Internet – Terence Eden’s Blog

Are LLMs still surprisingly bad at some simple tasks?

Terence Eden — Tue, 22 Sep 2026 11:34:27 +0000

Last year I ran an experiment to test the ability of modern LLMs to correctly answer a relatively straightforward question. Every single one of them got it wrong. Some missed information, some made up false statements, none were right.

Of course the fanbois variously claimed that I was holding it wrong, my prompts were shit, I should have chosen better defaults, and - my favourite - that it would be better next year.

Well, next year is now. 365 days after the original experiment, let's see if these self-reinforcing-learning machines have achieved anything close to intern-levels of competence.

The Question That Started It All

I asked:

Which TLDs have the same name as valid HTML5 elements?

Why It Matters

This is the sort of question that I would expect a moderately bright teenager to answer. There exists a list which comprehensively includes all TLDs. There is a separate list which contains every HTML element.

One could either manually go through the TLD list comparing it to the HTML list, or write a tiny scrap of code to do the same.

This isn't "solve Navier-Stokes" levels of superintelligence. It's a simple but boring task which people are bound to offload onto their digital sycophants.

The Quiet Part Out Loud

How many LLM generated answers have become load-bearing without scrutiny?

People are lazy, slapdash, and some third thing to make the rule-of-three. If an answer looks answer-shaped, they'll accept it. On a simple but boring task, no reasonable human is going to suspect that a superintelligent computer has made a mistake. All the marketing says that these machines are brainier than you - so why bother?

OK, I'll write a sub-heading that sounds like an AI.

So how did the current crop do? First up Google Gemini.

The default "Flash" model came up with this:

Valid top-level domains (TLDs) registered in the IANA Root Zone Database share exact names with standard HTML elements:

.a — <a> (Anchor/Hyperlink)

.app — <app> (Deprecated HTML tag for WebAPKs/WebApps)

.art — <art> (Historical/non-standard HTML element)

.audio — <audio>

.bar — <bar> (Historical SVG/HTML draft tag)

Then it listed a dozen more. You don't need to be a DNS expert to know that the minimum length of a TLD is two characters - .a simply isn't valid. HTML nerds will know that art, app, and bar have never been elements. Pathetic.

So I tried Gemini's extended thinking model. Thankfully, it didn't make up any imaginary TLDs or elements. It did, however, miss the <data> element which has a valid .data TLD. It also missed map, select, and search.

So, points for not making shit up. But demerits for not being able to compare two text lists.

A friend asked Claude. That missed search and select. It didn't report any ccTLDs. You could argue that a country code like li isn't part of the original question - but I'd say that was weak justification; the set of TLDs contains ccTLDs.

A different friend (I have many!) used a different model and, while the answers looked accurate, it included this at the end:

Near misses that don't count: .codes, .forum, .pictures, .market, .navy, .press, .dell, .baseball.

I get that there's a <code> and .codes, similarly <picture> and .picture - but what are forum, baseball, and the others doing there? This is just unnecessary verbiage designed to trick the user into thinking the task has been well-researched.

If you want a laugh, take a look at Perplexity which found 54 matches - most of which were wrong.

Finally, someone asked "GPT Astra 6 Extra High" (which is a bonkers bad name for any product). It seemed to get all the elements - and made a note that two were actually obsolete.

So that's a range of modern models which are either very wrong, slightly wrong, included spurious and incoherent information, or were right.

How do you know which one to choose? How confident are you that the non-determinist computer will always produce the correct answer?

Hello Computer

Another AI which got all the correct answers, didn't make anything up, didn't add extraneous information, and didn't use weasel words was…

Siri!

FUCKING SIRI?!?!

How did a glorified Speak 'n' Spell beat all the other AIs?

Oh. It just copied the answers off a random idiot's website.

The Trick Which Was Hiding In Plain Site

Note carefully the question.

Which TLDs have the same name as valid HTML5 elements?

There's a —secret— and —some would say— unintuitive type of element. Behold the mighty power of The Custom Element.

Website authors can create their own elements like <my-custom-element> in order to extend the functionality of their site. But you can't go and create any old custom element. You can't have <mobi> or <uk>. No, there are rules for validity.

The rules say that custom elements must start with a lower-case letter, it must not contain any upper-case letters, and it must contain a dash.

And that's the whole game.

There are over one hundred and fifty Top Level Domains which match that criteria!

The Hindi top level domain of .कॉम is represented in Punycode as xn--11b4c3d. It has been present in the list of TLDs for over a decade.

Write a simple piece of JS to register a custom element.

Paste this in to your console:

class Example extends HTMLElement {
  constructor() {
    super();
  }
}

customElements.define('xn--vermgensberatung-pwb', Example);

Try it again with a custom element like holiday (which is also a valid TLD) and it will fail with the error "'holiday' is not a valid custom element name". Thus it is demonstrated, Punycode TLDs are valid HTML5 elements.

One Last Thing

Perhaps you think that including custom HTML elements is a cheat. A trick question set by a bitter old man to tarnish the holy name of our new machine gods?

Verily, I submit to you one final heresy.

HTML specifically allows MathML elements in its documents.

That means we can include the following valid elements which are also TLDs: mn, mo, ms, and mtr!

Amusingly, if you go back and look at the Perplexity answer, after it barfed up a bunch of misinformation, it said:

The HTML specification also includes names from embedded vocabularies—<math> from MathML and <svg> from SVG—but .math and .svg are not currently delegated TLDs in the public DNS root.

So close and yet so far!

You're right, the question is unfair - and that's on me

If you think the original question was unfair, try asking "Which TLDs have the same name as elements which are valid in an HTML document?" and see if you get better results.

What precise wording would you use to ensure that a model would get the right answers? What assumptions are you making about how well you understand the problem? At what point do end up writing a thousand-word formal specification?

What does this prove other than you have too much time on your hands? (rewrite to be more friendly and professional)

Let's delve in to the problems.

Most people don't change defaults. Telling people "you have to fiddle with the settings" just means the normal experience is rubbish.
Humans are lazy and won't check outputs. But, crucially, they shouldn't have to! If something markets itself as a genius, why should a human have to hold its hand?
Sycophantic models make themselves seem less fallible by giving extraneous detail in order to misdirect overworked readers. That is despicable.
The fast models are no better than they were a year ago. There's no evidence of "trickle-down intelligence".
Some models are better than others! But unless you constantly validate their output, you'll have no real way of knowing which ones are capable of working at a suitable level.

Look, I don't claim this question is as useful or entertaining as Simon Wilson's "generate an SVG of a pelican riding a bicycle". But I do think it is an example of the sort of real-world use-case where LLMs regularly fail.

If I give a list of one thousand different numbers to Excel, I can be sure it'll add them up correctly. If I tell Photoshop to select all red pixels, I can be sure it won't imagine some of the blues are really red.

That's people's mental model of computers - they do boring tasks quickly and accurately.

In my opinion, LLMs are still surprisingly bad - but only if you know what you're looking for and if you can be bothered to check their outputs.

(And, yes, I am still just so bored of AI!)

The purpose of DNS is to spread scams

Terence Eden — Sun, 06 Sep 2026 11:34:20 +0000

I imagine everyone here has received an unsolicited message telling them that their tax is overdue and that they urgently need to visit Genuine-Tax-Payment-Website.fart or that a parcel is delayed at customs and you can pay a small sum for its release at Almost-The-Right-Acronym.ak

You know it is a scam. Most people just mark as spam and move on with their day. But a significant number of people don't. They hastily visit the site, tap in their credit card details, give it their mother's maiden name, confirm address, upload a nude selfie, and only then realise that they've been had.

The Internet works at pretty close to the speed of light. You can register a .uk domain and a minute later it's accessible from the other side of the planet. Brilliant for users who want to quickly launch a website. Also brilliant for abusers who want to launch a spam campaign.

By the time enough people have reported the scammers' domain as suspicious, it is too late. In the time it takes for a registrar to disable the domain, or for its name to make its way to the Safe Browsing List, a million messages have already been sent and enough people have handed over their details.

We're told that "the purpose of a system is what it does". At the moment, the Domain Name System's purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate.

How big is this problem?

