a blog

As an opportunity to rewire my brain from "docker" to "podman" and "buildah" I started to create an image build with an ECH enabled curl at https://gitlab.com/hoexter/ech. Not sure if it helps anyone, but setup should be like this: git clone https://gitlab.com/hoexter-experiments/ech cd ech buildah build --layers -f Dockerfile -t echtest podman run -ti echtest /usr/local/bin/curl \ --ech true --doh-url https://one.one.one.one/dns-query \ https://crypto.cloudflare.com/cdn-cgi/trace.cgi f...

Now that ECH is standardized I started to look into it to understand what's coming. While generally desirable to not leak the SNI information, I'm not sure if it will ever make it to the masses of (web)servers outside of big CDNs. Beside of the extension of the TLS protocol to have an inner and outer ClientHello, you also need (frequent) updates to your HTTPS/SVCB DNS records. The idea is to rotate the key quickly, the OpenSSL APIs document talks about hourly rotation. Which means you've to…

If you want the latest pflogsumm release form unstable on your Debian trixie/stable mailserver you've to rely on pining (Hint for the future: Starting with apt 3.1 there is a new Include and Exclude option for your sources.list). For trixie you've to use e.g.: $ cat /etc/apt/sources.list.d/unstable.sources Types: deb URIs: http://deb.debian.org/debian Suites: unstable Components: main #This will work with apt 3.1 or later: #Include: pflogsumm Signed-By:…