Puppetd (ruby) was going nuts.

Jul  1 01:59:59 elektron kernel: [183728.001601] Clock: inserting leap second 23:59:60 UTC

Results in:

I’ve created a small wrapper for libunbound for use in Go.

The code can be found at github. It depends on my Go DNS library which can be found here.

Official announcement on the Unbound-users@ list.

To give you a little taste of how it looks, I’ve (re)created tutorials 2 to 6 in Go. Tutorial 2 looks like this, for instance:

package main

// https://www.unbound.net/documentation/libunbound-tutorial-2.html

import (
        "dns"
        "fmt"
        "os"
        "unbound"
)

func main() {
        u := unbound.New()
        defer u.Destroy()

        if err := u.ResolvConf("/etc/resolv.conf"); err != nil {
                fmt.Printf("error %s\n", err.Error())
                os.Exit(1)
        }

        if err := u.Hosts("/etc/hosts"); err != nil {
                fmt.Printf("error %s\n", err.Error())
                os.Exit(1)
        }

        r, err := u.Resolve("www.nlnetlabs.nl.", dns.TypeA, dns.ClassINET)
        if err != nil {
                fmt.Printf("error %s\n", err.Error())
                os.Exit(1)
        }
        fmt.Printf("%+v\n", r)
}

Replying to @nlmarkscholten

je hebt toch de ip’s van de nameservers, met een tcp\(\!\) DNSKEY query ben je al een heel eind. Zie ook: http://drskey.sidnlabs.nl/

Sat Jun 30 08:11:25 +0000 2012

back to go’old XFCE 4.10. GNOME3 is more slick, but at least this just works \(and fast\!\)

Sat Jun 30 08:12:23 +0000 2012

Replying to @nlmarkscholten

key2ds? zit in ldns, perl’s net:dns en nog een paar andere libs denk ik zo :-)

This is a post that details on how to sync a subversion repository to git repository on github.com, and how to keep it in sync.

The following sites were instrumental in getting this to work:

• stackoverflow.com question on getting svn into git;
• ssh foo.

There are a number of steps to take. From a bird’s eye view:

1. Use git svn to clone the svn repo to a git repo;
2. Create a github git repo;
3. Add a remote origin in your local git to the remote github repo;
4. Use some SSH foo to use a separate SSH key for pushing to github.com.

Prerequisites

• We are working with the fictional svn repo located at https://svn.example.net/example;
• git-svn is installed;
• ssh is installed.

Clone the repository

I wanted to look at the increase in ntp traffic now that I’ve joined the pool.ntp.org ranks. Unfortunately munin didn’t have a watch-port-x-and-draw-something-plugin. So I wrote my own based upon the ip_ plugin.

The plugin monitors both v6, v4, tcp and udp and plots them together, as send and received. Just symlink the port number to the plugin:

ip_port_123 -> ip_port_

For it to work, you do need some iptables rules, so yes, this plugin only works in Linux. See the munin plugin for the documentation.

Now that the API seems to stabilize it is time to update these items.

We want to create a little program that prints out the MX records of domains, like so:

% mx miek.nl
miek.nl.        86400   IN      MX      10 elektron.atoom.net.

Or

% mx microsoft.com 
microsoft.com.  3600    IN      MX      10 mail.messaging.microsoft.com.

We are using my Go DNS package. First the normal header of a Go program, with a bunch of imports. We need the dns package:

For some reason I was experiencing wifi disconnects with the ath9k wifi driver under Linux (Ubuntu 12.04). After reading numerous blogs and bug reports (disable ipv6, use hwcrypto=0, etc.), I suspected it was the power management that was somehow disabling the driver, in turn leading to a disconnect. This will probably be fixed in newer kernels (Ubuntu 12.04 ships 3.2.x).

For now I took a shortcut and disabled the power management on the wlan0 interface. For this to work I created a (super)small script: /etc/network/if-up.d/wifipower:

Maybe I’ll try to send it in as a individual submission.

• Source repository at github
• As txt download
• Pandoc2rfc code repository

      Network Working Group                                          R. Gieben
      Internet-Draft                                                      SIDN
      Intended status: Informational                                April 2012
      Expires: October 3, 2012


                   Creating Internet Drafts and RFCs using Pandoc
                        draft-gieben-creating-rfcs-pandoc-00

      Abstract

         This memo presents a technique for using Pandoc syntax as a source
         format for documents in the Internet-Drafts (I-Ds) and Request for
         Comments (RFC) series.

