Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Local development with .local domains and HTTPS

localcan.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: Show HN: Local development with .local domains and HTTPS

#81

Post by 8organicbits »

Great work! Public CAs have done a wonderful job making HTTPS easy for public websites, but private networks feel under-supported and we're often stuck with legacy tools. I'm really happy to see people building here.

I've been working on getlocalcert[1] which explores this problem from the other end; how can we make TLS certificate management and trust root distribution easier? There's lots of interest in using certificates issued by public CAs for private domains. Especially the free ones from Let's Encrypt. This completely avoids trust root distribution challenges and concerns about trust roots being used to MITM traffic. My local DNS management story is admittedly currently a hand-wave[2], but I really like your approach. I was hoping we could pair our tools, but I think mDNS is for .local only, so we won't be compatible.

I'm curious about the trust root you're using. Lots of tools will create these without any nameConstraints, which is reasonable as client-side support has historically been poor[3], but restricting the root and any intermediaries to *.local can reduce the risk that a stolen trust root is used to MITM unrelated sites like google.com.

[1] https://www.getlocalcert.net/

[2] https://docs.getlocalcert.net/dns/

[3] https://alexsci.com/blog/name-non-constraint/

Re: Show HN: Local development with .local domains and HTTPS

#82

Post by j1elo »

rascul wrote: post #33
j1elo wrote: post #28

Earlier quoted context omitted.

Do you mean that this issue report can now be considered as resolved? https://issuetracker.google.com/issues/140786115 I'd love to update my notes if that's the case.

I don't know anything more than the docs I linked to.

Ok checked some info and, in summary:

Your linked article (the official source from Google) states "November 2021" [1], which by date would correspond to API Level 32 aka. Android 12.1.

Android 12.0 might also have the feature backported on some devices, according to some reports such as seen in the issue report for the feature [2].

Finally, the feature has apparently not been backported to Android 10 or 11, according to a blog post I found about this topic [3].

[1]: https://source.android.com/docs/core/ota/modular-system/dns-...

[2]: https://issuetracker.google.com/issues/140786115

[3]: https://www.esper.io/blog/android-dessert-bites-26-mdns-loca...

Re: Show HN: Local development with .local domains and HTTPS

#83

Post by harrygeez »

rcarmo wrote: post #23
redder23 wrote: post #13

I feels this is something that should NOT be a payable service at all. I am sure its not rocket science, not even Linux support? Probably some open source tools for this to set it up your self for free.

The mDNS broadcast thing is pretty easy, I've used pybonjour for that for a while. The SSL part, well, it's a bigger hassle.

Bigger yes but valuable knowledge for anyone. The good thing is once you understand it only takes little effort to repeat it.

Re: Show HN: Local development with .local domains and HTTPS

#84

Post by 8organicbits »

8organicbits wrote: post #81

Great work! Public CAs have done a wonderful job making HTTPS easy for public websites, but private networks feel under-supported and we're often stuck with legacy tools. I'm really happy to see people building here. I've been working on getlocalcert[1] which explores this problem from the other end; how can we make TLS certificate management and trust root distribution easier? There's lots of interest in using certi…

Hmm, I may need to look at this some more. Avahi supports[1] changing the default domain, so I think you could in principal use mDNS for domains other than .local. But that's a config change, so it wouldn't have that out-of-the-box zero-config benefit.

[1] https://linux.die.net/man/5/avahi-daemon.conf

Re: Show HN: Local development with .local domains and HTTPS

#85

Post by jareklupinski »

had a mini-heart attack reading the intro; we don't see enough of each others' names on here :)

been waiting for something like this to come along: when i set up microcontrollers that expose a mini-server, i would like to use the Geolocation API built into mobile browsers so users can tell the gadget where it is, but they block access to the API unless your site starts with 'https://' ( a silly barrier but whatever )

Re: Show HN: Local development with .local domains and HTTPS

#86

Post by manuelmoreale »

lapcat wrote: post #46

This submission violates the HN guidelines: "Please don't use HN primarily for promotion. It's ok to post your own stuff part of the time, but the primary use of the site should be for curiosity." https://news.ycombinator.com/newsguidelines.html The https://news.ycombinator.com/user?id=jarekceborski account was created 1 day ago, the only submission is this one https://news.ycombinator.com/user?id=jarekceborski and t…

Not entirely sure why you're getting downvoted. One might disagree with the guidelines but since they clearly say that it's ok to post your work "part of the time", an account created only to post personal content is clrealy going against the spirit of the guidelines.

