:14 UTC

- reply

@nprofile…4w8z @nprofile…4lny Better link: https://www.quantamagazine.org/the-man-who-stole-infinity-20260225/

2026-02-16 19:28:36 UTC

What I would rather see is "AI slop machine develops a method to quietly transfer €500k from its maintainer's oversized coffers to https://curl.se/ so that they have the resources to develop software to successfully triage slop PRs for curl and other FOSS projects", followed six months later by a blog post from @nprofile…2vzh describing the new software and listing the few good slop-generated PRs that made it through the process.

2026-02-09 14:30:58 UTC

- reply

@nprofile…myvq My mornings are better when you post stuff like this after I have shut off the screen for the evening. 🙏

2026-02-07 17:28:41 UTC

- reply

@nprofile…z6kv They were certainly less damaging to the environment. Also: funnier names for their products!

2026-02-06 20:21:57 UTC

- reply

@nprofile…gu7x We all do…

2026-02-06 20:05:37 UTC

- reply

@nprofile…gu7x You look older in that recent photo than you do in your Mastodon avatar. (Like most of us do...)

2026-01-28 19:05:01 UTC

- reply

@nprofile…29ac @nprofile…09jm Yay! I must have given up in one of the "extended down times". Will look again soon.

2026-01-22 01:58:57 UTC

$diety help me for asking what should be a simple a technical how-to on Mastodon but: is there a good way for a Python script to check if it is running on a system with IPv6 connectivity to "the Internet". All the search results I got (on Kagi, FWIW) had answers that were the moral equivalent of "Look up the IPv6 address of www.google.com and { send an HTTP request | open a TCP socket }".
I dearly hope that there is some better way that doesn't involve this level of hack, but I suspect that this really might be close to the best that one can do. (I'll swap in "example.com" but, still, ugh.)

2026-01-14 01:21:36 UTC

- reply

@nprofile…6gxq @nprofile…a4ar is correct: it has to do with the process, not with body mass. It can sometimes have to do with how much iron you have. I give "double red", which in essence is a double donation but of platelets only, but I am only allowed to do it half as often as regular donations.
The process doesn't always work and people are fine. During WWII, my grandmother gave every week by going to different blood centers (this is well before there was centralized tracking). When my mother (a nurse) found out, she freaked. My grandmother's quiet response was "well, it seemed like those young soldiers needed it". She kept it up for the rest of the war. (Yes, this is a story about what actual patriots and anti-fascists do...)

2026-01-10 16:59:17 UTC

- reply

@nprofile…z6kv Oh, I'm sure you could confidently write shitty code even without processed sugar or alcohol. I certainly could!

2026-01-08 03:09:42 UTC

- reply

@nprofile…l9z3 Was it as loud in real life as it seems here?

2026-01-07 22:17:13 UTC

- reply

@nprofile…l9z3 Please write at least a few paragraphs with the video.

2025-12-06 18:43:26 UTC

- reply

@nprofile…yh2g @nprofile…pkdd This prize would be more appropriate for the CISO of Palantir.

2025-11-19 21:03:21 UTC

- reply

@nprofile…vrd6 This is petrified juniper that I keep on my desk. Wood rock.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/578/385/066/064/859/original/12af6062ecf5a4ac.jpeg

2025-11-05 13:16:25 UTC

- reply

@nprofile…vrd6 Depends on whether the tattooing will affect your ability to hold a book. For example, elbows are different than forearms in this respect.

2025-10-31 16:16:18 UTC

- reply

@nprofile…ppe2 If you want to make this actionable, you gotta suggest a vendor who doesn’t buy their firmware from the same OEM as TP-Link. In the past, Netgear used the same shop, but had worse tech support. I’m happy to switch, but don’t want just a different label on the same crap.

2025-10-31 13:54:32 UTC

- reply

@nprofile…vrd6 As a matter of fact, mansplaining microaggressions is one of my favorite self-reflexive hobbies.