         Using Pandoc syntax this way minimizes the need to directly edit the
         raw XML, but it does not completely make the XML invisible.

      Status of this Memo

         This document is an Internet-Draft and is NOT offered in accordance
         with Section 10 of RFC 2026, and the author does not provide the IETF
         with any rights other than to publish as an Internet-Draft.

         Internet-Drafts are working documents of the Internet Engineering
         Task Force (IETF).  Note that other groups may also distribute
         working documents as Internet-Drafts.  The list of current Internet-
         Drafts is at http://datatracker.ietf.org/drafts/current/.

         Internet-Drafts are draft documents valid for a maximum of six months
         and may be updated, replaced, or obsoleted by other documents at any
         time.  It is inappropriate to use Internet-Drafts as reference
         material or to cite them other than as "work in progress."

         This Internet-Draft will expire on October 3, 2012.
















      Gieben                   Expires October 3, 2012                [Page 1]

      Internet-Draft           Pandoc for RFC creation              April 2012


      Table of Contents

         1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 3
         2.  Using Pandoc for RFC creation . . . . . . . . . . . . . . . . . 4
         3.  Syntax  . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
           3.1.  References  . . . . . . . . . . . . . . . . . . . . . . . . 7
         4.  Security Considerations . . . . . . . . . . . . . . . . . . . . 8
         5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 8
         6.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . 8
         7.  Normative References  . . . . . . . . . . . . . . . . . . . . . 8
         Author's Address  . . . . . . . . . . . . . . . . . . . . . . . . . 9








































      Gieben                   Expires October 3, 2012                [Page 2]

      Internet-Draft           Pandoc for RFC creation              April 2012


      1.  Introduction

         This memo presents a technique for using Pandoc [1] syntax as a
         source format for documents in the Internet-Drafts (I-Ds) and Request
         for Comments (RFC) series.

         Pandoc is an "almost plain text" format, which is inspired by
         Markdown Syntax [2] and therefor particularly well suited for editing
         RFC-like documents.

         The power of Pandoc also comes from the fact that it can be
         translated to numerous output formats, including, but not limited to:
         HTML, Markdown and "docbook" XML.

         In this case the Pandoc sources are converted to "docbook" XML.  This
         XML is then converted again, using an XSLT stylesheet, to XML
         suitable as input for "xml2rfc" [RFC2629].  The conversions are
         collectively called Pandoc2rfc [pandoc2rfc].

         Pandoc2rfc is in some way amusing, as we start off with (almost)
         plain text, use elaborate XML and end up with plain text again, as
         shown in Figure 1.

                            Attempt to justify Pandoc2rfc.

              +-------------------+   Pandoc   +---------+
              | ALMOST PLAIN TEXT |   ------>  | DOCBOOK |
              +-------------------+            +---------+
                            |                       |
              non-existent  |                       | XSLT (transform.xsl)
               quicker way  |                       |
                            v                       v
                    +------------+    xml2rfc  +---------+
                    | PLAIN TEXT |  <--------  | XML2RFC |
                    +------------+             +---------+

                                       Figure 1

         For the conversion to work the following tools and files need to be
         installed:

         o  xml2rfc [3];

         o  xsltproc [4] (or any other XSLT (v1) processor);

         o  Pandoc [1];





      Gieben                   Expires October 3, 2012                [Page 3]

      Internet-Draft           Pandoc for RFC creation              April 2012


         o  transform.xsl [5].


      2.  Using Pandoc for RFC creation

         As said in the introduction the use of Pandoc does not eliminate the
         need to setup some files in XML.  Particularly the "<front>" matter
         of "xml2rfc" can not be codified in Pandoc, so a template like this
         is still needed:

                                A minimal template.xml.

           < ?xml version='1.0' ?>
           <!DOCTYPE rfc SYSTEM 'rfc2629.dtd'>

           <rfc ipr='trust200902' docName='draft-gieben-pandoc-rfcs-01'>
            <front>
               <title>Creating Internet Drafts and RFCs using Pandoc</title>
               <abstract>
                   < ?rfc include="abstract.xml"?>
               </abstract>

               <author initials="R." surname="Gieben"
                   fullname="R. (Miek) Gieben">
                   <organization>SIDN</organization>
               </author>

           </front>

           <middle>
               < ?rfc include="middle.xml"?>
           </middle>

           <back>
               <references title="Normative References">
                   < ?rfc include="reference.RFC.2629.xml"?>
               </references>
               < ?rfc include="back.xml"?>
           </back>
           </rfc>

                                       Figure 2

         The template shown in Figure 2 includes 3 (not counting the
         reference) XML files:






      Gieben                   Expires October 3, 2012                [Page 4]

      Internet-Draft           Pandoc for RFC creation              April 2012


         1.  abstract.xml;

         2.  middle.xml;

         3.  back.xml.

