I run a DNS company (some of you can probably guess which one), and a few weeks ago one of my nephews was showing me his home setup and asking about local tunnels.
He already knew about Cloudflare Tunnels. I mentioned ngrok, localtunnel, etc., and then I started thinking about what a super-lightweight tunneling client might look like if it were optimized for clawbots, MCP servers, dashboards, and random services people are increasingly running on home networks and minis.
And then I remembered I owned the tunnel.to domain name.
At that point the idea kind of lodged in my brain and refused to leave until I built the thing.
Current state:
- lightweight relay-based tunnel service
- CLI-first
- public relay nodes in North America + Europe
- TLS
- no account required for basic usage
- intended to be dead simple to expose localhost services
Right now it’s centralized. Early days, but it's entirely doable to add:
- self-hosted relays
- private relays
- agent-oriented workflows
- lightweight auth/access controls
- better relay selection/failover
Given my background I'm also in a good position to preempt abuse, so it doesn't become a timesuck. The no-registration level assigns sub-hostnames so people can't set up obvious phishing sites.
(And yes, I told my nephew about it after it was finished. He said “cool”. Hasn’t used it yet.)
One thing I didn't realize until after this was posted was that the wiretaps ISPs will be ordered to perform under C-2 are warrantless. Just ministry orders.
The Gell-Mann Amnesia is strong in this story and thead.
As I posted on Krebs' article:
This is neither news nor new. There have been prior panics around this “water is wet” type issue going back at least a decade.
(Search up “Floating Domains – Taking Over 20K DigitalOcean Domains via a Lax Domain Import System” – and others).
I also wrote about this on CircleID from the DNS operator’s perspective (“Nameserver Operators Need the Ability to “Disavow” Domains”) – after this same issue was used to DDoS attack another DNS provider by delegating a domain to their DNS servers without having setup an account there, and then doing a DNS reflection attack on that domain. That was over ten years ago.
The fact that people can delegate their own domains to somebody else’s nameservers without ever properly setting up a zone on those nameservers, or ever keeping track of where THEIR OWN DOMAINS point is 100% the responsibility of the domain owner – and to varying degrees a function of their REGISTRAR – who is the only entity that has any control over it.
It’s a weird flex for corporate registrars who purport to be “high touch” and exclusive, to simply shrug their shoulders and turn a blind eye to their own clients’ obviously broken and vulnerable nameserver delegations.
For our part this is specifically one of things we actively monitor and alert our clients about.
Default behaviour in a registrar transfer is to leave the nameservers as is - the rar has to explicitly send a new ns set in the transfer call to effect a change.
Are you positive you didn't accidentally tick a checkbox or anything to use their nameservers?
I've been monitoring this with an eye toward creating a honeypot for DMARC abuse but so far been seeing zero messages come in.
Either the spammers haven't figured it out yet, or they realize it's a waste of time since all the messages are either mechanically processed or ignored.
I was a huge HHGTTG fan (counting Disaster Area among my top musical influences)
When I was at UWO in the early 90's Douglas Adams came on campus for a book signing - it was to last about 45 minutes, and it was scheduled right in the middle of one of my exams.
So I decided to sit the exam, thinking "I'll catch up with him at a future book signing", alas he died before I ever got the chance.
Wikileaks had their DNS cut off by Dynect - who lied about it being because of a non-existent DoS attack, when in reality they were getting their nuts squeezed by the State Department to deplatform them.
These ones are handy:
1. What is my public IP
2. What is my DNS resolver (handy)
3. Is this a homoglyph (have your openclaw check this before blindly following a link)
4. SPF Flattener
5. DNS Twister
More to come.