Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

.INTERNAL is now reserved for private-use applications

icann.org

Post reply on HN
Print view View original

101–110 of 290 posts

Re: .INTERNAL is now reserved for private-use applications

#101

Post by jacooper »

8organicbits wrote: post #46

My biggest frustration with .internal is that it requires a private certificate authority. Lots of organizations struggle to fully set up trust for the private CA on all internal systems. When you add BYOD or contractor systems, it's a mess. Using a publicly valid domain offers a number of benefits, like being able to use a free public CA like Lets Encrypt. Every machine will trust your internal certificates out of t…

This is why I'm using a FQDN for my home lab, I'm not going to setup a private CA for this, I can just use ACME-dns and get a cert that will work everywhere, for free!

Re: .INTERNAL is now reserved for private-use applications

#102

Post by JonathonW »

akira2501 wrote: post #99
j1elo wrote: post #93

Earlier quoted context omitted.

Try running anything more complicated than a plain and basic web server! See what happens if you attempt to serve something that browsers deem to require a mandatory "Secure Context", so they will reject running it when using HTTP. For example, you won't be able to run internal videocalls (no access to webcams!), or a web page able to scan QR codes. Here's the full list: * https://developer.mozilla.org/en-US/docs/Web…

localhost is a secure context. so.. presumably we're just waiting for .internal to be added to the white list.

Unlikely. Localhost can be a secure context because localhost traffic doesn't leave your local machine; .internal names have no guarantees about where they go (not inconceivable that some particularly "creative" admin might have .internal names that resolve to something on the public internet).

Re: .INTERNAL is now reserved for private-use applications

#103

Post by yarg »

lysace wrote: post #88
yjftsjthsd-h wrote: post #83

Earlier quoted context omitted.

Do you mean to say that your biggest frustration with HTTPS on .internal is that it requires a private certificate authority? Because I'm running plain HTTP to .internal sites and it works fine.

There's some every packet shall be encrypted, even in minimal private VPCs lore going on. I'm blaming PCI-DSS.

Blame leaked documents from the intelligence services.

No one really bothered until it was revealed that organisations like the NSA were exfiltrating unencrypted internal traffic from companies like Google with programs like PRISM.

Re: .INTERNAL is now reserved for private-use applications

#104

Post by prussian »

8organicbits wrote: post #46

My biggest frustration with .internal is that it requires a private certificate authority. Lots of organizations struggle to fully set up trust for the private CA on all internal systems. When you add BYOD or contractor systems, it's a mess. Using a publicly valid domain offers a number of benefits, like being able to use a free public CA like Lets Encrypt. Every machine will trust your internal certificates out of t…

Just be mindful that any certs you issue in this way will be public information[1] so make sure the domain names don't give away any interesting facts about your infrastructure or future product ideas. I did this at my last job as well and I can still see them renewing them, including an unfortunate wildcard cert which wasn't me.

[1] https://crt.sh/

Re: .INTERNAL is now reserved for private-use applications

#105

Post by otabdeveloper4 »

kortilla wrote: post #96
lysace wrote: post #88

Earlier quoted context omitted.

There's some every packet shall be encrypted, even in minimal private VPCs lore going on. I'm blaming PCI-DSS.

Hoping datacenter to datacenter links are secure is how the NSA popped Google. Turn on crypto, don’t be lazy

Pretty sure state-level actors sniffing datacenter traffic is literally the very last of your security issues.

This kind of theater actively harms your organization's security, not helps it. Do people not do risk analysis anymore?

Re: .INTERNAL is now reserved for private-use applications

#107

Post by zrm »

bawolff wrote: post #45
jcrites wrote: post #24

Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? It's nice that this is available, but if I was building a new system today that was internal, I'd use a regular domain name as the root. There are a number of reasons, and one of them is that it's incredibly nice to have the flexibility to make a name visible on the Internet, even if it is c…

I think there is a benefit that it reduces possibility of misconfiguration. You can't accidentally publish .internal. If you see a .internal name, there is never any possibility of confusion on that point.

> You can't accidentally publish .internal.

Well sure you can. You expose your internal DNS servers to the internet, or use the same DNS servers for both and they're on the internet. The root servers are not going to delegate a request for .internal to your nameservers, but anybody can make the request directly to your servers if they're publicly accessible.

Re: .INTERNAL is now reserved for private-use applications

#108

Post by zrm »

justin_oaks wrote: post #81
quectophoton wrote: post #44

Earlier quoted context omitted.

> Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? That assumes you are able to pay to rent a domain name, and keep paying for it, and that you are reasonably sure that the company you're renting it from is not going to take it away from you because of a selectively-enforced TOS, and that you are reasonably sure that both yourself and your…

If you control the DNS resolution in your company and use an internal certificate authority, technically you don't have to rent a domain name. You can control how it resolves and "hijack" whatever domain name you want. It won't be valid outside your organization/network, but if you're using it only for internal purposes then that doesn't matter. Of course, this is a bad idea, but it does allow you to avoid the "rent"…

One of the reasons that it's a bad idea is that whoever does have the domain can get a certificate for any name under it from any public CA, which your devices would generally still trust in addition to your private CA.

Re: .INTERNAL is now reserved for private-use applications

#109

Post by flemhans »

throwaway290 wrote: post #95
Filligree wrote: post #74

I’m going to go right on using .lan.

.la and .land are already valid domains so don't make a typo. And I guess .lan can be sold eventually if it turns out it's a word somewhere.

They already got .cat, so why not the ending as well.

Re: .INTERNAL is now reserved for private-use applications

#110

Post by shawnz »

otabdeveloper4 wrote: post #105
kortilla wrote: post #96

Earlier quoted context omitted.

Hoping datacenter to datacenter links are secure is how the NSA popped Google. Turn on crypto, don’t be lazy

Pretty sure state-level actors sniffing datacenter traffic is literally the very last of your security issues. This kind of theater actively harms your organization's security, not helps it. Do people not do risk analysis anymore?

Taking defense in depth measures like using https on the local network is "theatre" that "actively harms your organization's security"? That seems like an extreme opinion to me.

Picking some reasonable best practices like using https everywhere for the sake of maintaining a good security posture doesn't mean that you're "not doing risk analysis".

Post reply on HN