         To create the complete document you will need to edit three Pandoc
         files and the template, (".pdc" is the extension for Pandoc files):

         1.  abtract.pdc;

         2.  middle.pdc;

         3.  back.pdc;

         4.  template.xml (probably a fairly static file once setup).

         To convert, for instance, the "middle.pdc" file to XML the following
         command is executed on a Unix-like system:

         pandoc -t docbook -s middle.pdc|xsltproc transform.xsl - > middle.xml

         This is also done for "abstract.pdc" and "back.pdc".  After which
         "xml2rfc" is called:

         xml2rfc template.xml draft.txt

         Which creates the final output.  Of course this process can be
         automated using a tool like "make".

         When using Pandoc2rfc consider adding the following sentence to an
         Acknowledgements section:

         This document was prepared using Pandoc2rfc.


      3.  Syntax

         Almost all features of "xml2rfc" are supported.  A notable exception
         is the "crefs" tag, but HTML comments are allowed within Pandoc
         sources so they may be used as a substitute.

         Sections are started by using a header [README#headers].

         Paragraphs are separated by an empty line.  Hanging paragraphs are
         entered by using a definition list [README#deflists].

         Footnotes are not supported.  Pandoc2rfc (ab)uses the footnote syntax



      Gieben                   Expires October 3, 2012                [Page 5]

      Internet-Draft           Pandoc for RFC creation              April 2012


         to support indices.  Block quotes are not directly supported in
         "xml2rfc" so they get translated to a hanging paragraph.

         A good number of different type of lists are supported, they are
         translated according to the following table.

                      List conversions from Pandoc to "xml2rfc".

          +---------------------------------+------------------------------+
          | Pandoc                          | Converts to                  |
          +---------------------------------+------------------------------+
          | "* First item"                  | "<list style="symbol">"      |
          | "1. First item"                 | "<list style="numbers">"     |
          | "#. First item"                 | "<list style="empty">"       |
          | "a. First item"                 | "<list style="letters">"     |
          | "A. First item"                 | "list style="format %C.">"   |
          | "i. First item"                 | "<list style="format %i.">"  |
          | "I. First item"                 | "<list style="format (%d)">" |
          +---------------------------------+------------------------------+

                                        Table 1

         A figure or artwork is created with a paragraph that is indented with
         four spaces [README#codeblocks].  A figure caption is always
         translated to a "<preamble>".  A figure caption is created by using
         this text as the last line in the artwork: "Figure: ...caption
         text..."

         The different tables [README#tables] Pandoc supports are all mapped
         to "<texttable>".  A table caption is always translated to a
         "<postamble>".  A table caption is added by using "Table: ...caption
         text..." after a table.

         The caption is _always_ translated to a "<preamble>".  The
         "<postamble>" tag isn't supported.  If a table has a caption, it will
         *also* get a reference.  See Section 3.1 for the details.

         As footnotes are not supported in RFCs the syntax in Pandoc is used
         to support an index.  Footnotes in Pandoc (and thus an index in the
         RFC) are entered in two steps, you have a marker in the text, and
         later you give actual footnote text.  Like this:

         [^1]

         [^1]: footnote text

         This text translates to: "<iref item="footnote text"/>".  It points
         to the page where to footnote marker was placed.  Sub items are also



      Gieben                   Expires October 3, 2012                [Page 6]

      Internet-Draft           Pandoc for RFC creation              April 2012


         supported.  Use an exclamation mark ("!") to separate them: "[^1]:
         item!sub item".

      3.1.  References

         References to section are created automatically by Pandoc and the
         normal Pandoc rules are followed.

                    Reference conversions from Pandoc to "xml2rfc".

