- WLUG - wlug.mailman3.com

Re: Reminder!!! September 18th WLUG Meeting! Topic: Tailscale / Nebula

by John Stoffel

Guys, This is a _fascinating_ talk about Linux containers, mount namespaces, etc. Stuff I sorta kinda knew, but don't use day to day. Really interesting! https://labs.iximiuz.com/tutorials/container-filesystem-from-scratch Cheers, John

Sept. 17, 2025

Reminder!!! September 18th WLUG Meeting! Topic: Tailscale / Nebula

by Tim Keller

Hey Everybody, We've got a meeting THIS Thursday! Time: 7pm Date: September 18th, 2025 Location: Technocopia, 44 Portland St. Worcester MA. Virtual Location: https://meet.jit.si/WlugMA Topic: Why Traditional Network Security is DOOMED! In this talk, I'll explain how we've *done *modern network security, and why tools like tailscale / headscale / nebula largely nullify some of this security. For those of us who are network / security administrators I'll talk about what we should be looking for, and I'll also show off how these technologies are amazingly useful. I will be definitely demoing Tailscale as I'm a daily driver of it and provided it doesn't break my existing stuff I'll show off Nebula. I'm sure this is going to foster a lively discussion about networking, firewalls, security in general and what security on modern networks is going to have to look like to address these new technologies. As usual after the meeting we'll go get some dinner and keep talking. I hope to see you all there! Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Sept. 15, 2025

Reminder! WLUG Meeting NEXT Week, Sept 18th, 2025!

by Tim Keller

Hey Everybody, Our next meeting is the 18th of September! I'll be giving a talk on tailscale / headscale and possibly nebula if I have time. The working title for the topic is "Traditional Network Security is DOOMED!" Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Sept. 8, 2025

Next meeting will be the 18th, not the 11th.

by Tim Keller

Hey Gang! I've got a conflict on the 11th, so I'm moving the meeting to the 18th. My plan is to talk about Tailscale / headscale and nebula to build secure networks that don't require punching holes in firewalls, etc. Let me know if you know of similar tech and I'll try to talk about that as well. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Aug. 28, 2025

Re: Spectrum, Recursive dns and interception of root authoritative DNS

by steve＠patternsoft.net

Aug. 27, 2025

Re: Spectrum, Recursive dns and interception of root authoritative DNS

by eroc1990

Might also be worth looking at Quad9's offering if you don't want tonfunnelmyour traffic to Google or Cloudflare. More info here: https://docs.quad9.net/Quad9_For_Organizations/DNS_Forwarder_Best_Practices… -------- Original Message -------- On 8/26/25 8:30 PM, Jared Greenwald via WLUG wrote: > If you're ever bored with using the Google recursors, give the Oracle recursors a try - 216.146.35.35 & 216.146.36.36 > > Source: I work on OCI's DNS service that maintains the recursors. > > On Tue, Aug 26, 2025 at 7:51 PM Tim Keller via WLUG <wlug(a)lists.wlug.org> wrote: > >> ISPs figured out a long time ago they could harvest and sell your DNS query information. Sure because of https they can't see what your google queries are, but they can deduce the results.. >> >> Just looking at my PiHole logs is pretty enlightening.. It's clear I was just about to go on vacation in Maine, before that I was researching places in the Berkshires, before that I was on a whole bunch of EV review sites. >> That's just filtering for stuff from this machine and my phone. If I turn the filter off and see all the queries, you can quickly figure out there are people into Dr. Who, Star Trek, Anime. Using spotify and discord and facebook and instagram and tumblr and reddit. >> >> Things like DNS over HTTPS and DNSSEC help, but just to stop MITM stuff.. if the ISP is running the DNS server, they can see the queries.. Now, maybe cloudflare or google is doing the same thing, but have far less of an understanding of who I am.. vs.. Verizon.. >> >> We can have a bigger conversation about what google knows about you.. >> >> Tim. >> >> On Tue, Aug 26, 2025 at 3:55 PM Keith Wright <kwright(a)keithdiane.us> wrote: >> >>> Tim Keller via WLUG <wlug(a)lists.wlug.org> writes: >>> >>>> I've long since decided to avoid using my ISP's dns and went to >>>> running PiHole with the upstream dns being 8.8.8.8 and 1.1.1.1 >>>> >>>> Tim. >>> >>> Other than the hack value of doing it yourself, >>> is there a specific reason that you avoid ISP DNS? >>> >>> -- Keith >> >> -- >> >> I am leery of the allegiances of any politician who refers to their constituents as "consumers". >> _______________________________________________ >> WLUG mailing list -- wlug(a)lists.wlug.org >> To unsubscribe send an email to wlug-leave(a)lists.wlug.org >> Create Account: https://wlug.mailman3.com/accounts/signup/ >> Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ >> Web Forum/Archive: https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/PWR56…