BIG!

There's a great blog post by Andrew Campling which reports on this startling claim:

The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis. It estimated that, taking account of subsequent blocklisting and associated domains not themselves blocklisted, the share of names registered by malicious actors may be closer to 20%.

DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists (emphasis added)

That links to a presentation by Interisle which contains some rather shocking statistics (albeit with disputed methodology). It looks at generic Top Level Domains (gTLD) - those are things like .com and .fun rather than country code TLDs (ccTLD) like .uk and .de.

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it's probably closer to 20%. One in five newly registered domains with a gTLD are scams. That's a bloody crisis.

13 TLDs had more than 50% of their registrations blocklisted.

I can understand why .bid and .loan are popular with scammers. But why .mobi?! What did I ever do to you, eh?

Who are the scammers registering these through?

Ah, our old friends at NameCheap. See Why do scammers love NameCheap?

If those five registrars had more effective policies, it might significantly dent the scammers' ability to ply their devious wares. Or they might just move on to other registrars.

As the report points out:

suspension rates for blocklisted domains were 7.4% to 16.3%.

The full report is on the Interisle website.

What can be done?

I don't know.

In the first instance, it might make sense for registrars to do strong Know Your Customer (KYC) checks on anyone buying a domain. But that stops anyone who wants to anonymously register I-Hate-Nintendo.whatever without risking the wrath of Intellectual Property lawyers.

Also, criminals have access to stolen money and stolen cards. They can convince a hapless mule to register a domain on the criminals' behalf.

Registrars could ask for an escrow payment. Pay €9 for the domain name put €900 in escrow. If your domain appears on a blocklist within the year, you forfeit the money. Criminals with stolen funds are unlikely to care but it would probably put off lots of people from getting a new domain.

There are various banned words and phrases depending on the TLD. For example, South Sudan has a list of political words which they don't want associated with their .ss ccTLD.

But if one gTLD bans a word, a different one might not. A scammer doesn't care if the gTLD is .arse or .elbow - they just want the start of the domain to look legitimate.

Some registrars have strings that they don't allow. In fairness to NameCheap, when I tried to register dwp-payments-gov-uk.pizza it told me that domain was banned. It wouldn't let me get any gTLD with that name.

But all it takes is one registrar to be slightly lax and the scammers get through. Increasing the complexity of the rules is also a hell of a burden on smaller registrars.

Besides, it's pretty easy to get a generic enough looking domain and stick the confusing bit on a subdomain. Here are a clutch mentioned in the report:

https://gov.uk-dwpaph.bond/uk/
https://gov.uk-dwpcjh.bond/uk/
https://gov.uk-dwpclc.bond/uk
https://gov.uk-dwpclw.bond/uk
https://gov.uk-dwpclj.bond/uk/

Perhaps there ought to be a delay before a new domain goes live to allow people to object to it? That would give governments, banks, delivery companies, and a dozen more "important" organisations a right to veto any "dodgy" looking domain.

But suppose someone wants to register gov-uk-stole-my-horse.horse to protest the government's cruel policy of stealing horses - is that a legitimate use of a domain? What if the Darwin Pensioner Divas - a group of elderly singers - want to take payments for their new album of goth/punk covers, can the DPD delivery company veto dpd-payments.music?

Do we want a domain name system where powerful companies control exactly which domains we can register? If I have an idea for a domain on a Friday night do I have to wait until Monday before it can be launched? Are those companies realistically able to parse millions of domains per year and have a low false-positive rate?

All of these things are possible - but all of them come with an impact on legitimate users. To be clear, I don't know what the right answer is.

What is ICANN doing about it?

Lots! It has been a few years since I've been to an ICANN meeting, but even back then the topic of abuse was high on the agenda. They appear to be looking at ways to coordinate abuse reports between various entities, along with some other policies which should hopefully work.

There are two salient points from one of the discussions held at the recent meeting

If anybody thinks that in our current age of AI and as we move into different kinds of computing, DNS abuse is going to numerically stay steady and we will have a downward effect on that baseline 2027 number. I'm not sure that that's an accurate assumption. I think it's going to be the other thing, which is […] it's going to be easier to abuse the DNS.

And

Abusers are going to abuse because it's just too lucrative, because no matter what we do, they will find the way to make profit off of that, and will try to circumvent everything that we do. That is not a reason not to do it, though.

Quite!

As I said, I don't know the answer to this. What I do know is, much like Android's app ecosystem being a haven for scammers, DNS is facing a crisis. When trust in a system goes, only chaos follows.

I don't want to live in a world where I have to show my passport and pay thousands of pounds to register a domain which is only available after being vetted by private interests. But I also don't want to live in a world where scammers have effectively no deterrent from abusing millions of people.

The purpose of a system is what it does. I hope DNS's purpose can become less dangerous while still remaining open.

Two Way TV - product photos of 1997's hottest gadget

Terence Eden — Tue, 16 Jun 2026 11:34:18 +0000

Back in the late 1990s, I did a brief stint of work experience at the BBC. One of the most memorable moments was sitting in on a meeting about early forms of Interactive TV.

I saw a demo of "Two Way TV". A flimsy grey box which (somehow) integrated with your OnDigital TV Box and connected to a server via a modem. If you were watching "Who Wants To Be A Millionaire" you could play along at home, send in your answers in realtime, and win REAL CASH PRIZES!!!

An anonymous benefactor read my blog post about the tech, had a pootle through their loft, and found one of the trial boxes they'd been sent in June 1997. With their kind permission, here are some photos of the future we never got.

The unit came in a chunky box with enough logos to convince you it was safe to plug in to the phone network.

Flipping it over, we see a little more of the tech-specs and a defunct barcode (5033936000023 for anyone searching) and product number (SD2044N).

Mmmm! NICAM! So, what did the Set Top Box (STB) actually look like:

Pretty much the same as every other Digital TV STB of the era. A featureless grey slab. Here's a closer view.

How was it all connected? Here's the rear of the box:

Aerial in and out - I assume it had a digital decoder in it, but could pass the analogue channels through to the TV.

Stereo out, for plugging in to your sound system.

SCART in and out. I assume that let you connect your VCR or games console in pass-through mode.

Keyboard looks like a PS/2 port - which would have been the standard at the time. Comms and Remove Receiver both appear to be 8 pin serial connectors.

Finally, there's a standard telephone port for connecting to the dial-up service which makes it all work.

So, you've plugged in all the wires, how do you actually play the games? The unit comes with two controllers - one red and one blue.

The four buttons (triangle, square, circle, lozenge) were for answering on-screen questions. There's an up and down scroller in the middle and a help button above it. I don't know what the large grey circle does.

But what's the peculiar button on the coloured background? That's an early cursor control! Commercially available touchscreens were still in their infancy. This physical controller allowed you to position a digital cursor on screen. Nifty!

Also in the box was a TV guide:

A getting started leaflet:

There's also a service manual:

I don't know what the difference was between SD2044 and SD2044N. Do you?

How much would this amazing interactive experience cost you? I've no idea about the upfront payment for the kit, but there's a Direct Debit form for the monthly subscription.

That's about £14 in today's money.

So there you have it! A snapshot of 1997's vision of the future. From my understanding, the box was never a hit with the public. Two Way TV pivoted to other forms of interactive content like premium-rate phone-ins before going bust in 2003.

If you have any more memories of the service, or interesting photos, please leave a comment or get in touch with me.

Update! Some more information has been found:

Ooh! Ooh! I have some niche information about this. It appears that stuff was broadcast to these boxes via teletext databroadcast packets - we've seen mysterious data streams with references to two way tv in teletext recoveries from Channel 4 recordings.
— ZXGuesser (@zxguesser.bsky.social) 17 June 2026 at 12:59

With ZXGuesser's kind permission, here are some of the recovered data packets. They're fairly corrupt (recording Teletext to VHS isn't an exact science) but you can see some clear mentions of Two Way TV.

Here's something about a trial period being extended:

This looks like code for a game:

Quiz results by household (possibly test data):

Control code and UI code, possibly for a 68000 device:

If you have more info to share, please let me know.

How many consecutive hyphens can you have in a domain name?

