Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

.INTERNAL is now reserved for private-use applications

icann.org

Post reply on HN
Print view View original

171–180 of 290 posts

Re: .INTERNAL is now reserved for private-use applications

#171

Post by Arch-TK »

thaumasiotes wrote: post #149
wkat4242 wrote: post #98

Earlier quoted context omitted.

The problem with internal CAs is also that it's really hard to add them on some OSes now. Especially on android since version 7 IIRC, you can no longer get certs into the system store, and every app is free to ignore the user store (I think it was even the default to ignore it). So a lot of apps will not work with it.

> The problem with internal CAs is also that it's really hard to add them on some OSes now. Especially on android since version 7 IIRC That's because the purpose of certificate pinning is to protect software from the user. Letting you supply your own certificates would defeat the purpose of having them.

Certificate pinning and restricting adding custom certificates to your OS except if you're using MDM are two completely unrelated things. Overriding system trust doesn't affect certificate pinning and certificate pinning is no longer recommended anyway.

Re: .INTERNAL is now reserved for private-use applications

#172

Post by cowsup »

TheRealPomax wrote: post #61
dawnerd wrote: post #60

I'm still peeved they let google take over .dev when they knew tons of us used that in the older days for dev environments.

to be fair, ".dev" is not a full word, unlike INTERNAL or EXAMPLE. You're free to petition them to reserve .DEVELOPMENT, though, of course.

.com is not a full word either (company), or .org (organization), .net (internet), .gov (government), ...

Re: .INTERNAL is now reserved for private-use applications

#173

Post by 8organicbits »

kevincox wrote: post #167
eru wrote: post #163

Earlier quoted context omitted.

Can't you have a limited wildcard? Something like *.for-testing-only.company.com?

Yes, but then you are putting more information into the publically logged certificate. So it is a tradeoff between scope of certificate and data leak. I guess you can use a pattern like {human name}.{random}.internal but then you lose memoribility.

I've considered building tools to manage decoy certificates, like it would register mail.example.com if you didn't have a mail server, but I couldn't justify polluting the cert transparency logs.

Re: .INTERNAL is now reserved for private-use applications

#174

Post by baq »

yarg wrote: post #103
lysace wrote: post #88

Earlier quoted context omitted.

There's some every packet shall be encrypted, even in minimal private VPCs lore going on. I'm blaming PCI-DSS.

Blame leaked documents from the intelligence services. No one really bothered until it was revealed that organisations like the NSA were exfiltrating unencrypted internal traffic from companies like Google with programs like PRISM.

Echelon was known about before Google was even a thing. I remember people adding Usenet headers with certain keywords. Wasn’t much, but it was honest work.

Re: .INTERNAL is now reserved for private-use applications

#175

Post by lacerrr »

kevincox wrote: post #167
eru wrote: post #163

Earlier quoted context omitted.

Can't you have a limited wildcard? Something like *.for-testing-only.company.com?

Yes, but then you are putting more information into the publically logged certificate. So it is a tradeoff between scope of certificate and data leak. I guess you can use a pattern like {human name}.{random}.internal but then you lose memoribility.

Made up problem, that approach is fine.

Re: .INTERNAL is now reserved for private-use applications

#176

Post by hsbauauvhabzb »

0l wrote: post #158
hsbauauvhabzb wrote: post #129

Earlier quoted context omitted.

So we’re back to trusting the user?

Use HSTS, browsers are specifically designed not to let users bypass these.

Hsts forces encryption, it has no impact on certificate invalidity, at least to my knowledge.

Re: .INTERNAL is now reserved for private-use applications

#177

Post by OJFord »

justin_oaks wrote: post #81
quectophoton wrote: post #44

Earlier quoted context omitted.

> Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? That assumes you are able to pay to rent a domain name, and keep paying for it, and that you are reasonably sure that the company you're renting it from is not going to take it away from you because of a selectively-enforced TOS, and that you are reasonably sure that both yourself and your…

If you control the DNS resolution in your company and use an internal certificate authority, technically you don't have to rent a domain name. You can control how it resolves and "hijack" whatever domain name you want. It won't be valid outside your organization/network, but if you're using it only for internal purposes then that doesn't matter. Of course, this is a bad idea, but it does allow you to avoid the "rent"…

But then you still need a private CA (public one is going to resolve the domain correctly and find you don't control it) so you may as well have used .internal?

Re: .INTERNAL is now reserved for private-use applications

#178

Post by TeMPOraL »

okanat wrote: post #169
thaumasiotes wrote: post #149

Earlier quoted context omitted.

> The problem with internal CAs is also that it's really hard to add them on some OSes now. Especially on android since version 7 IIRC That's because the purpose of certificate pinning is to protect software from the user. Letting you supply your own certificates would defeat the purpose of having them.

Protect the software from the user? Why are you giving them the software then?

Most software is tools of control and exploitation, and remains in an adversarial relationship with its users. You give software to users to make them make money for you; you protect the software from users so they don't cut you out, or use software to do something you'd rather they don't do.

Software that isn't like that is in a minority, and most of it is only used to build software that is like that.

Re: .INTERNAL is now reserved for private-use applications

#180

Post by TimTheTinker »

otabdeveloper4 wrote: post #105
kortilla wrote: post #96

Earlier quoted context omitted.

Hoping datacenter to datacenter links are secure is how the NSA popped Google. Turn on crypto, don’t be lazy

Pretty sure state-level actors sniffing datacenter traffic is literally the very last of your security issues. This kind of theater actively harms your organization's security, not helps it. Do people not do risk analysis anymore?

Found the NSA goon.

Seriously, your statement is demonstrably wrong. That's exactly the sort of traffic the NSA actively seeks to exploit.

Post reply on HN