         +-------------------------+------------------------------+----------+
         | Pandoc                  | Converts to                  | Type     |
         +-------------------------+------------------------------+----------+
         | "[Click](URL)"          | "<eref                       | External |
         |                         | target="URL">Click..."       |          |
         | "[See](#local)"         | "<xref                       | Internal |
         |                         | target="local">See..."       |          |
         | "[](#RFC2119)"          | "<xref target="RFC2119"/>"   | Citation |
         +-------------------------+------------------------------+----------+

                                        Table 2

         Internal references will add "Section:", "Table:" or "Figure:"
         depending on where it points to (this is the default behavior of
         "xml2rfc").  For the citations to work the reference anchor must be
         known (i.e. the RFC reference.xml must be included in the template).

         References to tables and figures are not handled by Pandoc, this
         behavior is implemented in the XSLT stylesheets, therefor the rules
         are slightly different (and less flexible).  A figure and table only
         get a reference when they have a caption.  If a figure has a caption
         it is also centered on the page.

         The reference anchor attribute will be: "fig:" + "first 10
         (normalized) characters from the caption" for figures and "tab:" +
         "first 10 (normalized) characters from the caption" for tables.
         Normalized is:

         o  Take the first 10 characters of the caption (i.e. this is the text
            _after_ the string "Figure:" or "Table:");

         o  Spaces are translated to a minus "-";

         o  Uppercase letters translated to lowercase.

         For example a figure with a caption "Figure: A minimal template" will
         get the anchor "fig:a-minimal-"




      Gieben                   Expires October 3, 2012                [Page 7]

      Internet-Draft           Pandoc for RFC creation              April 2012


      4.  Security Considerations

         This memo raises no security issues.


      5.  IANA Considerations

         This memo has no actions for IANA.


      6.  Acknowledgements

         The following people have helped to make Pandoc2rfc what it is today:
         Benno Overeinder, Erlend Hamnaberg, Matthijs Mekking, and Trygve
         Laugstoel.

         This document was prepared using Pandoc2rfc.


      7.  Normative References

         [README#codeblocks]
                    MacFarlane, J., "PANDOC Documentation", 2006, <http://
                    johnmacfarlane.net/pandoc/
                    README.html#indented-code-blocks>.

         [README#deflists]
                    MacFarlane, J., "PANDOC Documentation", 2006, <http://
                    johnmacfarlane.net/pandoc/README.html#definition-lists>.

         [README#headers]
                    MacFarlane, J., "PANDOC Documentation", 2006,
                    <http://johnmacfarlane.net/pandoc/README.html#headers>.

         [README#tables]
                    MacFarlane, J., "PANDOC Documentation", 2006,
                    <http://johnmacfarlane.net/pandoc/README.html#tables>.

         [RFC2629]  Rose, M., "Writing I-Ds and RFCs using XML", RFC 2629,
                    June 1999.

         [pandoc2rfc]
                    Gieben, R., "Pandoc2rfc", 2012,
                    <http://github.com/miekg/pandoc2rfc>.

         [1]  <http://johnmacfarlane.net/pandoc/>

         [2]  <http://daringfireball.net/projects/markdown/>



      Gieben                   Expires October 3, 2012                [Page 8]

      Internet-Draft           Pandoc for RFC creation              April 2012


         [3]  <http://xml.resource.org/>

         [4]  <http://xmlsoft.org/xslt/xsltproc2.html>

         [5]  <https://raw.github.com/miekg/pandoc2rfc/master/transform.xsl>


      Author's Address

         R. (Miek) Gieben
         SIDN
         Meander 501
         Arnhem,   6825 MD
         NL

         Phone:
         Email: miek@miek.nl
         URI:

































      Gieben                   Expires October 3, 2012                [Page 9]

Replying to @silentlennie and @dakami

The equivalent of HTST in DNS is the DS at the parent. If its there you *expect* DNSKEYs and RRSIGs as a resolver

Thu May 31 11:23:42 +0000 2012

Replying to @dakami and @silentlennie

yeah, but dns is of course a slightly diff. proto than http\(s\)

Thu May 31 12:41:00 +0000 2012

RT @nlmarkscholten: Aanrader RT @SIDN U kunt het webinar ‘Do’s and don’ts van DNSSEC voor .nl-registrars’ terugkijken via http://t.co/Jv ...

Replying to @jessemcnelis

ah ok. Silly that go vet complains about it then

Mon Apr 30 08:35:10 +0000 2012

What is the LOC record a bitch!

Mon Apr 30 12:09:26 +0000 2012

Replying to @_cyclops_

that too. Implementing experimental records *sigh*

Mon Apr 30 12:15:43 +0000 2012

Replying to @rogpeppe

how do you encode for that? One long tag-string or multiple tags?