Terence Eden — Mon, 08 Jun 2026 11:34:59 +0000

A seemingly simple question which sent me down into the murky depths of standards. How many consecutive hyphens can you have in a domain name? It probably isn't sensible to name your online presence a----------hyphen.com - but is there anything technically stopping you?

History

Let's do some history!

This is 1978's "HOST NAMES ON-LINE". Early Internet standards described the - character as "minus" rather than hyphen.

RFC 608

up to 48 characters drawn from the alphabet (A-Z),

digits (0-9), and the minus sign (-) ... specifically, no blank or space characters allowed;

no distinction between upper and lower case letters;

the first character is a letter;

the last character is NOT a minus sign;

no other restrictions on content or syntax.

So, originally, you could have as many hyphens as you wanted after the first symbol - which had to be a letter. The last symbol had to be a letter or number⁰.

That was later formalised in 1981's "DoD INTERNET HOST TABLE SPECIFICATION"

RFC 810 GRAMMATICAL HOST TABLE SPECIFICATION

<name> ::= <let>[*[<let-or-digit-or-hyphen>]<let-or-digit>]

That's carried in the the slightly more modern RFC 952.

By the time we hit 1987, the word "minus" has gone. Note, there are no restrictions on the number of hyphens - just as long as your domain name doesn't start or end with one¹.

RFC 1035 2.3.1. Preferred name syntax

The labels must follow the rules for ARPANET host names. They must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphen.

By 1989, the "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" was tweaked again:

RFC 1123 2. GENERAL ISSUES

The syntax of a legal Internet host name was specified in RFC-952. One aspect of host name syntax is hereby changed: the restriction on the first character is relaxed to allow either a letter or a digit. Host software MUST support this more liberal syntax.

And, from then on, things stayed pretty stable until the futuristic year 2010. That was when Internationalised Domain Names (IDN) became available. They use the xn-- string at the start of the name so, the spec now says:

RFC 5891 4.2.3.1. Hyphen Restrictions

The Unicode string MUST NOT contain "--" (two consecutive hyphens) in the third and fourth character positions and MUST NOT start or end with a "-" (hyphen).

What they really mean is that "--" is banned in position 3 & 4 unless the first two characters are "xn"².

So, in theory, you can have up to 59 consecutive hyphens by ensuring that they start in position 4 and end at position 62.

Something like abc---[…]---z.com should be fine.

OR IS IT?!?!?

TLD Restrictions

There's what the RFC's say, and what a Top Level Domain (TLD) will allow. The Registry (the organisation which administers the TLD) may set their own, more restrictive, policies. Some will ban naughty words, or refuse IDN registrations, or prevent impersonation of Public Suffix domain, etc.

For example, South Sudan's .ss policies refuse to allow any hyphens.

Nominet, who run the .uk Registry, don't have any restrictions on the use of hyphens other than refusing to register xn-- domains.

But, in general, you can register multi-hyphened domain names with most Registries.

Anomalies

Of course, the mighty Internet mostly runs on spit and hope³. Naturally there are going to be mistakes, glitches, exceptions, and anomalies.

My delightful friend Q Misell had a rummage through her archives and helped track down some of the domain names which violate the modern rules. It's somewhat difficult to query every domain name, nevertheless, there are hundreds of multi-hyphened domains lurking within DNS.

Some, like ok--computer.com are long dead, but some are still active⁴!

Possibly the most consecutive hyphens belongs to http://a-------------------------------------------------------------a.com/

Sixty-one hyphens! The maximum possible, and it still works! The website looks like it hasn't been updated since it was first registered in 2000.

But what about more modern domains? The spookily named http://zz--icann-monitoring.uk/ was registered in 2024 - long after the rules were updated. But as Nominet doesn't allow xn-- domains, I guess it is fine?

There are some domains like bq--3bhauz7frjrgbka.com which look like they were pseudo-randomly generated. Perhaps as command-and-control servers?

Here's a quick table showing some of the ones Q found:

Domain	Creation Date	Status
`0-------------------------------------------------------------0.com`	1999	Down
`0-------------------------------------------------------------5.com`	2001	Live
`0---------------------0.com`	2000	Live
`0----------------0.com`	2000	Live
`0---------0.com`	2000	Live
`pr--newswire.org.uk`	2005	Down
`0o--o0.com`	2000	Down
`a-----a.net`	2000	Down
`pr--newswire.uk`	2019	Down
`uk--domain--names.uk`	2019	Live
`zz--icann-monitoring.uk`	2024	Live
`cd--storage-shelves.co.uk`	2012	Live
`mb--uk.co.uk`	2015	Live
`o---t.co.uk`	2016	Live
`om--tat-sat.co.uk`	1999	Live
`pr--newswire.co.uk`	2005	Down
`uk--domain--names.co.uk`	2000	Down
`we--buy--any--car.co.uk`	2009	Down
`i---i.net`	2001	Down
`a-------------------------------------------------------------a.com`	2000	Live
`a---b.com`	2000	Down
`v---v.net`	2000	Down
`we--care.net`	1999	Down
`b---h.com`	2001	Down
`bq--3bhauz7frjrgbka.com`	2000	Down
`bq--3bhauz7frjrgbkdcia.com`	2000	Down
`bq--3cbpcty2rjyq.com`	2000	Down
`bq--744a.com`	2000	Down
`bq--abs7czi.com`	2000	Down
`bq--abxgt4lb.com`	2000	Down
`bq--azbukkckjavdc.com`	2000	Down
`bq--azdecny.com`	2000	Live
`bq--eh7xj73b75xp62x7mh7xgah7ad7xj73b75xa.com`	2000	Down
`bq--gbbpy2enmnhq.com`	2000	Down
`bq--gbtfs2a.com`	2000	Down
`bq--s7z76.com`	2000	Down
`bq--zzzz.com`	2000	Down
`c-------7.com`	2001	Live
`f---you.com`	1998	Down
`id--design.com`	1999	Down
`ok--computer.com`	2001	Down
`t---28.com`	2000	Live
`t---taz---t.com`	2001	Down

Note, "Live" just means an HTTP request returned something. There may, of course, be other services running on that domain, or on subdomains.

So What?

Without a full list of every domain name, it's rather hard to draw firm conclusions. But, in the absence of anything better to do, here are some thoughts.

Most people don't want multiple consecutive hyphens in their domain names. They're unwieldy but mostly not prohibited.
If the authors of RFC 5891 had access to a full list of domains, might they have chosen a different syntax for Punycode?
Why is it so hard to look through every single registered domain name anyway? Even Certificate Logs no longer seem to be easily searchable.
Are there any other weird restrictions which are violated by older domain names?
When will DNS finally go all-in with Unicode rather than this kludge? (Probably around the same time as IPv6 adoption!)

If you know of any weird multi-hyphenated domains, please stick a comment in the box 😊

Update! A kind anonymous benefactor has shared a list of eighty-four thousand domains with multiple hyphens. There are some very odd entries in there.

Way back in the year 1999, several domains were registered with trailing hyphens. This was swiftly corrected and the domains deleted. ↩︎
Note, I think this is when domain names expanded from 48 characters to 63. But that's a different Yak to Shave. ↩︎
I wonder why this isn't zero-based like so many other computery things. But that's a different rabbit hole. ↩︎
And, so I'm told, a cabal of vicious Furries waiting to pounce. ↩︎
There are also quite a few for sale. ↩︎

This time is different

Terence Eden — Thu, 26 Feb 2026 12:34:39 +0000

3D TV, AMP, Augmented Reality, Beanie Babies, Blockchain, Cartoon Avatars, Curved TVs, Frogans, Hoverboards, iBeacons, Jetpacks, Metaverse, NFTs, Physical Web, Quantum Computing, Quibi, Small and Safe Nuclear Reactors, Smart Glasses, Stadia, WiMAX.

The problem is, the same dudes (and it was nearly always dudes) who were pumped for all of that bollocks now won't stop wanging on about Artificial Fucking Intelligence.

"It's gonna be the future bro, just trust me!"

"I dunno, man. Seems like you say that about every passing fancy - and they all end up being utterly underwhelming."

"This time is different!"

