The Open Line

The mechanism is older and duller than the story. ENUM is an early-2000s scheme for asking DNS whether a phone number can be reached over the internet instead of the phone network: reverse the digits, tack on .e164.arpa, ask. It never caught on. Her three zones logged 100,170 queries, 99,902, and 9,133, and because the question a switch asks contains the number it’s about to dial, every one of those lookups was a phone number handed to a stranger who paid five euros to be standing there.

The Hacker News thread pulled 688 points and 89 comments, and the sharpest thing in it is a question from somebody who clearly runs systems for a living: “Why is a phone call making a DNS query?” That’s the whole thing. Not a vulnerability, not a breach. A working phone system, doing what it was configured to do in about 2011, asking a question of a machine that no longer belongs to anyone. One commenter pushed back on how firmly the author landed the military-base conclusion, and he’s right that DNS logs prove the lookup, not who picked up. It doesn’t rescue anybody, because the lookup was the leak.

It isn’t a phone problem

Change the layer and the shape holds. In 2024, watchTowr Labs noticed the old WHOIS server for the .mobi top-level domain had moved and the original hostname had lapsed. They registered it for $20. Within days more than 135,000 unique systems were asking it questions: government mail servers across a dozen countries, security vendors, registrars including GoDaddy, and, worst of the set, certificate authorities using WHOIS output to decide who got issued a TLS certificate.

The following year the same team went looking for abandoned S3 buckets that software still tried to download from. They found roughly 150, re-registered them for a little over $400, and took eight million requests in two months: software updates, precompiled binaries, virtual machine images, VPN configuration files. The senders included government agencies, military networks, Fortune 500 companies, payment card networks, banks, and cybersecurity companies. Their own note on it is the important part: this is “prolific and not representative of any one organization’s approach to infrastructure or cyber security in isolation.”

Three different layers of the stack. Same story every time. Something was configured correctly by a competent person. That person moved on. The configuration did not.

Name every number your company dialed this hour

Try it. Not the vendors on the AP ledger, the actual outbound requests: every webhook, every DNS lookup, every callback to an API at a company that’s been acquired twice since, every integration a contractor wired up in a sprint nobody documented, every SIP trunk and every update check. Say who owns the far end of each one, by name, today.

You can’t. Neither can we, without going and looking. That isn’t sloppiness or a maturity score, it’s a property of systems that outlive the people who built them, and every company past its first few years has it.

Call these open lines: a request your systems still place, on a schedule, to something with nobody’s name on it. An open line isn’t broken, which is precisely why it’s still there. Broken things get fixed the same week, because a customer screams. An open line works perfectly, costs nothing, appears on no dashboard and in no budget review, right up until somebody on the other end decides to answer. A five-euro renewal is the entire barrier to entry.

The audit is a photograph of something moving

The reflex here is to commission an inventory. Somebody produces a spreadsheet of every dependency, presents it, and it’s genuinely useful for about a month. Then two engineers ship four integrations, a vendor sunsets an endpoint, and the document becomes a record of what used to be true. We’ve watched companies pay real money for that spreadsheet.

What broke the audit permanently is the thing everyone is celebrating. Standing up a new integration used to cost a week of somebody’s attention, and that cost was the only inventory control anybody had. It was never a good one. It was just slow enough to be countable. Now a developer with an agent adds a connector, a key, and a scheduled job before lunch, and an AI voice assistant bolted onto the phone system reaches four systems the person who bought it has never heard of. What your company opens jumped by an order of magnitude. What a human can enumerate didn’t move at all.

Here’s what the three stories actually have in common, and it isn’t negligence. Every open line is a standing offer, and the market price of accepting it is a domain renewal. Your side of that trade is a real business with a security budget, a compliance posture, and customers. The other side is five euros. AI has made your side of it faster and cheaper and more numerous every single quarter, and has done nothing whatsoever to the other side.

So the discipline has to move to where the line gets opened, the only place left where a human is present. A name, an actual person, on every outbound dependency at the moment it’s created, not a ticket and not a wiki page. Hanging up as the default: anything nobody will put their name to gets switched off, and the alarms that follow tell you what you actually depend on. And somebody’s last two weeks include handing over their open lines, not just their passwords, because the engineer who set up those nameservers over a decade ago almost certainly did a clean job and then simply left.

One more warning from that thread, from an operator who priced the service: ENUM isn’t dead. It moved behind private nameservers and VPNs and became a paid subscription for number-porting data. “We don’t use that protocol anymore” and “our systems stopped asking” are different sentences, and only one of them is checkable.

Stay close enough to see the damage

Our manifesto puts it plainly: stay close to what you own and manage it directly, because the best things are ruined by owners who never see the damage. That reads as advice about equity, and it’s also a literal instruction about infrastructure. The strongest case for genuinely owning your systems rather than renting the operation of them is that renters never go looking for the open lines. Nobody files a ticket about the thing that works.

The engineer who bought that domain for five euros deleted the logs and walked away. That was a choice she made, and nobody dialing those numbers had any say in it. Your company has open lines, same as everyone else’s. The question worth sitting with is who’s holding the other end of them right now, and what it cost them to be there.