11–20 of 21 posts
Seems like GitHub could solve this by making users verify they own a domain name by adding a value to a txt record rather than just seeing the domain points to github and letting any repo use it.
Don't point a wildcard domain to Github. It's a wildcard and dangerous.
You told your NS to forward any request to GitHub, a platform you don't own. I think this is the expected outcome. It's good you noticed and shared your findings, but to me this "works as intended"
You wildcarded any traffic to github.com and thought, "eh, they probably check" and are wondering who is at fault? It's you. You didn't think through the consequences, and you could learn a bit more about DNS.
I did not expect that Github facilitates other accounts creating scam pages under the domain I own...
Your DNS config 5-7 rows are the culprit. Don't point a wildcard domain to Github. It's a wildcard and dangerous.
edit: apparently CNAME can't be used for TLD+1, only for subdomains, so you have to use a more error prone approach for those.
By the way, even while a custom domain is still pending verification, the GitHub Pages LB will route the request based on the Host header, allowing for the following:
dig +short github.io | head -1
185.199.108.153
curl -H "Host: 42.news.ycombinator.com" 185.199.109.153
hello
Managing DNS through DigitalOcean (although, this should be possible with any DNS service) requires both pointing the nameservers to that service and adding the domain to your account. If you delete the domain from your account, like I had, but forget to update the nameservers with your registrar, anyone else can claim the domain. Theoretically, if you redirect the nameservers first and then add the domain to your account, someone could swipe it from you, I guess. Though it would basically have to be pure luck.
Why is it always slot machines though?
You told your NS to forward any request to GitHub, a platform you don't own. I think this is the expected outcome. It's good you noticed and shared your findings, but to me this "works as intended"
Please don’t scold people on HN. That’s not the style of discussion we’re trying for here. https://news.ycombinator.com/newsguidelines.html
It's like saying "my motorbike was stolen" when you let the key in the ignition for a day in the favelas. What did you expect exactly?
Seems like GitHub could solve this by making users verify they own a domain name by adding a value to a txt record rather than just seeing the domain points to github and letting any repo use it.