Mon Apr 30 12:34:34 +0000 2012

#xfce #4.10 #ubuntu No packages yet: https://launchpad.net/~xubuntu-dev/+archive/xfce-4.10

RT @jasparov: En zo blijft Nijmegen ‘scoren’@fabfrank1508: Zo staan ze bij alle parkeerautomaten in #Nijmegenparkeren. Schande http://t. ...

Sat Mar 31 16:33:48 +0000 2012

Replying to @stonehead

sorry? Wat voor voornemens...?

Sat Mar 31 16:34:39 +0000 2012

Site van Paradigit, paradigit.nl, nog steeds down...

Sat Mar 31 21:01:32 +0000 2012

“One Key to rule them all,
one Key to find them,
one Key to bring them all
and in the Resolver bind them."

• Modified from Lord of the Rings.
  

Yes, this quote is mine. And I think this Internet Protocol Journal has its first use.

See this code in github, where I’ve implemented zipping DNS messages. A modified q prints the compression rate at the first line. It only shows how much compression you would get when you compress the answer.

For compression we use DEFLATE as described in RFC 1951. A typical example:

q @open.nlnetlabs.nl MX miek.nl
;; Uncompressed/Compressed 253/142 (1.781690)
;; bla bla bla bla

That’s not bad a compression factor of almost 1.8! Some more examples:

The development of the language Go is going at a fast pace, hence an updated version of Super-short guide to gettinq q.

Get the latest version (called weekly) of Go:

1. Get Go: hg clone -u release https://go.googlecode.com/hg/ go Note the directory you have downloaded it to and set add its bin directory to your PATH: PATH=$PWD/go/bin.

2. Update Go to the latest weekly: cd go; hg pull; hg update weekly

3. Compile Go: cd src, you should now sit in go/src. And compile: ./all.bash

RT @Raspberry_Pi: Oh god I need a coffee.

Wed Feb 29 06:54:58 +0000 2012

Alle problemen zijn als sneeuw voor de zon verschenen

Wed Feb 29 12:54:10 +0000 2012

.US uses RSA keys with a 2^32+1 exponent. This breaks Go’s crypto lib, hence the validation failures.. http://code.google.com/p/go/issues/detail?id=3161

Wed Feb 29 18:22:26 +0000 2012

domainski, knot, http://www.knot-dns.cz/ cloning Git repo now

Wed Feb 29 18:26:33 +0000 2012

#knot knot-zcompile parses my test zone in 12.8 s, my Go code does it in 5.6 s :-) \(ok, ok, zcompile prolly does more\), still #win

Due to the new go tool (long story), I’ve renamed godns to dns. This means the github repo is also somewhere else.

godns installed itself as dns so code using it does not need to be changed.

http://tools.ietf.org down?

Tue Jan 31 09:09:58 +0000 2012

I don’t like the go build tool ‘go’ #WantMakefiles

Tue Jan 31 09:45:13 +0000 2012

Replying to @twitjeb

thanks. With shift-reloading that page. Also saw it is working again.

Tue Jan 31 09:55:21 +0000 2012

Always a keep way to check if your e-mail server setup is working. Incoming spam and PHP security alerts.

Tue Jan 31 10:00:47 +0000 2012

Replying to @SpamExperts and @ecnivnl

Announcing FP

The tool for DNS fingerprinting is fpdns, which is Perl based. In recent times development seems to have picked up, but a little competition never hurt anyone, so I wrote fp in Go. Fp is also a fingerprint program for DNS servers. Its aim is to be more readable then fpdns is (was?). And make it more easy to add new server types.

Help needed!

Do you have some old(er) nameserver laying around that can be queried? Does your (sick) mind know of a few extra evil queries that can be sent to nameservers? If so, please contact me: query@evilquery.nl. I want to get to a point where fp sends about 10 queries that can be used to identify a server.

Get the latest version (called weekly) of Go:

1. Get Go: hg clone -u release https://go.googlecode.com/hg/ go Note the directory you have downloaded it to and set $GOROOT to it: export GOROOT=$PWD/go. Add the GOROOT bin directory to your path: PATH=$PATH:$GOROOT/bin

2. Update Go to the latest weekly: cd $GOROOT; hg pull; hg update weekly

3. Compile Go: cd $GOROOT/src ; ./all.bash

   Install missing commands (gcc, sed, bison, etc.) if needed.

The latest Go is now installed.

