Security on ma.ttias.be

The ghost domain problem in DNS, and what we're doing about it

mattias@ma.ttias.be (Mattias Geniar) — Sat, 06 Jun 2026 10:00:00 +0000

I wrote a piece over on the Oh Dear blog about a failure mode that most uptime monitoring gets wrong: a domain gets pulled from its registry’s zone, but its authoritative nameservers keep answering, and cached resolvers happily serve the stale delegation for days. Your monitoring says green. The domain is gone.

Running HTTP/3 with Caddy in 2026: it just works

mattias@ma.ttias.be (Mattias Geniar) — Thu, 04 Jun 2026 00:00:00 +0000

When I wrote about running HTTP/3 with Caddy in 2020 , it was a ritual. You opted in with an experimental_http3 global option, the protocol was still draft h3-27, and to test it you needed a custom-compiled curl and a browser nightly with the right flags flipped. It worked, but it was clearly the bleeding edge.

QUIC and HTTP/3 in 2026: from Google experiment to IETF standard

mattias@ma.ttias.be (Mattias Geniar) — Wed, 03 Jun 2026 00:00:00 +0000

Ten years ago I wrote about Google’s QUIC protocol , back when it was an experiment you could realistically only test against Google’s own servers. I was excited about it, and I ended that post hoping the spec would get standardised and show up in other browsers and servers.

Caching get_certificate lookups in Caddy

mattias@ma.ttias.be (Mattias Geniar) — Tue, 02 Jun 2026 00:00:00 +0000

At Oh Dear , our status pages can run on a customer’s own domain, and we’ve always served on-demand ACME certificates for them: someone points their domain at us, and Caddy provisions a Let’s Encrypt certificate for it automatically. We’re now adding a second option, letting customers bring their own certificate. For that, Caddy doesn’t provision anything; it fetches the certificate from an HTTP backend in our app.

Could not find directory of OpenSSL installation

mattias@ma.ttias.be (Mattias Geniar) — Mon, 23 Nov 2020 00:00:00 +0000

Ran into this error when compiling some software from source:

Could not find directory of OpenSSL installation, and this `-sys` crate cannot
proceed without this knowledge. If OpenSSL is installed and this crate had
trouble finding it, you can set the `OPENSSL_DIR` environment variable for the
compilation process.

The fix is, luckily, rather easy.

OpenSSL pkg-config not found

mattias@ma.ttias.be (Mattias Geniar) — Mon, 23 Nov 2020 00:00:00 +0000

I found this error message when compiling some software from source:

It looks like you're compiling on Linux and also targeting Linux. Currently this
requires the `pkg-config` utility to find OpenSSL but unfortunately `pkg-config`
could not be found. If you have OpenSSL installed you can likely fix this by
installing `pkg-config`.

Luckily, it’s an easy fix!

What else can you stuff in a certificate chain?

mattias@ma.ttias.be (Mattias Geniar) — Mon, 25 May 2020 00:00:00 +0000

I recently learned that quite a few (old) root certificates are going to expire, and many websites still send those along in the TLS handshake .

Creating a 2-of-3 multisig with raw transactions on EOSIO

mattias@ma.ttias.be (Mattias Geniar) — Tue, 05 May 2020 00:00:00 +0000

These instructions can be followed to create a 2-out-of-3 multisignature address on the EOS blockchain (or any derivative thereof). This means you will need at least 2 out of the 3 keyholders to sign off on a transaction before any funds can be spent.

Someone, somewhere, is trying to break into your app

mattias@ma.ttias.be (Mattias Geniar) — Tue, 21 Apr 2020 00:00:00 +0000

It’s good to be reminded of the fact that the internet is, in fact, a pretty hostile place.

How to run HTTP/3 with Caddy 2

mattias@ma.ttias.be (Mattias Geniar) — Fri, 10 Apr 2020 06:30:00 +0100

I just migrated this webserver to Caddy 2 and with it, enabled HTTP/3 support. This post will give a short explanation how you can do that.