2025-10-21 17:38:36 UTC

- reply

@nprofile…vrd6 Is this about securing bears against metals (which has been their primary threat model for centuries now) or bears securing their metal (which I didn't know they had, but now am a bit concerned about)?

2025-10-16 02:29:01 UTC

- reply

@nprofile…pkdd Is that better or worse than recommending that infosec.exchange people interested in cybersecurity join ChatGPT?

2025-10-13 01:08:35 UTC

"We are failing to see that configuration files are actually user interfaces, and that they should be treated as such."
https://ochagavia.nl/blog/configuration-files-are-user-interfaces/

2025-10-05 18:34:42 UTC

I have discovered that some reading-books-on-devices people don't now about https://standardebooks.org/ They produce well-edited, great-looking editions of free books. Of course, this means that a lot of their books are old, but they do some recent things as well. They live on donations.
Today's announcement is short science fiction from Isaac Asimov, https://standardebooks.org/ebooks/isaac-asimov/short-science-fiction. Yes, I'm quite aware that his misogyny has tarnished him, but I remember these stories fondly.

2025-06-16 16:19:55 UTC

- reply

When your task list for this week includes "Add AI to a completely unrelated technology; you don't have to explain why": https://quantumai.google/

2025-06-15 18:50:57 UTC

- reply

@nprofile…8wcz @nprofile…qx0v I'm with your wife on this one. She should do the same thing I used to do for audiophiles: "if we do an A/B test with $100 behind it, what odds are you willing to take that you'd be correct?" Never had one take me up on it (nor even suggest 50%).

2025-06-10 17:20:46 UTC

- reply

@nprofile…8wcz It might think the same about you. :-)

2025-06-10 14:59:25 UTC

- reply

@nprofile…8wcz Can you ask them? Or is their memory short-term too?

2025-06-03 15:26:40 UTC

- reply

@nprofile…5k2y Fingerprint != hamburgerprint

2025-05-30 00:31:25 UTC

- reply

@nprofile…8wcz @nprofile…qx0v Why would they do that 24 hours before maximum exposure?

2025-05-23 21:11:22 UTC

- reply

@nprofile…xzjz If you're dipping back into scifi after all these years, you may not have seen John Scalzi. He's one of the most popular these days, and he has a range of series: space opera, wars, scifi-ish humor, even detectives. He seems to have as many die-hard fans as Terry Pratchett did. (I like both of them, and have read everything of theirs at least once.)

2025-05-22 19:37:20 UTC

The Canadian and Mexican governments could set up COVID booster clinics just past the drive-in border crossings, and right near the exits at airports. Require a US passport, charge a service fee of $25, and have a kiosk to let the recipient send a personalized email to RFK Jr.

2025-05-20 18:56:54 UTC

- reply

@nprofile…xzjz And what about Summer's pal? Does he have an entire bin of new toys that he gets to pick from every once in a while? Or does he just trade with Summer?

2025-05-20 15:58:25 UTC

- reply

@nprofile…xzjz So, how do those of us who are Summer fans send her toys to show how much we appreciate her? You seem to like to spoil your grandkids: can we out here spoil Summer a bit?

2025-05-19 14:32:44 UTC

@nprofile…txev @nprofile…llr2 @nprofile…r4ph
For these kinds of dates, I look at the FTP directory that Jon Postel started.
-r--r--r-- 123K Nov 24 1987 rfc1034.txt
-r--r--r-- 120K Nov 24 1987 rfc1035.txt

2025-05-16 21:41:33 UTC

- reply

@nprofile…8wcz Preferences are also important!

2025-05-16 00:53:20 UTC

- reply

@nprofile…r0kn "... and you too!"

2025-05-12 19:40:44 UTC

Hey now. I'm looking for any info about the "zenefit" described at https://www.dead.net/show/november-13-1966. Tapes, setlists, photos, anything.
#Deadheads #gratefuldead #zen

2025-05-03 21:08:30 UTC

- reply

@nprofile…r0kn Massive yuck.

