Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft mishandling example.com

tinyapps.org

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Microsoft mishandling example.com

#11

Post by szszrk »

irusensei wrote: post #5

Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.

My company used .local for EVERYTHING. I took it as normal at the time, until I got into problems with VMWARE products.

Support patiently explained .local is reserved for something else and kindly provided Wikipedia links.

They never responded why they used .local in their docs, trainings, webinars they provided, though :)

Re: Microsoft mishandling example.com

#13

Post by gruez »

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" "https://prod.autodetect.outlook.cloud.microsoft/autodetect/d...":

Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy expectations.

Re: Microsoft mishandling example.com

#15

Post by jsheard »

hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

It's all fun and games until Donuts buys .tmptest for some reason.

Re: Microsoft mishandling example.com

#16

Post by wongarsu »

hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

brb, just filing paperwork to apply for the .tmptest gTLD /s

Re: Microsoft mishandling example.com

#18

Post by Daviey »

Thaxll wrote: post #14

Where does sei.co.jp comes from? Why Microsoft would use that domain in the first place?

I'm willing to bet they were the first user to try and add example.com to their Outlook account, and MS then just assigned it to them without verifying they own the domain.

Re: Microsoft mishandling example.com

#19

Post by irusensei »

szszrk wrote: post #11
irusensei wrote: post #5

Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.

My company used .local for EVERYTHING. I took it as normal at the time, until I got into problems with VMWARE products. Support patiently explained .local is reserved for something else and kindly provided Wikipedia links. They never responded why they used .local in their docs, trainings, webinars they provided, though :)

My impression is that Ballmer IE6 era Microsoft didn't gave a shit about standards.

Re: Microsoft mishandling example.com

#20

Post by lagniappe »

wongarsu wrote: post #16
hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

brb, just filing paperwork to apply for the .tmptest gTLD /s

I suspect you'd download a car.
Post reply on HN