Nostr notes by NLnet Labs

Another Unbound security release is now available, addressing a ...

2026-07-22T14:40:12+02:00

Another Unbound security release is now available, addressing a large set of multi-vendor vulnerabilities. In total, Unbound 1.25.2 fixes 24 CVEs.

Many thanks to the security researchers who responsibly reported these issues.

Release details: https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430

#DNS #DNSSEC #Security

We're huge fans of Rust, and it's been helping us build ...

2026-07-14T10:51:18+02:00

We're huge fans of Rust, and it's been helping us build mission-critical software for the last six years. We love the community and we try to give back where we can. Starting next week, we're giving back in a new way: in collaboration with RustNL (npub19jl…066u), we're giving our optimization-obsessed arya dradjica (npub1ppe…swq8) one day a week to speed up the Rust compiler. We're so excited to see what she can do!

#rustlang

https://blog.nlnetlabs.nl/giving-back-to-rust/

We have been working incredibly hard on patching all of the ...

2026-06-30T13:41:16+02:00

We have been working incredibly hard on patching all of the LLM-assisted security reports for our authoritative #DNS server NSD.

Today, we're happy to launch the NSD 4.15.0rc1 pre-release so you can test the 20+ fixes that are included. This release also improves the Prometheus metrics, as a nice bonus.

https://community.nlnetlabs.nl/t/nsd-4-15-0rc1-pre-release/3421

Several people have asked if they can use (parts of) our new LLM ...

2026-06-30T09:10:09+02:00

Several people have asked if they can use (parts of) our new LLM policy. Because we're all about sharing, the text is now licensed under Creative Commons BY 4.0.

https://nlnetlabs.nl/llm-policy/

What we do ship this Friday, is a published policy on LLM use in ...

2026-06-26T15:42:30+02:00

What we do ship this Friday, is a published policy on LLM use in the open source projects we maintain. We hope it’ll help potential contributors assess how to spend their time and ours in the most productive way. https://nlnetlabs.nl/llm-policy/

To his complete surprise, our colleague Jaap Akkerhuis was ...

2026-04-24T11:45:11+02:00

To his complete surprise, our colleague Jaap Akkerhuis was awarded Knight of the Order of the Dutch Lion earlier today for Exceptional Contribution to Society. Akkerhuis is a Dutch Internet pioneer, protocol designer and expert on the internet's naming system.

More at https://blog.nlnetlabs.nl/dutch-internet-pioneer-jaap-akkerhuis-knighted-for-exceptional-contribution-to-society/ #internet #dns

RE: https://fosstodon.org/@iscdotorg/116416426577631380 In case ...

2026-04-17T07:48:06+02:00

RE: https://fosstodon.org/@iscdotorg/116416426577631380

In case you’re wondering: while not as extreme as illustrated by ISC (we don’t offer a bug bounty program), NLnet Labs suffers from a similar situation, in particular for Unbound.

Handling vulnerability reports, both valid ones and false positives, has now become a full time job for the entire Unbound team.

You can argue that it ultimately makes our resolver more secure, it also means we cannot work on building and releasing new features, like:

https://github.com/NLnetLabs/unbound/pulls/wcawijngaards

#DNS #OpenSource #AI

quoting
note1x4m…cyz6

I just posted a blog, it is 100% nicer and more restrained than our development team would have posted. Read between the lines, people.... ;-)

https://www.isc.org/blogs/2026-04-16-How-to-report-a-vulnerability/

Back in May 2019, we said goodbye to SVN and Bugzilla and ...

2026-03-10T16:38:51+01:00

Back in May 2019, we said goodbye to SVN and Bugzilla and migrated to Git and GitHub [1]. Since then, we accumulated 188 repositories. 🙀

We're now making a list to decide which ones we're moving to Codeberg (npub1fh7…ee83) and which are going to be archived and left behind.

While we're doing that, we signed NLnet Labs up as a Codeberg e.V. member!

[1] https://lists.nlnetlabs.nl/pipermail/unbound-users/2019-April/006130.html

#OpenSource #FOSS #DigitalSovereignty #DNS #BGP

🕵️‍♀️ In our recursive resolver Unbound, many of you ...