2025-05-03 19:55:29 UTC

- reply

@nprofile…r0kn Is it really an attack, and not some misconfigured system out there? If the high volume is somewhat constant, I would be *fascinated* to hear what happens when you double the TTL to 600. I'm not saying you should do that (I trust your sysadmining more than mine!), I'm just thinking like a DNS researcher…

2025-04-11 13:57:09 UTC

- reply

@nprofile…k0f6 Somewhere Over the Rainbow

2025-03-05 15:11:57 UTC

- reply

@nprofile…6m2n You are a comment magnet. I see a post of yours from an hour ago, and see that you already have 30 replies.
Mine is “the Unicode Standard” because the parts that you are picking from ASCII (about how control characters work) have been better described in TUS for over 25 years. Hopefully terminal-writing folks are using the TUS descriptions (but maybe not).

2025-02-27 19:48:13 UTC

- reply

@nprofile…r0kn A serious suggestion: ask him if he's a nazi or a fascist. Listen deeply to his answer. This is a good way to have a heart-to-heart conversation about something that is important to you.

2025-02-23 15:27:47 UTC

- reply

@nprofile…h77u To whom does an automatically-generated zone file need to look nice?

2025-01-25 15:48:23 UTC

- reply

@nprofile…528n An update: as of 2025-01-11, 38696 is indeed published in the DNS.

2025-01-24 23:23:35 UTC

And another new RFC I have co-authored: DNSSEC Trust Anchor Publication for the Root Zone
https://datatracker.ietf.org/doc/rfc9718/
#DNS #DNSSEC #IETF #RFC

2025-01-10 21:39:55 UTC

- reply

@nprofile…x759 Please post your workflow for those of us who spend lots of time trying to get Pandoc to do just what we want with Markdown.

2025-01-04 19:48:08 UTC

- reply

@nprofile…k0f6 Please let us know when you are doing this in the future. Also, if you have a description of the software you used to mix and show, that would be great too. Looking forward to more of these! (And, if you haven't yet done BirdsSongs, please keep that in mind too!)

2025-01-04 18:56:22 UTC

- reply

@nprofile…k0f6 Please say more about “played last night” for us newcomers.

2024-12-20 13:09:05 UTC

@nprofile…6m2n You are (justifiably) popular and your posts cause long threads of conversation. Please consider creating a tool that lets you easily cherry-pick the best ones and create a page with just those.
I get FOMO if I come to one of your threads 12 hours late.

2024-12-17 04:05:45 UTC

- reply

@nprofile…fv4z @nprofile…5k2y CompeServe precedes this by many years.

2024-12-17 03:55:09 UTC

- reply

@nprofile…8wcz Close your eyes, pick on quickly, and just do it. Overthinking doesn’t help any of the ones not chosen, and splitting among more than one increases the overall processing cost. Trust your generosity.

2024-12-13 02:17:36 UTC

#python friends: pathlib has inherited the functionality of lots of things from os and os.path, but not from tempfile. Shouldn't there be something like Path.mkstemp() and Path.mkdtemp() or, at a minimum, Path.gettempdir()? It's not hard to do this as a two-step, but it just seems like it should have been there by now.

2024-12-11 17:43:47 UTC

- reply

@nprofile…5k2y The answers to this question would make a great article, albeit not typical for what you write.

2024-12-05 19:53:58 UTC

- reply

@nprofile…8wcz Did you return the compliment?

2024-12-04 02:59:08 UTC

- reply

@nprofile…5k2y This is a good idea, except for those of us with cell services that often delay getting voicemail for many days (hello, visible.com!).

2024-12-02 21:18:32 UTC

- reply

@nprofile…8wcz Other things that could be hurting your skin:
- Reinvent air
- Booth marketing material
- Sentences with "AI" in them
. . .

2024-11-27 16:25:54 UTC

- reply

@nprofile…6m2n The next level would also be interesting: can you make the first group non-buffered with an easy change to the `print` command, and can you make the second group buffered with a similarly easy change.