*sigh*

The investor who says, “This time is different,” when in fact it’s virtually a repeat of an earlier situation, has uttered among the four most costly words in the annals of investing.

16 rules for investment success - Sir John Templeton

All of the above technologies are still chugging along in some form or other (well, OK, not Quibi). Some are vaguely useful and others are propped up by weirdo cultists. I don't doubt that AI will be a part of the future - but it is obviously just going to be one of many technology which are in use.

No enemies had ever taken Ankh-Morpork. Well technically they had, quite often; the city welcomed free-spending barbarian invaders, but somehow the puzzled raiders found, after a few days, that they didn't own their horses any more, and within a couple of months they were just another minority group with its own graffiti and food shops.

Terry Pratchet's ~~Faust~~ Eric

The ideology of "winner takes all" is unsustainable and not supported by reality.

Preventing NAPTR Spam

Terence Eden — Mon, 18 Aug 2025 11:34:47 +0000

You're the sort of cool nerd who knows all the weird esoterica which makes up DNS, right? In amongst your A, AAAA, SOA, and MX records, there's a little used NAPTR. Yes, you can use DNS to store Name Authority Pointers!

What?!

It is yet another of those baroque standards which spits out things like:

cid.uri.arpa.
;;       order pref flags service        regexp           replacement
IN NAPTR 100   10   ""    ""  "!^cid:.+@([^\.]+\.)(.*)$!\2!i"    .

Essentially, it is a way to store contact details within a DNS record (rather than in a WHOIS record).

Back in the early 2000s, the dotTel company opened the .tel TLD with a promise that it could be used to store your contact details in DNS⁰. The idea was simple, rather than storing my phone number in your address book, you'd store my domain name - https://edent.tel/

If I updated my phone number, changed my avatar, or deleted an old email address - your address book would automatically update via DNS. Nifty!

If you didn't know a company's phone number, you'd dial example.com on your phone and it would grab the phone numbers from DNS. Wowsers trousers!

You can see an example by running:

dig justin.tel NAPTR

You'll get back something like:

NAPTR   100 101 "u" "E2U+web:http" "!^.*$!http://justinkhayward.com!"

A phone number stored in a NAPTR would look something like:

NAPTR   100 100 "u" "E2U+voice:tel" "!^.*$!tel:+442074676450!" .

Brilliant! But there's a problem - aside from the somewhat obtuse syntax! - and that problem is spam.

Those of you old enough to remember putting your unexpurgated contact details into WHOIS know that the minute it went live you were bombarded with sales calls and scammy emails. So putting your details directly into DNS is a bad idea, right?

.tel thought they'd come up with a clever hack to prevent that. As they explain in the .tel privacy paper, records can be individually encrypted.

Alice has her contact details on alice.tel
Bob has his contact details on bob.tel
Alice agrees to share her phone number with Bob.
Alice looks up Bob's public key from bob.tel.
Alice encrypts her phone number.
Alice generates a new DNS record specifically for Bob - bob123456.alice.tel
Alice shares the name of the new record with Bob.
Bob downloads the NAPTR from bob123456.alice.tel and decrypts it with his private key.
Bob periodically checks for updates.
Alice can decide to revoke Bob's access by removing the data or subdomain.

Clever! If convoluted. You can read more about the way friendships and public keys were managed and some more technical details.

Are there better ways?

Multi Recipient Encryption

When people say "you can't give Government a secret key to your private messages" they are technically incorrect¹. Multi Recipient Encryption is a thing.

Here's a very simplified and subtly wrong explanation:

Alice creates a temporary public/private keypair.
Alice encrypts some text with her temporary public key - resulting in e.
Alice encrypts the temporary private key with Bob's public key - resulting in k1.
Alice encrypts the temporary private key with Charlie's public key - resulting in k2.
Alice publishes the concatenation of e+k1+k2
Bob downloads the file, decrypts his version of the key, and uses that to decrypt the message.
Charlie does the same.

In this way, both recipients are able to decipher the text but no one else can. So can we just shove an encrypted record in the NAPTR? Not quite.

There are two main problems with this for DNS purposes.

The encrypted size grows with every recipient.
Every time a new recipient is added, everyone needs to download the data again even if it is unchanged.

Generally speaking, DNS records are a maximum of 255 characters - although they can be concatenated.

An extra record could be used to say when the plaintext was last updated - which would let existing recipients know not to download it again.

Monitoring for changes would allow a user to know roughly how many recipients had been added or removed.

What other ways could there be?

What else could be done?

Here's the user story.

I want a friend to subscribe to my [phone|email|street|social media] address(es).
I must be able to pre-approve access.
When I change my address, my friend should get my new details.
I need to be able to revoke people's access.
This should be done via DNS².

Using an API this would be playing on easy mode. A friend (or rather, their app) would request an API key from my service. I would approve it, and then ✨magic✨.

DNS isn't technically an API although, with enough effort, you could make it behave like one³.

So - how would you do it?

Even back in 2009 I didn't think it was terribly compelling. By 2013, it was almost dead. And in 2017 it became just another generic TLD. ↩︎
The worst type of incorrect. ↩︎
Why DNS? Because I like making life difficult. ↩︎
If you were a sadist! ↩︎

Get the location of the ISS using DNS

Terence Eden — Sun, 06 Jul 2025 11:34:33 +0000

I love DNS esoterica. Weird little things that you can shove in the global directory to be distributed around the world instantly(ish).

Domain names, like www.example.com usually resolve to servers. As much as we think of "the cloud" as being some intangible morass of ethereal Turing-machines floating in probability space, the more prosaic reality is that they're just boxen in data centres. They have a physical location.

Got a tricky machine which is playing silly-buggers? Wouldn't it be nice to know exactly where it is? That way you can visit and give it some percussive maintenance.

Enter the DNS LOC record!

The snappily titled RFC 1876 is an experimental standard. It allows you to create a DNS record which specifies the latitude and longitude of your server. Of course, some data-centres are very tall and some are underground. So it also contains an altitude parameter.

The standard allows for a minimum altitude of -100,000 metres - deep enough for any bunker! The maximum altitude is 42,849,672 metres which is high enough to allow it to be used on satellites in geostationary orbit.

So, as a bit of fun, I decided to create where-is-the-iss.dedyn.io

It isn't a website. You can't ping it. There's no way to interact with it except by using DNS. Yup! You can use a DNS query to get the (approximate) location of the International Space Station!

Linux and Mac users⁰ can run:

dig where-is-the-iss.dedyn.io LOC

And receive back the latest position of the ISS:

;; ANSWER SECTION:
where-is-the-iss.dedyn.io. 1066 IN  LOC 47 24 53.500 N 66 12 12.070 W 430520m 10000m 10000m 10000m

The DNS records are updated every 15 minutes on a best-effort basis¹.

How

The lovely people at N2YO have a website which allows you to track loads of objects in orbit. They also have an easy to use API with a generous free tier.

Calling https://api.n2yo.com/rest/v1/satellite/positions/25544/0/0/0/1/&apiKey=_____ gets back the latest position:

{
    "info": {
        "satname": "SPACE STATION",
        "satid": 25544,
        "transactionscount": 7
    },
    "positions": [
        {
            "satlatitude": -21.25409321,
            "satlongitude": 140.3335763,
            "sataltitude": 420.09,
            "azimuth": 292.92,
            "elevation": -70.95,
            "ra": 202.69300845,
            "dec": -32.16097472,
            "timestamp": 1751366048,
            "eclipsed": true
        }
    ]
}

Note that the altitude is in Km, whereas the LOC format requires m.

The latitude and longitude are in decimal format - they need to be converted to Degrees, Minutes, and Seconds.

There were only a few free domain name providers who offer an API for updating LOC records. I went for deSEC a charity from Berlin. They have comprehensive API documentation.