When using dig to debug DNS/DNSSEC errors, you (I have the need, I’m assuming you have it too) often want to know:

• Are the signatures in the message correct?
• Does the NSEC3 authenticated denial of existence proof look OK? (this is a work-in-progress)

With dig this is next to impossible, because we humans can not validate RSA signatures, nor hash names for NSEC3 validation.

This is why I added a little feature to q, the query-tool found in godns. The tool looks very much like dig or drill (from ldns).

(This is an English translation of this blog article over at sidnlabs.nl)

After the publication of the SIDN NSEC3 white paper we received feedback of a number of people. The most constructive feedback was from Karst Koymans of the University of Amsterdam. This, together with the other feedback has led to a version 2 of the white paper.

This version has the following differences with respect to version 1:

• A number of corrections;
• The NSEC3 example now returns three NSEC3 records in stead of two;
• Two figures are added;
• Empty non-terminals are explained (a little).

Version 2 of the white paper can be found here. Or here locally.

(This is a English translation of this Dutch blog article)

By writing the NSEC3 whitepaper, we gained a lot of insight in how “authenticated denial of existence” works. But some new questions popped up:

• Is NSEC3 the most efficient way to do (hashed) authenticated denial of existence?
• Are there ways to optimize the NSEC3 record that asserts or denies the wildcard?
• Can’t we use Opt-Out for unhashed names too?

Answering these question led to the birth of NSEC4, which is documented in this internet draft.

This came up during a recent Pandoc discussion. The discussion was about outputting <sectN> section styling when creating DocBook XML. Currently Pandoc outputs nested <section>s.

I argued you could easily change between the two formats and <section> is more flexible, so just leave Pandoc as it is. But it allowed me to play with XSLT once more. With the following results.

Translate to sectN

This XSLT translates <section> to <sectN> where N is 5. If the sections are nested deeper it switches to <section>.

Replying to @stonehead

als de buren het papier buiten hebben staan moet je het ook buiten zetten #simpel

Sat Dec 31 10:09:31 +0000 2011

Een leuke Hollandse traditie. Ik denk 2 doden \(in den haag natuurlijk\), stuk of 10 zwaar gewonden. En overal rellen #oudennieuw

Sat Dec 31 12:31:38 +0000 2011

Xslt, Go, Perl, Bash, C, Java #code2011

Sat Dec 31 14:03:56 +0000 2011

Twitter already over capacity??

Sat Dec 31 15:14:40 +0000 2011

I’ve tweaked my vim color scheme quite a bit and tried to keep the colors of gvim (which I use less often) in sync.

This keeping in sync hasn’t worked out, so I wrote this little script to convert the vim colors to the gvim ones:

Download the makegvim script, and use it like:

$ ./makegvim < ~/.vim/colors/<yourfile> > /tmp/x
$ mv /tmp/x ~/.vim/colors/<yourfile>

And now the colors of gvim should be identical to those of vim.

I’ve create a little tool (actually an XSLT file) that helps to write RFCs. Browsing my github repo I found two different forks. And browsing those forks, I saw some commits I wanted to have.

But how do you merge a commit from a forked git repository? Turns out it is not that difficult.

The commit I want has the hash 5a11e88ddbef4ce7513aae93bdcd377449f45efb.

The steps:

• Create a remote branch:

    git remote add hamnis https://github.com/hamnis/pandoc2rfc
  

• Fetch the contents of it:

Replying to @geertjanweijman

Op google+ staat wat, maar ik moet het nog bij elkaar schrapen

Wed Nov 30 11:59:46 +0000 2011

I can’t help to feel sorry for people who are stuck with using windows as their desktop env. #SucksToBeYou

Wed Nov 30 13:40:44 +0000 2011

Replying to @zmooc

like prostitutes?

Wed Nov 30 13:59:21 +0000 2011

Replying to @tomhendr

Unity victims :-) #like

Wed Nov 30 14:08:22 +0000 2011

Replying to @zmooc

Gnome

(This is an English translation of this blog article over at sidnlabs.nl)

In theory DNSSEC isn’t really that complicated, but in practice some parts can be pretty intimidating.

One such part is “Authenticated denial of existence”. In short this is communicating, with certainty, to a resolver that a name does not exist in the DNS.

The DNSSEC specification uses two records (and thus actually two different methods) for this purpose:

• The NSEC record and;
• The NSEC3 record.

In this white paper (local copy) we explain how NSEC and NSEC3 work and what the main differences are. We also show the evolutionary path of NSEC to NSEC3.