Aug. 27, 2025

Re: Spectrum, Recursive dns and interception of root authoritative DNS

by Jared Greenwald

If you're ever bored with using the Google recursors, give the Oracle recursors a try - 216.146.35.35 & 216.146.36.36 Source: I work on OCI's DNS service that maintains the recursors. On Tue, Aug 26, 2025 at 7:51 PM Tim Keller via WLUG <wlug(a)lists.wlug.org> wrote: > ISPs figured out a long time ago they could harvest and sell your DNS > query information. Sure because of https they can't see what your google > queries are, but they can deduce the results.. > > Just looking at my PiHole logs is pretty enlightening.. It's clear I was > just about to go on vacation in Maine, before that I was researching places > in the Berkshires, before that I was on a whole bunch of EV review sites. > That's just filtering for stuff from this machine and my phone. If I turn > the filter off and see all the queries, you can quickly figure out there > are people into Dr. Who, Star Trek, Anime. Using spotify and discord and > facebook and instagram and tumblr and reddit. > > Things like DNS over HTTPS and DNSSEC help, but just to stop MITM stuff.. > if the ISP is running the DNS server, they can see the queries.. Now, maybe > cloudflare or google is doing the same thing, but have far less of an > understanding of who I am.. vs.. Verizon.. > > We can have a bigger conversation about what google knows about you.. > > Tim. > > > On Tue, Aug 26, 2025 at 3:55 PM Keith Wright <kwright(a)keithdiane.us> > wrote: > >> Tim Keller via WLUG <wlug(a)lists.wlug.org> writes: >> >> > I've long since decided to avoid using my ISP's dns and went to >> > running PiHole with the upstream dns being 8.8.8.8 and 1.1.1.1 >> > >> > Tim. >> >> Other than the hack value of doing it yourself, >> is there a specific reason that you avoid ISP DNS? >> >> -- Keith >> >> > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/PWR56… >

Aug. 27, 2025

Re: Spectrum, Recursive dns and interception of root authoritative DNS

by Tim Keller

ISPs figured out a long time ago they could harvest and sell your DNS query information. Sure because of https they can't see what your google queries are, but they can deduce the results.. Just looking at my PiHole logs is pretty enlightening.. It's clear I was just about to go on vacation in Maine, before that I was researching places in the Berkshires, before that I was on a whole bunch of EV review sites. That's just filtering for stuff from this machine and my phone. If I turn the filter off and see all the queries, you can quickly figure out there are people into Dr. Who, Star Trek, Anime. Using spotify and discord and facebook and instagram and tumblr and reddit. Things like DNS over HTTPS and DNSSEC help, but just to stop MITM stuff.. if the ISP is running the DNS server, they can see the queries.. Now, maybe cloudflare or google is doing the same thing, but have far less of an understanding of who I am.. vs.. Verizon.. We can have a bigger conversation about what google knows about you.. Tim. On Tue, Aug 26, 2025 at 3:55 PM Keith Wright <kwright(a)keithdiane.us> wrote: > Tim Keller via WLUG <wlug(a)lists.wlug.org> writes: > > > I've long since decided to avoid using my ISP's dns and went to > > running PiHole with the upstream dns being 8.8.8.8 and 1.1.1.1 > > > > Tim. > > Other than the hack value of doing it yourself, > is there a specific reason that you avoid ISP DNS? > > -- Keith > > -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Aug. 26, 2025