Adding the initial LOC record is done with:

curl https://desec.io/api/v1/domains/where-is-the-iss.dedyn.io/rrsets/ \
    --header "Authorization: Token _______" \
    --header "Content-Type: application/json" --data @- <<< \
    '{"type": "LOC", "records": ["40 16 25.712 S 29 32 36.243 W 427550m 0.00m 10000m 10m"], "ttl": 900}'

However, updating the record is a little trickier. it needs to be sent as an HTTP PATCH to a subtly different URl. The PATCH only needs to send the data which have changed.

curl -X PATCH https://desec.io/api/v1/domains/where-is-the-iss.dedyn.io/rrsets/@/LOC/ \
    --header "Authorization: Token _______" \
    --header "Content-Type: application/json" --data @- <<< \
    '{"records": ["40 16 25.712 S 29 32 36.243 W 427550m 0.00m 10000m 10m"]}'

I set the Time To Live at 900 seconds. Every 15 minutes my code runs to update the record². That keeps me well within the API limits for both services. I could add TXT records showing when it was last updated, or other sorts of unstructured data, but I think this is enough for a quick proof-of-concept.

There you have it! A complex and silly way to demonstrate how DNS can be used to hold the most unlikely of records³. Say, I wonder how you'd represent the co-ordinates of the Mars Rover…?

http:, ftp:, and ... dict:?

Terence Eden — Wed, 18 Sep 2024 11:34:56 +0000

I went for a spelunk⁰ through an ancient codebase a few weeks ago which contained a curious regex that I just couldn't grok¹.

{<((https?|ftp|dict|tel):[^\'">\s]+)>}i

I'm familiar with HTTP and FTP. I worked in the mobile industry, so knew that tel:+44... could be used to launch a dialer.

But DICT?!?!?!

It turns out that, lurking on the Internet are Dictionary Servers! They exist to allow you to query dictionaries over a network.

For many years, the Internet community has relied on the "webster" protocol for access to natural language definitions. […] In recent years, the number of publicly available webster servers on the Internet has dramatically decreased. Fortunately, several freely-distributable dictionaries and lexicons have recently become available on the Internet. However, these freely-distributable databases are not accessible via a uniform interface, and are not accessible from a single site.

The (informal) standard was published in 1997 but has kept a relatively low profile since then. You can understand why it was invented - in an age of low-size disk drives and expensive software, looking up data over a dedicated protocol seems like a nifty² idea.

Then disk size exploded, databases became cheap, and search engines made it easy to look up words.

How it works

You can try it out today!

Run this command in your terminal:

curl dict://dict.org/d:Internet

That will bring back the definition from the server's default dictionary. If you want to look up a word in a specific dictionary - like The Jargon File - you can run:

curl dict://dict.org/d:Internet:jargon

You can even use it for simple translation tasks. For example, to translate English to Japanese:

curl dict://dict.org/d:Internet:fd-eng-jpn

What Else?

Perhaps the easiest way to explore the protocol and server is to use telnet:

telnet dict.org dict

Type the command HELP and help ye shall receive:

113 help text follows
DEFINE database word         -- look up word in database
MATCH database strategy word -- match word in database using strategy
SHOW DB                      -- list all accessible databases
SHOW DATABASES               -- list all accessible databases
SHOW STRAT                   -- list available matching strategies
SHOW STRATEGIES              -- list available matching strategies
SHOW INFO database           -- provide information about the database
SHOW SERVER                  -- provide site-specific information
OPTION MIME                  -- use MIME headers
CLIENT info                  -- identify client to server
AUTH user string             -- provide authentication information
STATUS                       -- display timing information
HELP                         -- display this help information
QUIT                         -- terminate connection

250 ok

That will allow you to see all the dictionaries available - in a variety of languages - and the various commands you can use with them.

Unanswered Questions

Are there any other Dictionary Servers still available on the Internet?
Did the Webster Protocol get specified outside of obscure source code?
Is there something interesting and modern one could do with a DICT server?

v 1: explore natural caves [syn: {cave}, {spelunk}] ↩︎
(/grok/, /grohk/, vt. 1. To understand. Connotes intimate and exhaustive knowledge. ↩︎
nifty \nifty\ adj. 1. Very good; excellent; -- an informal term meaning about the same as {groovy}, sense 1. [informal, 1960's] ↩︎

.ss TLD opening for direct registrations

Terence Eden — Wed, 31 Jul 2024 11:34:05 +0000

It looks like South Sudan's Top Level Domain is going to start allowing direct registrations!

Long-time readers of this blog will know that it's possible to register .me.ss domain names - there are various other 3rd level domains you can buy.

But, from the 1st of August 2024, you'll be able to apply for a 2nd level. So you'll be able to grab example.ss.

Here's the official announcement.

As per normal for a new TLD, there will be a period where organisations with Trade Marks can register their domains. Then a period where anyone with sufficient cash can register their cool idea for a domain. Then it opens up to everyone.

So what will they cost? Afriregister provided these prices:

Period	Domain	Registration	Renewal
Sunrise (2 years)	.ss	€1020	€110
	.co.ss	€610	€60
Landrush (1 year)	.ss	€300	€110
	.co.ss	€160	€60
Early Access (1 year)	.ss	€220	€110
	.co.ss	€160	€60
General (1 year)	.ss	€110	€110
	.co.ss	€60	€60

For comparison, their .me.ss domains are only €25.

Registrations will only be allowed in ASCII - which means no IDNs. The majority of the languages officially recognised in South Sudan appear to be written in the Latin script, so that shouldn't be a huge issue.

As is common with all other TLDs, there is a list of words which will not be allowed to be registered.

Applications will not be accepted for domain names appearing on the Second Level Domain (SLD) block list.

When I previously investigated this, there were lots of names which weren't available due to local politics. Although there is an archived version of the list of banned words (PDF), the modern SLD Block List appears to have vanished from the registry. I've asked them for an updated list which I'll link to once I get it.

I think it is fair to say that the .ss TLD has had a tumultuous history. There hasn't been much discussion of this change in policy since the announcement a few weeks ago - but I hope that this opening up will help South Sudanese people & businesses to establish their own distinct presence on the Internet.

Universal Basic Website

Terence Eden — Sat, 27 Apr 2024 11:34:29 +0000

Many years ago - when I was very young and you were even younger - it was standard for an ISP to provide all their users with a small amount of webspace. Both Pipex and Demon offered webspace back in 1996. If my hazy memory is correct, they offered a few megabytes - more than enough for a fledgeling website⁰.

But, over the years, ISPs shut down their bundled web offerings. Even their bundled email services went on the chopping block. This is sad, but understandable. Most people unbundled their email so they didn't need to stick with the same ISP. Why have user@isp.example when you could have a GMail address?

And, indeed, why host data with your ISP when you could just use Facebook?

For most people, Facebook is a pretty good personal website. You can post your photos and have your friends & family see them. You can write long heartfelt rants about your teenage melodrama. You can put up the opening times of your new business. You can even host a discussion board around a specific topic.

Now, don't get me wrong, there are a few problems with Facebook¹. All your faves are problematic. But I think it shows that people want the benefits of personal websites, even if they don't want the hassle of running those websites.

What does the world look like if a country offers its citizens a Universal Basic Website? Similar to Universal Basic Income, a no-questions asked entitlement to a chunk of the Web. Perhaps a generic subdomain, some storage space, and an easy to use interface?

Oh, sure, there are lots of technical issues. You'd probably have to make sure people weren't running unapproved scripts. Moderation of prohibited content would be contentious. Tech support would be a nightmare. Some corrupt company would get billions to run a sub-standard service. A failed backup or a hacker would wipe out your bakery's recipes.

But...

We accept that there are common spaces in the real world² where people can have fun without paying. Anyone can go to a park. Anyone can stick a flyer up on a community notice board. We let kids ride the bus for free.

Can we do the same in cyberspace?

You can read some other peoples' thoughts on this Mastodon thread.

With background MIDI music, as was the fashion of the day. ↩︎
This is an understatement. ↩︎
AKA Meatspace. AKA AFK. ↩︎

Virgin Media preparing to offer symmetrical upload speeds?

Terence Eden — Fri, 08 Mar 2024 12:34:09 +0000

Virgin Media - a UK-based fibre-optic ISP - recently sent me a survey about their potential product offerings. It was desperate to know if I wanted bundled streaming video (no), or Sky Sports (LOL no), or any other digital subscriptions (no, go away), or a landline (what, is this the 1990s?). They even wanted to know if I'd pay extra for priority support.

In amongst all the other offers, they asked whether I would be interested in paying more for symmetric Internet speeds!