Do I personally care? No. Am I bothered by the submission? Also no.

Still, downvoting you doesn't seem all that fair since you do raise a valid point.

Re: Show HN: Local development with .local domains and HTTPS

#87

Post by louzell »

EspressoGPT wrote: post #34
raincole wrote: post #27

Earlier quoted context omitted.

When I read this comment I knew it must be targeting MacOS users. The only reason I clicked the link is to confirm my assumption. Edit: I'm not trying to shame MacOS users. I'm just saying that Linux and MacOS users (Windows users don't use /etc/hosts so out of discussion) have very different behaviour regarding paying for software.

I mean, the creator's personal website exactly looks like the Apple website and he's selling clones of Apple wallpapers, too.

Why are you trying to dismiss this guy? I don't understand it. If you don't like the product or feel that $19 is too much money, then move along. God forbid someone tries to make a living by selling software.

I've personally struggled to test https locally [1], and I'm sure others have too. The next time I have the problem, though, I'll save myself the configuration and spend $19.

[1] https://www.louzell.com/notes/serve_https_on_localhost.html

Re: Show HN: Local development with .local domains and HTTPS

#88

Post by ninju »

Zetice wrote: post #72
raincole wrote: post #27

Earlier quoted context omitted.

When I read this comment I knew it must be targeting MacOS users. The only reason I clicked the link is to confirm my assumption. Edit: I'm not trying to shame MacOS users. I'm just saying that Linux and MacOS users (Windows users don't use /etc/hosts so out of discussion) have very different behaviour regarding paying for software.

There is an /etc/hosts on Windows, just fyi.

Yep...in strange directory

C:\Windows\System32\drivers\etc\hosts

Re: Show HN: Local development with .local domains and HTTPS

#89

Post by WorldMaker »

francislavoie wrote: post #49
throwawaymobule wrote: post #37

Earlier quoted context omitted.

.local is usually setup if you have an mDNS daemon running. I think Ubuntu does this ootb, and if you still have an old windows install, you may have a copy of 'bonjoir' that was bundled with iTunes. You could probably lean on existing software to do most of the work.

I agree that reaching out to systemd-resolved on Linux and Bonjour on Mac/Windows is probably the way to go, but I don't have the time/energy to learn these APIs and test it right now, hence why I'm asking for help! :)

Windows has had built-in mDNS (and DNS-SD) support built-in since Windows 10, I wouldn't recommend using Bonjour on Windows today.

That said, the tricky part to Windows' mDNS support is that the APIs to work with it are WinRT-only and you'll need a WinRT projection of one sort or another to use them.

Re: Show HN: Local development with .local domains and HTTPS

#90

Post by 8organicbits »

lxgr wrote: post #60
moondev wrote: post #55

foo-192-168-1-1.traefik.me bar-192-168-1-1.traefik.me http://traefik.me/fullchain.pem http://traefik.me/privkey.pem

This is neat! However, given that allowing private IP resolution from a public DNS subdomain facilitates DNS rebinding attacks, it (and all equivalent approaches) will unfortunately be blocked by quite a few of the more sophisticated home routers out there, including a quite common brand in Germany. Also, doesn't publishing a privkey for a public TLS certificate theoretically require it to be revoked under common bro…

The certificate is revoked, your browser must not be checking for revocation. Browser support for revocation is pretty poor, unfortunately.

https://crt.sh/?id=9497801989&opt=ocsp

Post reply on HN