Re: Spectrum, Recursive dns and interception of root authoritative DNS

by steve＠patternsoft.net

Got my own router. SO I have just a 3rd party modem I own that’s not a spectrum device, just a docsis 3.1 device compatible with spectrum. But no I haven’t set any transparent/bridge settings. That’s actually a good idea to check. I always think of the modem as invisible infrastructure but worth a look. Thanks! Steve Thibault > On Aug 26, 2025, at 4:41 PM, Chuck Anderson <cra(a)fea.st> wrote: > > Did you turn off any "security" features Spectrum has on the cable modem/gateway and put it into transparent bridging mode and use your own router? > > On Tue, Aug 26, 2025 at 04:02:17PM -0400, steve--- via WLUG wrote: >> Privacy. I don’t want one org, source, company knowing EVERY DNS query I make from my house and therefor every company, site, organization, service,…,etc that I use. >> >> If I have a recursive DNS server that doesn’t go to one DNS forward like Spectrum, Google, Cloud flair, etc, server, but instead caches the root entries locally on initial startup for .com, .net, .bix, .org, etc, and then cache as I go the next level down, nobody ever when and what I query but once, and then that’s just the next level of the recurse, which is auto refreshed when the cache TTL runs out. So I keep as much of my digital data away from prying eyes as possible. As the IETF says in their specs, passive monitoring is an attack, and should reasonable measures should be taken to reduce or eliminate it. >> >> Steve Thibault >> >>> On Aug 26, 2025, at 3:55 PM, Keith Wright via WLUG <wlug(a)lists.wlug.org> wrote: >>> >>> Tim Keller via WLUG <wlug(a)lists.wlug.org> writes: >>> >>>> I've long since decided to avoid using my ISP's dns and went to >>>> running PiHole with the upstream dns being 8.8.8.8 and 1.1.1.1 >>>> >>>> Tim. >>> >>> Other than the hack value of doing it yourself, >>> is there a specific reason that you avoid ISP DNS?

Aug. 26, 2025

Re: Spectrum, Recursive dns and interception of root authoritative DNS

by Chuck Anderson

Did you turn off any "security" features Spectrum has on the cable modem/gateway and put it into transparent bridging mode and use your own router? On Tue, Aug 26, 2025 at 04:02:17PM -0400, steve--- via WLUG wrote: > Privacy. I don’t want one org, source, company knowing EVERY DNS query I make from my house and therefor every company, site, organization, service,…,etc that I use. > > If I have a recursive DNS server that doesn’t go to one DNS forward like Spectrum, Google, Cloud flair, etc, server, but instead caches the root entries locally on initial startup for .com, .net, .bix, .org, etc, and then cache as I go the next level down, nobody ever when and what I query but once, and then that’s just the next level of the recurse, which is auto refreshed when the cache TTL runs out. So I keep as much of my digital data away from prying eyes as possible. As the IETF says in their specs, passive monitoring is an attack, and should reasonable measures should be taken to reduce or eliminate it. > > Steve Thibault > > > On Aug 26, 2025, at 3:55 PM, Keith Wright via WLUG <wlug(a)lists.wlug.org> wrote: > > > > Tim Keller via WLUG <wlug(a)lists.wlug.org> writes: > > > >> I've long since decided to avoid using my ISP's dns and went to > >> running PiHole with the upstream dns being 8.8.8.8 and 1.1.1.1 > >> > >> Tim. > > > > Other than the hack value of doing it yourself, > > is there a specific reason that you avoid ISP DNS?

Aug. 26, 2025