41–50 of 68 posts
Earlier quoted context omitted.
Let me introduce you to neverssl.com!
There are a number of those. I use http://detectportal.firefox.com/
Neat tools as until I learned of the existence of these ssl-less sites to prompt captive portals I use to try to connect to various sites until it showed up.
Earlier quoted context omitted.
Let me introduce you to neverssl.com!
The difference being, example.com is run by IANA [0] and guaranteed by them, whereas neverssl is just a kind-hearted soul, and may one day resolve to something else. [0] https://www.iana.org/domains/reserved
Sure, it might go away one day. Until it does, it’s the best solution to this problem.
This is a great reminder that when working with test data for stuff like email delivery, always use example.com (or a few other similar TLDs) and not stuff like "test.com" or "acme.com" or "dummyuser.com". I see this all the time by devs and they don't understand the risk and why example.com was put into the standards.
I have a .com domain with 'test' in the name. I was mildly DNS spammed because Microsoft admins would create that thing with test in the name. I'd get 10-20 DNS packets a day. I moved it to an external DNS provider just to give my logs a break.
This is a great reminder that when working with test data for stuff like email delivery, always use example.com (or a few other similar TLDs) and not stuff like "test.com" or "acme.com" or "dummyuser.com". I see this all the time by devs and they don't understand the risk and why example.com was put into the standards.
It'll never resolve to anything, and makes it really obvious the code is for testing or sample code.
This is a great reminder that when working with test data for stuff like email delivery, always use example.com (or a few other similar TLDs) and not stuff like "test.com" or "acme.com" or "dummyuser.com". I see this all the time by devs and they don't understand the risk and why example.com was put into the standards.
I always use `myco.example` for testing requests and emails, as well as documentation. https://en.wikipedia.org/wiki/.example It'll never resolve to anything, and makes it really obvious the code is for testing or sample code.
Earlier quoted context omitted.
Only somewhat. > 2. Application software SHOULD NOT recognize example names as special and SHOULD use example names as they would other domain names. > 3. Name resolution APIs and libraries SHOULD NOT recognize example names as special and SHOULD NOT treat them differently. Name resolution APIs SHOULD send queries for example names to their configured caching DNS server(s). > 6. DNS server operators SHOULD be aware t…
> You are guaranteed to be able to try and resolve the domain, which should generally be enough for the crappy man-in-the-middle systems to work. I have never seen any captive portal work at DNS level though (and that by itself sounds problematic). They works at HTTP level. So if one day example.com start using HSTS then it will also be a problem, in addition to nowadays browser defaulting to HTTPS so you have to typ…
Those were pretty problematic, for all the reasons you're thinking... Better to use a hostname you're not hoping to actually use.
The advantage of example.com is that its still served over HTTP, which is very helpful if you are trying to force a redirect for wifi login or 'out of quota' on a phone plan.
1. Examples
https://security.stackexchange.com/questions/149852/how-legi...
https://zapier.com/blog/open-wifi-login-page/
http://www.my80211.com/home/2012/7/23/web-auth-redirect-does...
IANA also reserves TLDs like '.test' and '.example' as well as some IDN equivalents. https://www.rfc-editor.org/rfc/rfc2606.html https://www.iana.org/domains/reserved
The advantage of example.com is that its still served over HTTP, which is very helpful if you are trying to force a redirect for wifi login or 'out of quota' on a phone plan.
Why is it that popular browsers do not allow users to manually disable the behaviour that necessitates this apparently common workaround.^1 Is this another example of "tech" company paternalism. 1. Examples https://security.stackexchange.com/questions/149852/how-legi... https://zapier.com/blog/open-wifi-login-page/ http://www.my80211.com/home/2012/7/23/web-auth-redirect-does...
Probably the number of people that care about overriding this behavior could be counted on one hand.
> Is this another example of "tech" company paternalism.
No.
Earlier quoted context omitted.
I always use `myco.example` for testing requests and emails, as well as documentation. https://en.wikipedia.org/wiki/.example It'll never resolve to anything, and makes it really obvious the code is for testing or sample code.
No guarantee an .example TLD won't be created