Here are some of the offerings they proposed. I must not that these are from a market research exercise. Whether they'll ever launch, and whether the prices are accurate, is something we'll have to wait to see.

As I've mentioned before, I like my 500Mbps down - but the 50Mbps upload is a bit of a drag. So I eagerly answered "yes" to anything that looked like faster upload bandwidth.

I've no idea if this will actually materialise. And I can only hope those prices are realistic.

If you're interested in joining Virgin Media, you can get £50 if you join with my link.

False Friends - HTML Elements which are also Top Level Domains

Terence Eden — Mon, 18 Sep 2023 11:34:25 +0000

In linguistics, a "False Friend" is a word which looks similar in multiple languages, but means something different in each of them. For example the word "gift" in English means "a present", in German means "poison", and in Norwegian it means "married".

The Internet uses Top Level Domains (TLD) to organise information into hierarchies. This website uses .mobi - you may also be familiar with .com for commercial entities, or .de for German pages.

The World Wide Web uses HyperText Markup Language (HTML) to structure web pages. For example <footer> to display a footer, or <ol> for an ordered list.

There is absolutely no relationship between the two sets of entities. But, just for fun, are there any HTML elements which happen to be false friends of the TLDs?

Before we go any further, have a quick think. How many do you reckon there are? Are there some which spring to mind immediately?

Obviously, the first port of call is AI. Its mastery of all things means that we can get an accurate answer in a nanosecond.

HTML5 element. .app: This TLD corresponds to the HTML5 element. Please note that this information is based on the state of TLDs as of September 2021. There might have been updates or changes after that date, so it's always a good idea to check official sources or domain registrars for the most current information." width="932" height="473" class="aligncenter size-full wp-image-46824">

Oh.

Right, let's compare the Element Reference with the Root Zone Database.

There are fifteen current HTML elements which have a match with a TLD. And a couple which are deprecated. Here they are:

	HTML	TLD
🔊	`<audio>`	.audio
🇧🇷	`<br>`	.br
🗂	`<data>`	.data
🇭🇷	`<hr>`	.hr
🇱🇮	`<li>`	.li
🔗	`<link>`	.link
🗺	`<map>`	.map
☰	`<menu>`	.menu
🔎	`<search>`	.search
👉	`<select>`	.select
🧥	`<style>`	.style
🇹🇩	`<td>`	.td
🇹🇭	`<th>`	.th
🇹🇷	`<tr>`	.tr
📹	`<video>`	.video

And the ones which are no longer valid HTML:

	HTML	TLD
🖕	`<center>`	.center
🇹🇹	`<tt>`	.tt

Is that more than you expected? Less? Are there others which you think should be TLDs? Should HTML get a <uk> element post-Brexit? Have I missed any?

Comments in the usual box.

Book Review: The Internet Con - How to Seize the Means of Computation by Cory Doctorow ★★★★⯪

Terence Eden — Sun, 17 Sep 2023 11:34:16 +0000

This is beloved firebrand Cory doing what he does best. Rallying the rebellion with righteous indignation and a no-nonsense approach to fixing technology's ills.

If you've read any of his fiction, or listened to him talk, you'll know what to expect. An overview of how big tech has screwed us over and the consequences of those machinations. Unlike other writers, Doctorow provides eminently practical solutions.

Now, some of the solutions you'll be unable to implement unless you're an elected official. So now's a great time to write to your representative and ask them to take action.

He is relentless at pointing out the hypocrisy of big tech - fighting to carve out exceptions for themselves which they then deny to others. We get a full-on historical lesson about the VCR and how the fight for the right to ~~party~~ infringe copyright was won and lost several times.

I spent many years working inside the UK Government pushing the agenda of open standards and interoperability. So it was particularly gratifying to read:

Governments can—and should—have rules about interoperability in their procurement policies. They should require companies hoping to receive public money to supply the schematics, error codes, keys and other technical matter needed to maintain and improve the things they sell and provide to our public institutions.

That's what I did! It is getting better - but it is work that will never be finished.

Similarly, he accurately describes the problems with Standards Development Organisations:

standardization meetings and forensic examinations of firewall errors—is supremely dull. It combines the thrill of bookkeeping with the excitement of Robert’s Rules of Order.

I've been a member of many and - yes - that's exactly what it is like. But, I take slight issue at some of his suggestions on this topic. The ideal SDO has to be a compromise. No one gets to walk away entirely happy. This is the eternal "Devil's Bargain" - we all exchange a little bit of what we want in order to get closer to what we need. I'm not sure there's any way around that without centrally mandating specific technical choices.

Indeed, he goes on to say:

We won’t fix anything by demanding the impossible and shouting “nerd harder!” when tech companies fail to produce it. Nor will we fix anything by taking the tech industry at its word when it tells us that effective policies are flat-out impossible.

I'm a boring practicalist. At some point we need to do what works, even if it is ideologically unpleasant.

One of the things that Cory does well is "steelman" his opponents' arguments. He's excellent at taking on some big topics (CSAM and Blockchain, for example) and giving their proponents the benefit of the doubt⁰. And then he forensically takes them apart.

Cory's writing style is like his spoken style. The poetic rhythm is almost palpable - as is his love for sarcastic asides. It makes this - admittedly short - book supremely quick to read. I feel greedy asking for more - but the book does end rather abruptly.

If you work in tech, or go anywhere near tech-policy, this is a must read. It gives you the history of how we got here, explains the problems happening now, and warns about an uncertain future.

The eBook is currently on sale for £4.50 from the publishers.
You can follow Cory Doctorow on Mastodon @pluralistic

OK, he does say "It’s an established fact that 99.83 percent of all conversations about blockchain are nonconsensual." Which is a bit uncharitable. It's, like, 99.73% max! ↩︎

What will the Web be like in 20 years?

Terence Eden — Sun, 03 Sep 2023 11:34:06 +0000

Way back in 2011, I contributed to an article on The Next Web called "What will the Web be like in 20 years?".

Foolishly, I missed the 10 year anniversary, but let's see how we're doing against those predictions a little over halfway through.

My prediction for the Web?

The same speed. Faster pipes & processors – more bloated markup & JS.

Well... fuck! Bang on the money there. The web is faster than it was on dial-up. But I can't say that it's noticeably better since I got ADSL. Sure, it's faster to download big files and stream 4K video. But for day-to-day browsing? Between the unoptimised "hero" images, multi-megabytes of JS, and thousands of trackers, it sometimes feels like we've taken a step backwards in speed.

We all know that bloat expands to fill available bandwidth. But perhaps we could rein it in a little? Please?

A few of the predictions are already here. Better, smarter phones. Computers becoming pervasive and invisible. And, yes, lots of cat gifs.

Some of the other predictions are - I think it's fair to say - not quite on track.

We haven't returned to an AOL model where AT&T charge us per minute. And I don't see any path to that.

Internet censorship is a tricky one. There are some countries which routinely shut off net access. There's still a cat-and-mouse game with pirates. There are still people crying censorship when their inflammatory posts are removed. But, outside of a few jurisdictions, you remain as free as ever to criticise whoever you want.

Holograms aren't even close to real. And, no, Facebook's laughable attempts at the MeTAvErSe don't count. Perhaps Apple's iBalls (or whatever they're called) will get us to that point before 2031? But I doubt it.

There are a lot of predictions about 3D printers. Look, they're pretty nifty, but it is clear that most homes don't need an endless supply of rapidly printed plastic doodahs.

Finally, there are a couple which I still think are feasible by 2031. Take this one from Santiago Ochoa:

Companies like Google, Facebook, PayPal, Amazon, will create virtual currency systems linked to our social reputation. The more friends, posts, contacts, and comments we have, the more +1s, “like it”s or whatever points we’ll accumulate. These points will then be used to buy real things like you do now with PayPal and Amazon. Good social communicators will be able to make a living out of social networking points. Similar to Second Life but not limited to a virtual world. Our cell phones will be used as wallets and even some salaries will be paid with virtual money.

