Package: syncthing Version: 1.29.5~ds1-2 Severity: minor Dear Maintainer,
The old primary STUN server, stun.syncthing.net, has been discontinued and removed from more recent syncthing versions (upstream commit e5b72da60742a65423e52e8ffd0166c9ed6f2c48). However, for some reason, the DNS name still resolves to 192.0.2.42 (an RFC1918 private address). This triggers a flood of warnings such as “possible DNS-rebind attack detected: stun.syncthing.net” in dnsmasq on, for example, OpenWRT routers, and likely something similar on other routers and firewalls. Please consider dropping stun.syncthing.net from the Debian version. Henrik -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.101+deb13-amd64 (SMP w/2 CPU threads; PREEMPT) Kernel taint flags: TAINT_WARN, TAINT_CRAP Locale: LANG=fi_FI.UTF-8, LC_CTYPE=fi_FI.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: SELinux: enabled - Mode: Permissive - Policy name: default Versions of packages syncthing depends on: ii init-system-helpers 1.69~deb13u1 ii libc6 2.41-12+deb13u3 Versions of packages syncthing recommends: ii xdg-utils 1.2.1-2 syncthing suggests no packages. -- no debconf information