Migrating to Caddy 2

mattias@ma.ttias.be (Mattias Geniar) — Fri, 10 Apr 2020 06:00:00 +0100

Last week, the first Release Candidate of Caddy 2 saw the light of day. I don’t usually like to run production environments on beta software, but for Caddy I wanted to make an exception

How to prevent content-spoofing in Apache's 404 error pages

mattias@ma.ttias.be (Mattias Geniar) — Wed, 20 Nov 2019 00:00:00 +0000

We had an interesting security report for our Oh Dear monitoring service . An attacker could load a specific URL and trigger a 404 page in which they controlled the output.

Disable HTTP sessions in Laravel to speed up your API

mattias@ma.ttias.be (Mattias Geniar) — Fri, 08 Nov 2019 00:00:00 +0000

If you run a Laravel application purely as a headless API, you can benefit from disabling the HTTP sessions.

strace: operation not permitted, ptrace_scope incorrect

mattias@ma.ttias.be (Mattias Geniar) — Tue, 22 Oct 2019 15:54:37 +0000

When using strace on a server, you might get this error message when you try to attach to a running process.

Chrome’s next steps for security: mixed content checking more important than ever

mattias@ma.ttias.be (Mattias Geniar) — Wed, 09 Oct 2019 08:59:27 +0000

The team at Chrome has announced their plans for handling mixed content last week on their blog.

How we used Caddy and Laravel’s subdomain routing to serve our status pages

mattias@ma.ttias.be (Mattias Geniar) — Thu, 19 Sep 2019 10:04:17 +0000

We recently launched our new Status Page feature. Under the hood, it’s using the Caddy proxy server and Laravel’s subdomain routing to serve the right status page on the right domain.

There’s more than one way to write an IP address

mattias@ma.ttias.be (Mattias Geniar) — Tue, 09 Jul 2019 11:31:32 +0000

Most of us write our IP addresses the way we’ve been taught, a long time ago: 127.0.0.1, 10.0.2.1, … but that gets boring after a while, doesn’t it?

Enable the RPC JSON API with password authentication in Bitcoin Core

mattias@ma.ttias.be (Mattias Geniar) — Sat, 04 May 2019 20:09:26 +0000

The bitcoin daemon has a very useful & easy-to-use HTTP API built-in, that allows you to talk to it like a simple webserver and get JSON responses back.

Requesting certificates with Let’s Encrypt’s official certbot client

mattias@ma.ttias.be (Mattias Geniar) — Mon, 22 Apr 2019 13:18:41 +0000

There’s plenty of guides on this already, but I recently used Let’s Encrypt certbot client again manually (instead of through already automated systems) and figured I’d write up the commands for myself. Just in case.

The end of Extended Validation certificates

mattias@ma.ttias.be (Mattias Geniar) — Wed, 03 Apr 2019 07:40:18 +0000

You know those certificates you paid 5x more for than a normal one? The ones that are supposed to give you a green address bar with your company name imprinted on it?

Remote Code Execution in apt/apt-get

mattias@ma.ttias.be (Mattias Geniar) — Wed, 23 Jan 2019 10:59:22 +0000

A very clever exploit was found in apt.

tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine installing any package. The bug has been fixed in the latest versions of apt. If you’re worried about being exploited during the update process, you can protect yourself by disabling HTTP redirects while you update.

The convincing Bitcoin scam e-mail extorting you

mattias@ma.ttias.be (Mattias Geniar) — Wed, 17 Oct 2018 12:51:02 +0000

A few months ago I received an e-mail that got me worried for a few seconds. It looked like this, and chances are you’ve seen it too.

Find the public key belonging to a private key

mattias@ma.ttias.be (Mattias Geniar) — Tue, 02 Oct 2018 13:33:52 +0000

Here’s how you can show the public key part if you have the private key.

ssh error: unable to negotiate with IP: no matching cipher found

mattias@ma.ttias.be (Mattias Geniar) — Mon, 24 Sep 2018 19:03:31 +0000

I have a pretty old Synology NAS at home that I use for some basic file storage. I also abuse it as a cron-server, doing some simple rsync’s from remote systems. When I last tried to SSH into it, I was greeted with this error.

Remote Desktop error: CredSSP encryption oracle remediation

mattias@ma.ttias.be (Mattias Geniar) — Mon, 14 May 2018 08:21:29 +0000

A while back, Microsoft announced it would ship updates to both its RDP client & server components to resolve a critical security vulnerability. That rollout is now happening and many clients have received auto-updates for their client.