Social credit scores aren't mainstream… yet. But Twitter is experimenting giving revenue to some posters based on their social reach. Facebook's currency dreams are dead for now, but I bet another social network will try to use virtual money as its hook. Some people are, no doubt, being paid in volatile cryptotokens. And many of us use our phones as tap-to-pay wallets.

There's also this by Pedro Henrique Monteiro Padilha:

Internet will more and more allow people to work to companies on other countries or continents. It will also create a new way for all our social behavior, we will have web shows and maybe web pubs. The large bandwidth will help us connecting everywhere and we will no longer need TV as we know. Every TV show will be a stream to be brought in different languages.

That's pretty much the Covid experience, isn't it? Remote working, Zoom quizzes, livestreaming, and endless Netflix. Perhaps by the end of this decade streaming services won't be geo-restricted and decent subtitles will be available to all?

It's fun to see how accurate people's guesses are. But making predictions is usually less about future gazing and more about understanding our current reality. It isn't about being right or wrong - it's about daring to dream of something brighter than today.

The new .zip TLD is going to cause some problems

Terence Eden — Sat, 13 May 2023 11:34:42 +0000

Many years ago, Google applied for the .zip Top Level Domain. ICANN, in its infinite wisdom, granted it. And now, I think, bad things are going to happen.

You see computers try to be helpful. They see you wrote "visit example.com" and autolink the thing which looks like a domain name. That's handy - especially as most people don't have the time or skill to write HTML.

So what happens when things which are not domain names look like they are domain names? I've been worrying about this for a few years:

Right now there is an old tweet, blog, email, or instant message from an authority figure which points to a non-existent .zip domain.

Is that domain available to buy? Well, let's look at Google's Domain Availability site

(No, I don't know where the missing "T" is either.)

Yup! OK, premium domains like photos.zip appear to be about £1,000 - which should put off some scammers. But the price for non-premium .zips is between £10-£30.

Look, I doubt a former president ever Tweeted "Hey, anyone know how I extract files from something called blah.zip on a Mac?" but I'll bet you that something, somewhere, is going to be abused with this new TLD.

I feel like a curmudgeonly old fart. Don't we have enough TLDs? What's the limit? There are very few meaningful controls on who can register all but the most retrictive TLDs (looking at you, .int!) So at what point do we just give up and same everyone can have their own Top Level?

Anyway, have fun determining if the link you see was ever intended to link to a website!

Some new HTTP verbs

Terence Eden — Tue, 13 Sep 2022 11:34:17 +0000

Hyper-Text Transfer Protocol is, by some measure, the most popular way for computers to talk to each other on the Internet⁰.

Generally speaking¹, clients (like browsers) talk to servers using a set number of HTTP "verbs". This tells the server what sort of thing the client is trying to do.

The two most popular² verbs are probably POST - which lets you send data to a server - and GET - which lets you get data back from a server.

There are other HTTP verbs like DELETE to delete data, and PATCH to change data. But it is a fairly limited set of actions.

What would be some interesting or useful verbs to add to HTTP's vocabulary?

Payments

I think the most obvious one would be BUY.

A client sends a GET request to a server. The server responds with HTTP Status 402 Payment Required which includes payment details. The client sends BUY along with confirmation that they've sent the payment³. The server responds with the content.

Mistakes

What about if you make a mistake using POST, PUT, or DELETE? Wouldn't you like to use HTTP UNDO?

Let's not get in to a discussion about idempotency⁴

Halt And Catch Fire

Some CPUs have peculiar instructions which can be (ab)used to make them self-destruct. So why not extend that to HTTP⸮

<https://twitter.com/whalecoiner/status/1562878271960002560>

Remember that scene in every Star Trek movie where the captain shouts "Computer! Initiate self-destruct sequence. Confirmation code Heliotrope Banana Daguerreotype." Let's extend that so that clients can request that a (virtual?) machine shuts down.

Won't you please please help me?

APIs - and other services - are sometimes difficult to use. In the Linux⁵ world we just type -h or --help after every command and get some more-or-less useful help text.

So what about HTTP HELP? Return a machine- or human-readable document explaining what commands the server responds to. Pretty sure that'd be useful.

Who are you? Who? Who?

Cookies have gotten out of hand. And, frankly, they're a security disaster. Why should a server send a client a token to store? Let's reverse that with HTTP REMEMBER.

The client sends the server a suitably complex string and a validity period. The server is then compelled to remember the client's authorisation. Perfect⁶!

And when you want to log out, an HTTP FORGET is easier than clearing your cookies. Imagine that, a log-out button in your browser which worked everywhere...!

Over to you

So, if you were made God-Emperor-For-Life of the IETF, which new HTTP verbs would you add?

I just made up that "fact". But it feels right, doesn't it? ↩︎
It is a lot more complicated than that. If you want to have a rant about precise definitions, please do so on your own blog. ↩︎
I can't be bothered to actually back this up with statistics. ↩︎
How? I dunno? A signed response from a payment provider? A crypto receipt? Something like that. ↩︎
FINE! Have a discussion about the implications. It bet it won't end in bloodshed. ↩︎
…or as I’ve recently taken to calling it, GNU plus Linux… ↩︎
I'm not sure this makes any more sense than doing it the cookie way. But, hey, that's what brainstorming is for! ↩︎

DNS Esoterica: BIMI - SVG in DNS TXT WTF?!

Terence Eden — Mon, 01 Aug 2022 11:34:24 +0000

You've been on the Internet a long time, right? Of course you know what BIMI is. All the cool kids do. But, for those of you who aren't hip to the jive of the Infobahn...

BIMI (Brand Indicators for Message Identification) is a new standard that can curb the issue of online impersonators. ... BIMI is a new standard that enables you to include your company’s logo alongside the emails you send. That way, your brand stands out among other emails, and your customers are sure that the emails are legitimate.

How To Create a BIMI record

Wow! Much innovation! Such security! There's no way a fraudster could put a bank's logo on their dodgy spam, right?

*sigh*

OK, so in order for this not to be abused, most email providers require brands to pay for an expensive Verified Mark Certificate (VMC) - a digital certificate which says that you are the trademark owner of the logo.

How much does it cost?

US$1,499.00

Per year! No wonder no one is using BIMI.

Then it's just a case of sticking something like this in your DNS TXT records:

v=BIMI1;
l=https://example.com/logo.svg;
a=https://example.com/certificate.pem

That's nice, and all, but I don't think I've ever seen one in the wild. Even the BIMI Group haven't bothered paying for the VMC!

One of the few organisations who have set this up correctly is DigiCert. Because they're one of the orgs you can buy this service from.

dig txt default._bimi.digicert.com will get you:

;; ANSWER SECTION:
default._bimi.digicert.com. 3600 IN TXT 
   "v=BIMI1; 
    l=https://www.digicert.com/resources/DigiCertLogo_WhiteOnBlue.svg; 
    a=https://cacerts.digicert.com/digicert_com_vmc_WhiteOnBlue.pem"

You can read the PEM certificate using: openssl x509 -in digicert_com_vmc_WhiteOnBlue.pem -noout -text

Inside, you'll find this nugget:

data:image/svg+xml;base64,H4sIAAAAAAAACo1XXW/jRhJ8tn8FwzwF4NDzzaFhb3BRckmADRAgwL4eHFoxhePZhqiVN/…

Hmmm… H4sIAAA is the start of a base64 encoded zipped string.

Once decoded and unzipped, we find… the SVG logo!

It's fairly obvious that people want a nice logo next to their email in your inbox. If you're on GMail, you're probably used to seeing your friends faces smiling back at you. But that only works if everyone is on the same email system. So BIMI is a reasonable idea for a cross-provider standard.

Downsides

There are several problems with BIMI.

The first is cost. If it were free then AbsolutelyYourBank@trust_me.biz could use the HSBC logo with impunity. I'm sure an extremely dedicated fraudster could spend the $1.5k and fool DigiCert into certifying their illegitimate use of someone else's logo. But it's unlikely to happen.

There's also a privacy issue. Because the BIMI logos are stored on a website, the website owner could track when they were downloaded and use that to work out who was reading their emails. Thankfully, both GMail and Yahoo proxy the images - so the provider doesn't get any additional analytics benefit.

Support is poor in GMail. Here's an email from LinkedIn: As you can see, the BIMI logo is displayed by the email address - but is absent in the contact view.

