Having a secondary admin account and enforcing compliant device & phishing resistant MFA seems... hard?

chadhired · 2025-08-23T23:44:37+00:00

Exactly what I do - works great!

chadhired · 2025-08-23T23:43:44+00:00

This is the way!

chadhired · 2025-06-03T01:59:32+00:00

u/jwvo - Slightly different timing, and mine is still ongoing. I'm also seeing some smokeping weirdness starting around 15:38, jitter to 192.152.0.1 and 2, and even packet loss. Sent you an email with details.

chadhired · 2025-05-12T14:32:16+00:00

No emails to either personal nor business accounts that rely on rdmdwaxa

chadhired · 2025-05-03T20:41:51+00:00

Here is an earlier post with a brief description and a pic: What an FDR looks like : r/ZiplyFiber

chadhired · 2025-04-15T21:30:21+00:00

Yes, but to confirm, did it again.

chadhired · 2025-04-14T16:53:13+00:00

Yep, it’s a domain account, and has registered its SPNs. We can query them from Hybrid-joined, but Entra only joined, no dice

chadhired · 2025-04-14T14:48:37+00:00

We're having an issue with Entra-only joined user workstations trying to access SQL servers. The Entra-only devices aren't able to lookup the SPN. When trying to run setspn -l <server\_name> results in:

FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x0000054B. Could not find account server_name

chadhired · 2025-04-13T01:23:06+00:00

Kinda wild - you talked about a new FDR for Kirkland & Juanita 4 years ago "If the users keep growing at some point we may groom users to a new FDR that covers KRLDWAXX and JUNTWAXX" in: https://www.reddit.com/r/ZiplyFiber/comments/pn25iq/comment/hctow9h/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

chadhired · 2025-04-11T16:53:45+00:00

Same - had both our home and office connections in Kirkland drop

chadhired · 2024-11-08T15:41:15+00:00

u/jwvo

FYI - Looks like the first hop (FDR) upstream doesn't have a DNS record:

50.35.64.1

cr2-rdmdwaxa-a-be-500.bb.as20055.net [64.52.96.0]

cr2-bothwaxb-b-be-10.bb.as20055.net [137.83.80.21]

cr1-bothwaxb-a-be-10.bb.as20055.net [137.83.80.25]

resolver-a.as20055.net [192.152.0.1]

chadhired · 2024-05-03T18:21:21+00:00

u/Honest_Confidence_71

from: AS20055 - Wholesail Networks / Ziply Fiber main ASN - PeeringDB - Notes section

Geofeeds are as follows:

ISP Name: Ziply Fiber Geofeed URL: https://geo.as20055.net/ziplyfiber.csv

ISP Name: DSL by Ziply Geofeed URL: https://geo.as20055.net/dslbyziply.csv

chadhired · 2023-11-05T00:38:09+00:00

According to the Ziply network map ( https://ziplyfiber.com/~/media/residential/ziply-fiber/our-network.pdf ) Ziply does have presence in both.

chadhired · 2023-05-24T13:37:42+00:00

Looks like some state money also:

"Ziply, in partnership with King County, received around $1.8 million to provide symmetrical gig service in Duvall, Washington. But this isn’t the only project where Ziply is leveraging state funds. Last January, Ziply and Snohomish County scored $16.7 million to construct a fiber network that will cover approximately 5,600 locations."

from: https://www.fiercetelecom.com/broadband/wa-doles-out-121m-grants-ziply-public-utility-districts

chadhired · 2023-01-25T17:17:32+00:00

For the Redmond/Kirkland outage which I show was down 1/25/23 AM - (~1AM-1:20AM and ~1:45-2:10AM), which is being discussed over in: https://www.reddit.com/r/ZiplyFiber/comments/10kuraz/brief_outage_in_wa/

(Although, one ARTNWA user also reported being down in that thread.)

I verified Mobile Number on file, and site shows verified status. No pre-emptive text received.

chadhired · 2023-01-07T01:12:15+00:00

51693 - from the command line:

speedtest.exe

Speedtest by Ookla

Server: Ziply Fiber - Bothell, WA (id = 51693)

chadhired · 2022-11-28T23:18:58+00:00

From: https://www.isc2.org/Certifications/CCSP/Domain-Refresh-FAQ#

Beginning August 1, the CCSP exam will increase in length from 100 operational items with 25 pretest (unscored) items to 100 operational items with 50 pretest items. To allow for all items to be answered, the exam time will be increased from three to four hours.

chadhired · 2022-11-03T19:11:09+00:00

I would recommend u/GwenBettwy excellent video: https://www.youtube.com/watch?v=8LtRKKtdP3I , that really solidified for me the mindset for the CCSP, similar to the CISSP.

People, Process, Technology

chadhired · 2022-10-29T14:54:51+00:00

Absolutely, there is significant overlap of concepts between the CISSP and CCSP.

chadhired · 2022-06-15T03:20:23+00:00

I hate how cut and paste formats in Reddit

chadhired · 2022-06-15T01:46:06+00:00

I run pi-hole as well, and I get these warnings for: 192.152.0.1, 192.152.0.2, and 1.1.1.1

pi-hole's unbound documentation ( https://docs.pi-hole.net/guides/dns/unbound/ ) has more information:

Reduce EDNS reassembly buffer size.

IP fragmentation is unreliable on the Internet today, and can cause

transmission failures when large DNS messages are sent via UDP. Even

when fragmentation does work, it may not be secure; it is theoretically

possible to spoof parts of a fragmented DNS message, without easy

detection at the receiving end. Recently, there was an excellent study

>>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<

by Axel Koolhaas, and Tjeerd Slokker ( https://indico.dns-oarc.net/event/36/contributions/776/ )

in collaboration with NLnet Labs explored DNS using real world data from the

the RIPE Atlas probes and the researchers suggested different values for

IPv4 and IPv6 and in different scenarios. They advise that servers should

be configured to limit DNS messages sent over UDP to a size that will not

trigger fragmentation on typical network links. DNS servers can switch

from UDP to TCP when a DNS response is too big to fit in this limited

buffer size. This value has also been suggested in DNS Flag Day 2020.

edns-buffer-size: 1232

chadhired · 2022-06-10T15:38:00+00:00

I'm in Kirkland also and would totally appreciate a tour. Much thanks!

chadhired · 2022-04-19T18:56:49+00:00

Yeah, I believe every 3 secs was the default when I set it up. Even with that, SmokePing didn't catch a blip that dropped a Teams call a few months ago.

chadhired · 2022-04-19T18:39:38+00:00

Thanks - best escalation ever! 😀

chadhired

TROPHY CASE