2026-01-29T09:18:55+01:00

🕵️‍♀️ In our recursive resolver Unbound, many of you depend on Response Policy Zones (RPZ), allowing you to customize #DNS responses to for example block malicious domains or phishing sites.

⚡️ With very large RPZ zones, this could be slow. So solve this, we have brought our SIMD capable zone file parser for NSD to Unbound. This is now ready for review.

https://github.com/NLnetLabs/unbound/pull/1397
https://github.com/NLnetLabs/unbound/pull/1399

🧡 Funding for the development of this functionality is organised by sunet (npub1jxp…glgf) and provided by GÉANT (npub1j23…a0nv).

In our journey to #DigitalSovereignty, here's where we are: - ...

2026-01-27T14:38:01+01:00

In our journey to #DigitalSovereignty, here's where we are:

- Domain registration: TransIP and Prolocation 🇳🇱
- Email, calendar, collaborative writing, and more: mailbox.org 🇩🇪
- Document store: Tresorit 🇨🇭
- Critical infra hosting: Hetzner 🇩🇪
- Discourse hosting: Communiteq 🇳🇱
- Security: 1Password.eu 🇨🇦/🇪🇺 and Yubico 🇸🇪

Next up: GitHub —> Codeberg 🇩🇪

To-do: Slack —> Zulip, Matrix, Mattermost?

#OpenSource #DNS #BGP

#Debian question: Looks like the Debian kernel does not have the ...

2026-01-14T14:26:54+01:00

#Debian question: Looks like the Debian kernel does not have the CONFIG_TCP_AO setting enabled by default.

How would one go about asking to maybe get that enabled?

Thanks to @npub1q39…mc8z we now have documentation for Cascade ...

2025-11-24T08:46:36+01:00

Thanks to JP Mens (npub1q39…mc8z) we now have documentation for Cascade describing how to integrate with a Nitrokey NetHSM to store your DNSSEC keys.

Thanks a lot! 🧡

#DNS #DNSSEC #HSM #OpenSource

https://cascade.docs.nlnetlabs.nl/en/latest/nethsm.html

Tomorrow we drop details on the DNSSEC signer we built. Today, ...

2025-09-09T08:07:44+02:00

Tomorrow we drop details on the DNSSEC signer we built.
Today, we're dropping the pretence.

Before we wrote a line of code, we asked 16 TLDs:
"What keeps you up at night?"

We expected shop talk.
We got meaningful discussions that taught us DNSSEC in 2025 isn’t just a tech issue.
It’s a control issue.
And the fear of losing it is real.

👉 Read the full report: https://blog.nlnetlabs.nl/dnssec-operations-in-2026-what-keeps-16-tlds-up-at-night/

#DNS #DNSSEC #infosec #TLD #devops #OpenSource

A shift begins. Before writing a line of code for our new ...

2025-09-04T08:17:31+02:00

A shift begins.

Before writing a line of code for our new #OpenSource toolset, we asked sixteen TLD operators a simple question:

What keeps you up at night?

We expected answers about tooling.
Instead, we heard about trust, continuity, and compliance.

That changed everything.

🗓️ Report drops Tuesday.
From Tuesday on, we’ll show what #DNSSEC resilience looks like.

We’re very excited.
And you’re all invited.

#DNS #Resilience #TLD

We're looking for a creative web developer who is all in on ...

2025-06-23T07:53:39+02:00

We're looking for a creative web developer who is all in on #OpenSource!

We plan to build a website using an open source static site generator (your choice, as long as it sings), and need a #freelancer to help us bring our new brand identity and content to life across every screen.

Clean code, fast load times, beautiful design — that’s the goal.

Interested? Reach out for the details. Sharing is caring. 💚

This year, NLnet Labs celebrates twenty-five years as an ...

2025-06-16T17:47:10+02:00

This year, NLnet Labs celebrates twenty-five years as an independent, non-profit foundation working on #opensource and #openstandards.
Our mission remains to make the core of the Internet a better, safer place by developing open-source software, through applied research and by promoting and contributing to open standards.