Amsterdam Zuid Railway Station (Station Amsterdam Zuid)
at Amsterdam Zuid Railway Station (Station Amsterdam Zuid)
Schiphol Airport Railway Station (Station Schiphol Airport)
at Schiphol Airport Railway Station (Station Schiphol Airport)
If you’re a Tailscale user with Eero mesh, you may have noticed nodes on your tailnet constantly losing contact with the Tailscale control plane. I worked with Eero to diagnose and reproduce the issue and they’ve pushed a new firmware version that fixes the problem. You’re welcome ☺️
Today’s #WASSUP tip:
Turn on DNS over HTTPS (DoH) in your Firefox Preferences. Advanced Settings.
Custom: Always use secure DNS with control over your provider and fallback behavior.
[x] Always warn me if secure DNS isn’t available.
There are both security and privacy reasons to use DoH.
Step-by-step instructions:
1. open Firefox Preferences ("Firefox" menu, "Preferences" item)
2. Type “DoH” in the auto-activated search box
3. Scroll down to where it says “DNS over HTTPS” under “Privacy and Security”
4. Click “Advanced Settings”
5. Choose the “(•) Custom” radio button that says “Always use secure DNS with control over your provider and fallback behavior” right under it
6. Check “[x] Always warn me if secure DNS isn’t available.”
Privacy: the domain name of every website you browse is sent to the local router (e.g. WiFi), and on up to whatever internet service provider you’re connected to. Everything along the way has the ability to track what domains / websites you are using, how often, and build a profile accordingly, perhaps even matching it with stored profiles.
The sites you use, how frequently, what time of day, may all be enough information to create a unique fingerprint of you, to uniquely identify you, and perhaps target you.
By using DoH exclusively, every one of those domain names is sent only to your DoH provider (e.g. Cloudflare or NextDNS) blocking your local router, WiFi, and internet service provider from making a list of which websites you visit, or at least making it much harder (and both privacy and security are about making it harder for adversaries). They can still track what IP addresses you access, but that‘s much less information, and much less reliable over time.
Security: if your local router, WiFi, or internet service provider is compromised by an attacker, they can theoretically pretend to be any website you are trying to access (DNS hijacking), and then capture your credential as you login (username, password, even 2FA), and instantly re-use them to pretend to be you (credential stuffing) and sign-in to that website. Once they do that, they usually get a "long-lived" session token (like a session cookie) that they can re-use to pretend to be you, repeatedly, until that session token expires. Some don't expire for months or even years.
For example, if you’re using public WiFi, at a cafe, or a hotel, or airport, you have no idea if their routers or internet service providers are secure, and increasingly, unfortunately, we know that they are often compromised by various network attackers.
We know this is actively happening from both frequent news reports:
* https://news.google.com/search?q=wifi+dns+hijack
And from Anthropic’s report published mere days ago:
* https://www.anthropic.com/threat-intelligence-report-september-2026
* full PDF: https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf
E.g.:
“They used compromised admin credentials to modify DNS records so that they pointed to services owned by the actor (a technique known as DNS hijacking). Guests of hotels using the compromised vendors who connected to the hotel WiFi had their traffic, device identifier and IP address sent to the actor’s servers. At that point, ClickFix-style lures were staged to deliver Windows, Android and iOS malware to the victim’s device. The actor was able to use a combination of guest information stolen from the hotel management systems with the data stolen from individual guests’ devices to focus additional targeting efforts.”
And it only gets worse from there.
When you activate exclusive DoH use, Firefox skips using those local DNS services, and instead directly contacts the DoH provider for DNS queries (to connect to the websites you access).
For more about how DoH works in Firefox, see the FAQs:
* https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs
Glossary:
ClickFix
https://en.wikipedia.org/wiki/ClickFix
Credential stuffing
https://en.wikipedia.org/wiki/Credential_stuffing
DNS hijacking
https://en.wikipedia.org/wiki/DNS_hijacking
DNS over HTTPS (DoH)
https://en.wikipedia.org/wiki/DNS_over_HTTPS
Replay attack
https://en.wikipedia.org/wiki/Replay_attack
This is my seventh #WASSUP2026 post, and fifth useful web tip for September.
✨ Weekly Tipster (https://tantek.com/2026/244/t1/september-blogging-challenge-wassup)
#DoH #DNSoverHTTPS #Firefox #tip #webTip #browserTip #webBrowserTip #security #privacy #cyberSecurity #DNS #DNShijack #DNShijacking #hotelWifi
Turn on DNS over HTTPS (DoH) in your Firefox Preferences. Advanced Settings.
Custom: Always use secure DNS with control over your provider and fallback behavior.
[x] Always warn me if secure DNS isn’t available.
There are both security and privacy reasons to use DoH.
Step-by-step instructions:
1. open Firefox Preferences ("Firefox" menu, "Preferences" item)
2. Type “DoH” in the auto-activated search box
3. Scroll down to where it says “DNS over HTTPS” under “Privacy and Security”
4. Click “Advanced Settings”
5. Choose the “(•) Custom” radio button that says “Always use secure DNS with control over your provider and fallback behavior” right under it
6. Check “[x] Always warn me if secure DNS isn’t available.”
Privacy: the domain name of every website you browse is sent to the local router (e.g. WiFi), and on up to whatever internet service provider you’re connected to. Everything along the way has the ability to track what domains / websites you are using, how often, and build a profile accordingly, perhaps even matching it with stored profiles.
The sites you use, how frequently, what time of day, may all be enough information to create a unique fingerprint of you, to uniquely identify you, and perhaps target you.
