mastodon.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
Generic Mastodon server for anyone to use.

Server stats:

11K
active users

#dns

49 posts46 participants5 posts today

So an update pushed out to stuff.co.nz over the last couple of days has made it pretty much unusable due to additional tracking/surveillance capitalism. Links from front page are not fetchable anymore if you sanitize #DNS / cookies etc #NewZealand #media usual agent switching techniques don't fix it - and it does it across the three browsers I tested.

TLDR: I will never again use XYZ owned domains

What a fucking debacle. I purchased a cheap .quest domain to run my xmpp server on for my family and a few close friends. It was on sale, was cheap and I grabbed it.
It lasted less than 24 hours before being suspended by the regsistrar.

Turns out, it ended up on a spamhaus list, and XYZ suspends domains automatically based on that. I have lodged tickets with each, but can't rectify because:
- Spamhaus issues can't be rectified because the domain is locked
- XYZ won't unsuspend because it is still on the Spamhaus blocklist

Chicken and egg. I have tickets with each, and with Porkbun which is where I started.
I get it. It's a fucking great scam to bleed money from spammers when they snap up cheap domains.

I just wanted one to self-host xmpp for my family though, and am now caught up in the loop sadly.

So now I will never use XYZ owned domains (there are a lot, and some fun ones sadly).

Spamhaus in itself isn't a bad thing; it is a great tool. But automatically flagging everything listed by it in your registrar? Yeah nah fuck that. XYZ using external blocklists where everything is automatically opted in with no practical recourse is a terrible idea. The same goes for domains, fedi, whatever. There is always collateral damage and it sours it for everyone. It is just a stupid.

#spamhaus #domains #domain #DNS #XYZ #spam #blocklist

“Your device has been blocked due to illegal activity” — 🙄 sure it has. After fat-fingering github[.]com, we were redirected to a domain running a fake Microsoft tech support scams: pop-ups that lock your browser, shout scary messages, and push you to call a “support” number (aka the scammer who’ll walk you through installing remote access tools).

They're hosted on legit infra like Azure blobs or Cloudflare Pages. That one redirect led to uncovering 1,200+ other domains hosting identical fake support pages. Of course, whenever a redirect like this happens, there's a malicious traffic distribution system (TDS) involved.

Examples include:
- tenecitur.z1.web.core.windows[.]net

- neon-kleicha-36b137[.]netlify[.]app

- us6fixyourwindowsnow[.]pages[.]dev

- microsoft-coral-app-6xv89.ondigitalocean[.]app

Continued thread

More #poser improvements:

* Use arc4random() if available, avoids excessive syscalls just to get high-quality random data
* Add a "resolver" to do #reverse #DNS lookups in a batch, remove the reverse lookup stuff from the connection which was often useless anyways, when a short-lived connection was deleted before resolving could finish 🙈

As a result, #swad can now reliably log requests with reverse lookups enabled 🥳