Live data from Hacker News

So You Want to Define a Well-Known URI

mnot.net

11–20 of 105 posts

Re: So You Want to Define a Well-Known URI

#11
No, in fact I don't. But this post wouldn't be of any help anyway. It feels like it's about nothing, there is no substance, just stating some obvious facts. Without examples that lead to some real recommendations, this whole expertise claimed by the author is of no use.

Re: So You Want to Define a Well-Known URI

#12
post #9

How well-known are those URIs though? :-\

There's an interesting list on Wikipedia: https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-kn...

Not one of them links to the actual well-known resource, only pdf specifications. And several I picked randomly leads to dead ends.

Here's one I could find: https://accounts.google.com/.well-known/openid-configuration

But how does one even find this?

Re: So You Want to Define a Well-Known URI

#13
post #3

I wish people would follow this, instead of coming up with new standards in the root namespace. "llms.txt" [1] comes to mind, for example. Let's stop polluting the root of a domain! [1] https://llmstxt.org/

LLMs.txt is also nonsense since it isn't adopted by any of the major AI players.

Re: So You Want to Define a Well-Known URI

#14
post #8

Why are they so specific? Why password-reset instead of a more generic link tree? Why discord domain verification instead of domain-verifications with a dynamic list on entries? Seems like a waste of time. I would just define my own spec outside of well known for my use case.

> Why discord domain verification instead of domain-verifications with a dynamic list on entries? The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else. Example: ;; ANSWER SECTION: ycombinator.com. 300 IN TX…

"Domain-verifications" is an invitation for everyone else that might need it to use the same standard and convention. "Discord-domain-verification" is not, it's what feels like polluting the global namespace with the company name that might cease to exist in a few years.

At the very least, it should be "domain-verification-discord", "-google" and so on. Maybe even "-com.discord", "-com.google"? And the first part clearly standardized and registered, instead of one entity using "domain" and another one "site".

Re: So You Want to Define a Well-Known URI

#15
post #6

How well-known are those URIs though? :-\

I agree. I was hoping for a few positive examples, but didn't see any. The only one I know of is the OIDC discovery endpoint.

I would say acme-challenge is one of the most used ones. How else would one get SSL certificates today

Re: So You Want to Define a Well-Known URI

#16
post #9

Earlier quoted context omitted.

There's an interesting list on Wikipedia: https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-kn...

Not one of them links to the actual well-known resource, only pdf specifications. And several I picked randomly leads to dead ends. Here's one I could find: https://accounts.google.com/.well-known/openid-configuration But how does one even find this?

well-known is for programmatic access, it either namespaces something you’re told to look for (e.g. various types of domain markers) or it lets you discover a feature / endpoint.

In the latter case you just probe, for instance if you’re a password manager and you have a password for site A you hit A/.well-known/change-password and if they returns something you can surface a change password link to your user.

The one you found is for OIDC provider discovery (https://openid.net/specs/openid-connect-discovery-1_0.html#P...) so someone tells you they want to log in via Google, you hit that endpoint, and it lets you setup Google as an oidc provider rather without needing to hard-code providers. Even if you just want to support Google as a provider, you hit that and you get the entire configuration rather than have to hunt down the same information in the docs.

Re: So You Want to Define a Well-Known URI

#17
post #8

Why are they so specific? Why password-reset instead of a more generic link tree? Why discord domain verification instead of domain-verifications with a dynamic list on entries? Seems like a waste of time. I would just define my own spec outside of well known for my use case.

> Why discord domain verification instead of domain-verifications with a dynamic list on entries? The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else. Example: ;; ANSWER SECTION: ycombinator.com. 300 IN TX…

[deleted]

Re: So You Want to Define a Well-Known URI

#18
post #8

Earlier quoted context omitted.

> Why discord domain verification instead of domain-verifications with a dynamic list on entries? The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else. Example: ;; ANSWER SECTION: ycombinator.com. 300 IN TX…

"Domain-verifications" is an invitation for everyone else that might need it to use the same standard and convention. "Discord-domain-verification" is not, it's what feels like polluting the global namespace with the company name that might cease to exist in a few years. At the very least, it should be "domain-verification-discord", "-google" and so on. Maybe even "-com.discord", "-com.google"? And the first part cle…

Why?

Re: So You Want to Define a Well-Known URI

#19

Why are they so specific? Why password-reset instead of a more generic link tree? Why discord domain verification instead of domain-verifications with a dynamic list on entries? Seems like a waste of time. I would just define my own spec outside of well known for my use case.

> discord domain verification

That’s on Discord. They’re not in the registry: https://www.iana.org/assignments/well-known-uris/well-known-...

> Why password-reset instead of a more generic link tree?

[edit: answered in more detail in a sibling thread https://news.ycombinator.com/item?id=48596286]

Post reply on HN