By using DoH exclusively, every one of those domain names is sent only to your DoH provider (e.g. Cloudflare or NextDNS) blocking your local router, WiFi, and internet service provider from making a list of which websites you visit, or at least making it much harder (and both privacy and security are about making it harder for adversaries). They can still track what IP addresses you access, but that‘s much less information, and much less reliable over time.
Security: if your local router, WiFi, or internet service provider is compromised by an attacker, they can theoretically pretend to be any website you are trying to access (DNS hijacking), and then capture your credential as you login (username, password, even 2FA), and instantly re-use them to pretend to be you (credential stuffing) and sign-in to that website. Once they do that, they usually get a "long-lived" session token (like a session cookie) that they can re-use to pretend to be you, repeatedly, until that session token expires. Some don't expire for months or even years.
For example, if you’re using public WiFi, at a cafe, or a hotel, or airport, you have no idea if their routers or internet service providers are secure, and increasingly, unfortunately, we know that they are often compromised by various network attackers.
We know this is actively happening from both frequent news reports:
* https://news.google.com/search?q=wifi+dns+hijack
And from Anthropic’s report published mere days ago:
* https://www.anthropic.com/threat-intelligence-report-september-2026
* full PDF: https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf
E.g.:
“They used compromised admin credentials to modify DNS records so that they pointed to services owned by the actor (a technique known as DNS hijacking). Guests of hotels using the compromised vendors who connected to the hotel WiFi had their traffic, device identifier and IP address sent to the actor’s servers. At that point, ClickFix-style lures were staged to deliver Windows, Android and iOS malware to the victim’s device. The actor was able to use a combination of guest information stolen from the hotel management systems with the data stolen from individual guests’ devices to focus additional targeting efforts.”
And it only gets worse from there.
When you activate exclusive DoH use, Firefox skips using those local DNS services, and instead directly contacts the DoH provider for DNS queries (to connect to the websites you access).
For more about how DoH works in Firefox, see the FAQs:
* https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs
Glossary:
ClickFix
https://en.wikipedia.org/wiki/ClickFix
Credential stuffing
https://en.wikipedia.org/wiki/Credential_stuffing
DNS hijacking
https://en.wikipedia.org/wiki/DNS_hijacking
DNS over HTTPS (DoH)
https://en.wikipedia.org/wiki/DNS_over_HTTPS
Replay attack
https://en.wikipedia.org/wiki/Replay_attack
This is my seventh #WASSUP2026 post, and fifth useful web tip for September.
✨ Weekly Tipster (https://tantek.com/2026/244/t1/september-blogging-challenge-wassup)
#DoH #DNSoverHTTPS #Firefox #tip #webTip #browserTip #webBrowserTip #security #privacy #cyberSecurity #DNS #DNShijack #DNShijacking #hotelWifi
Happy #8bitday!
And happy Progammer’s Day! (https://en.wikipedia.org/wiki/Programmer%27s_Day) — one of the rare annual ordinal date observations, based on the day of the year, rather than day of a specific month of the year.
Piano Day is another, celebrated on the 88th day of the year:
* https://en.wikipedia.org/wiki/Piano_Day
* https://tantek.com/2024/088/t1/world-piano-day-ordinal-date-iso-8601
Do you know of any other annual ordinal date observances?
Besides New Year’s Day of course.
Previously, previously:
* https://tantek.com/2025/257/t1/happy-8bitday-255-bytes-max
* https://tantek.com/2024/256/t1/happy-8bitday-binary-byte (more previous posts there)
#ProgrammersDay #ordinalDate #dayOfTheYear #ordinalDateObservance #annualObservance #annualEvent
And happy Progammer’s Day! (https://en.wikipedia.org/wiki/Programmer%27s_Day) — one of the rare annual ordinal date observations, based on the day of the year, rather than day of a specific month of the year.
Piano Day is another, celebrated on the 88th day of the year:
* https://en.wikipedia.org/wiki/Piano_Day
* https://tantek.com/2024/088/t1/world-piano-day-ordinal-date-iso-8601
Do you know of any other annual ordinal date observances?
Besides New Year’s Day of course.
Previously, previously:
* https://tantek.com/2025/257/t1/happy-8bitday-255-bytes-max
* https://tantek.com/2024/256/t1/happy-8bitday-binary-byte (more previous posts there)
#ProgrammersDay #ordinalDate #dayOfTheYear #ordinalDateObservance #annualObservance #annualEvent
If you've been using my https://webmention.io service, you'll notice a few changes today.
Everything should be transparent from a user and API perspective, all your webmention endpoints and API queries should still be working. Please let me know if you run in to any problems!
I replaced the aging Ruby codebase so that I can more easily fix bugs and make it more secure going forward. Stay tuned for some much-needed UX improvements in the near future as well.
Everything should be transparent from a user and API perspective, all your webmention endpoints and API queries should still be working. Please let me know if you run in to any problems!
I replaced the aging Ruby codebase so that I can more easily fix bugs and make it more secure going forward. Stay tuned for some much-needed UX improvements in the near future as well.
LOL OSU*
Man, I’ve missed college football. Two top ten teams knocked off by unranked opponents, one of which had a double digit losing streak.
Phrase of the year: "emotional support typewriter"!
h/t Elisa Cristina Makoon-Singh
Yeesh, Miami’s WR room is deeeeeep. True freshman Vance Spafford with an absolutely absurd TD catch while getting mugged by two defenders. Guy is probably 8th on the depth chart.
I pay ESPN for their streaming service. Just now getting a chance to watch the Miami game and am trying to catch up, but they have unskippable 3 minute ad breaks at every single opportunity. Such bullshit. I think I’m just going to cancel and stream from sketchy sources instead.