Finally, DNS TXT records are limited to 255 bytes of data. That's why logos are restricted to being (fairly short) links.

Is it worth it?

I think the marketplace of ideas has answered this with a fairly resounding "no".

You can track adoption at BIMIBRadar.

It would be great to stick your face, logo, or picture next to every email you send. But the risk from fraudsters is just too high.

The cost of certification is necessary to stop misuse - but that also means that smaller brands and individuals are locked out. Which isn't what we want from an open Internet.

There's no worldwide brand registry which can certify your use of an image. And, even if there were, it would be a huge single-point-of-failure.

The conversation about BIMI chugs on in IETF mailing lists. Do get involved if you think you have something of value to add.

DNS Esoterica - Why you can't dig Switzerland

Terence Eden — Thu, 14 Jul 2022 11:34:18 +0000

As part of my new job, I'm learning a lot more about the mysteries of the Domain Name System than ~~any mortal should know~~ I thought possible.

The humble unix dig command allows you to query all sort of DNS information. For example, to see name server records for the BBC website, you can run:

dig bbc.co.uk NS

Which will get you:

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35614
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 17

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 097db2ee4c92b84982083ecf62b5b5f2007906e616035113 (good)
;; QUESTION SECTION:
;bbc.co.uk.         IN  NS

;; ANSWER SECTION:
bbc.co.uk.      900 IN  NS  ddns1.bbc.com.
bbc.co.uk.      900 IN  NS  dns0.bbc.co.uk.
bbc.co.uk.      900 IN  NS  ddns1.bbc.co.uk.
...

And a whole lot more. But you can go further down the DNS tree. What are the nameservers for .co.uk?

dig co.uk NS

And you'll get your answer. You can go one further and see the nameservers for the Top Level Domain:

dig uk NS

Which replies with:

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54061
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 17

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 880427eda8ff71de2ab4f43862b5b65f95e317d29cc10a8e (good)
;; QUESTION SECTION:
;uk.                IN  NS

;; ANSWER SECTION:
uk.         159692  IN  NS  nsc.nic.uk.
uk.         159692  IN  NS  dns1.nic.uk.
uk.         159692  IN  NS  nsd.nic.uk.
...

And that works with every TLD. Countries like de, generic names like museum, and internationalised domains like 在线. All of them work!

Except Switzerland.

Switzerland's country code is ch - after the name Confoederatio Helvetica. Let's run the dig on it: dig ch NS

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 31910
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

We have been refused and warned. But why does this only happen with Switzerland?

The blame - as with most modern ills - lies in the mid-1970s. The Bee Gees were storming the charts with "Jive Talkin'", the Rocky Horror Picture Show was gathering a cult following, and MIT scientists were causing chaos. Literally.

Chaosnet was an early network protocol designed for local networks. It was technically very clever but, sadly, never really took off.

However, it found its way into DNS records. Let's go back to the answer to dig bbc.co.uk NS:

;; ANSWER SECTION:
bbc.co.uk.      900 IN  NS  ddns1.bbc.com.

OK, the first part is the domain name. The number is the TTL. The IN is the class. The NS says this is a nameserver record. And, finally, we get the domain of the nameserver.

But, in the class, what does IN stand for?

"Internet", obviously. Wait... Isn't the DNS on the Internet? Why do we need to specify that these DNS records are for Internet?

Well, isn't it obvious? Because you might want records of a different network. Like, for example, Chaosnet.

And if Internet is abbreviated to IN, what is Chaosnet shortened to? That's right! CH.

So, dig sees you enter ch for Switzerland, but thinks you're asking about CH for Chaosnet. And so it fails.

In order to query the records for ch we need to provide an absolutely fully-qualified domain name. It's as simple as sticking a dot at the end of the domain name:

dig ch. NS

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64932
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 11

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: e19b9c23cdfa0f7bcf82750462b5c16b47744386c7974ffb (good)
;; QUESTION SECTION:
;ch.                IN  NS

;; ANSWER SECTION:
ch.         164894  IN  NS  e.nic.ch.
ch.         164894  IN  NS  a.nic.ch.
ch.         164894  IN  NS  f.nic.ch.

And there we go. A failed 1970s experiment like bell-bottoms and Betamax videos - but with much longer lasting consequences.

You can see some CH records by running like:

dig ch txt @f.root-servers.net version.bind

That will get you something like:

;; ANSWER SECTION:
version.bind.       86400   CH  TXT "cloudflare-f-root-20190930"

Of course, DNS doesn't only have IN and CH class records.

There's also Hesiod - HS. But you already knew that, right...?

Drones Vs Telegraphs

Terence Eden — Tue, 01 Feb 2022 12:34:18 +0000

There is a thoroughly modern story coming out of Ireland:

Drones are being used routinely around Irish racecourses to take advantage of a short time lag between broadcast footage of events and the action on the ground.

Even this small delay allows gamblers take advantage of changes to so-called “in-running” betting odds, if say a horse begins to struggle, jumps awkwardly, or falls.

The battle above the skies of Irish racecourses: drone operators vs Horse Racing Ireland.

Obviously what those naughty drone operators are doing is despicable. Imagine cheating bookmakers out of their hard-won profits by using technology! Awful!

But it reminded me of an earlier story. Much earlier!

Tom Standage wrote a brilliant book called "The Victorian Internet". It talks about how the invention of the telegraph upended all sorts of social conventions - in much the same way as the popularity of the Web did at the end of the last century.

Provincial bookmakers used to accept bets long after the race was over. They would wait until the information was transmitted to them via telegraph. To prevent regular punters sending the winning horse's name back to their accomplices, the telegraph companies simply banned unauthorised people from transmitting racing results. But there was plenty of cunning to be had…

Here's an excerpt from Tom's book:

One story from the 1840s tells of a man who went into the telegraph office at Shoreditch station in London on the day of the Derby, an annual horse race, and explained that he had left his luggage and a shawl in the care of a friend at another station—the station that just happened to be nearest the racetrack. He sent a perfectly innocent-sounding message asking his friend to send the luggage and the shawl down to London on the next train, and the reply came back: "YOUR LUGGAGE AND TARTAN WILL BE SAFE BY THE NEXT TRAIN." The apparently harmless reference to "TARTAN" revealed the colours of the winning horse and enabled the man to place a bet and make a hefty profit.

You can read more about this in "The London Anecdotes for All Readers" published in 1848.

I wonder what the next innovation will be which exploits information asymmetry?

How many connected devices do you have at home?

Terence Eden — Mon, 21 Dec 2020 12:26:37 +0000

Five years ago, I wrote that I had 30 connected devices at home. How has that changed over the last half-decade?

Some of my devices have consolidated. My Eufy security cameras have a hub - so despite having more cameras, They're using fewer IP addresses. Similarly, I've replaced most of my LIFX bulbs with Zigbee which also use a hub-and-spoke model.

So these are the devices I currently have connected:

Video Doorbell
Solar Battery
LIFX bulb in external light
Security camera
EInk display
Alexa
Robot vacuum cleaner / mop
TV
Android TV box
Amazon Fire TV stick
Chromecast
Internet Connected Record Player (yes! Really!)
PS4
Nintendo Switch
AV Amplifier
Another Alexa
Home server
Eufy Cameras Hub
Philips Hue Light Hub
Internal LIFX bulb
Smart heating control
Office TV
Wife's work laptop
Wife's personal laptop
Wife's phone
My work laptop
My personal laptop
My phone
My tablet
Power strip
Lifx lamp
Internet connected plasma ball
Gym TV
Another robot vacuum cleaner
Internet connected electric blanket (my side)
Internet connected electric blanket (her side)
Solar panel inverter

We have a lot of smarthome kit! I've probably forgotten some. And I haven't counted my various Raspberries Pi and obsolete computers. But we're only a family of two. Larger families are likely to have more phones, tablets, and many other devices.

Is the future the "hub" model? Most of these devices don't need a power-hungry WiFi connection. Keep the airwaves clear for high-bandwidth devices and move everything to ZigBee or similar?

Either way, the number of devices in a typical home is only going to increase. What do we need to do to prepare for that?