Live data from Hacker News

Google DNS at 010.010.010.010

8.8.8.8

61–70 of 132 posts

Re: Google DNS at 010.010.010.010

#61
post #54

This is the first time I've seen a certificate issued to an IP address. Cloudflare does the same thing for 1.1.1.1. X509v3 Subject Alternative Name: DNS:dns.google, DNS:dns.google.com, DNS:*.dns.google.com, DNS:8888.google, DNS:dns64.dns.google, IP Address:8.8.8.8, IP Address:8.8.4.4, IP Address:2001:4860:4860:0:0:0:0:8888, IP Address:2001:4860:4860:0:0:0:0:8844, IP Address:2001:4860:4860:0:0:0:0:6464, IP Address:200…

You can use this for any purpose. These certificates conform to PKIX and are part of the Web PKI if they're issued (as this was) by a trusted CA.

In some ways the actual rules for IP addresses are less strict than for DNS names. Perhaps this will get tightened up. Google Trust Services (the part of Google which issues certificates, as distinct from say, Chrome, which on behalf of Relying Parties has to decide if the certificates are trustworthy) expressed interest in issuing IP address certificates via ACME, ie automatically to anyone who asks. The pushback (including from people in other parts of Google) was considerable, even though what GTS proposed to do was actually more robust than what's technically required for issuance today. But it's nice that they asked (and indeed one argument to allow what they requested is, hey, there was no requirement for them to ask, if somebody had just done this without asking would we have been even more unhappy about that or would we let it slide?)

In practical terms, you likely don't get and don't want certificates with ipAddress SANs in them. You probably don't get them because (unless GTS went ahead subsequently) this is a Special Request item not something your Certbot or acme.sh or whatever can get for you, and you probably don't want them because unless you're a DNS server people expect to type in a name, not a sequence of arcane numbers.

Re: Google DNS at 010.010.010.010

#63
post #20

Earlier quoted context omitted.

Is that a real TLD?

No, it's an IPv4 address. No TLD is allowed to be a series of digits in order to avoid any confusion about this. Whether your URL parser considers that octal IPv4 addresses are a reasonable thing is up to each individual parser. On the whole I'd suggest user-facing software should not permit this because it's pointlessly confusing. Rust took a patch that says if you try to convert (for example) 010.010.010.010 to an…

Yeah, I meant the .google name the IP redirects you to in the browser

Re: Google DNS at 010.010.010.010

#65
post #10

Octal 010 is 8. Dotted quads can apparently be in octal, so that’s just 8.8.8.8 . What are we looking at here that’s new?

Google's server handles the octal case if it's provided directly. Not sure if this is an explicit code path or if the server handles all IP forms. Try this: curl -v -H "Host: 010.010.010.010" https://8.8.8.8 Trying to do the same with other websites doesn't seem to work.

They probably don't even look at the host header. You can set any host header and it works.

Re: Google DNS at 010.010.010.010

#66

Earlier quoted context omitted.

Do you perhaps think that DNS log data could be valuable for Google? As always, when a product is free...

Is it any worse than the harvesting my ISP is likely doing?

Yes. And no, I would not assume that your ISP is doing it.

Re: Google DNS at 010.010.010.010

#67
post #22
post #19

Earlier quoted context omitted.

It's weird that this is just a side-effect of the way strtol works, but there's no way (that I can figure out) to get + or - involved.

It can't only be that, or 127.1 would not work. It is doing some parsing beyond just calling a parseInt on each of them in order to recognize domain names and use name resolution rather than directly putting the bytes in the IP header. That must be why 0x9000000.-16250872 doesn't work (if negative worked, that should also resolve to 8.8.8.8).

All of this weird behavior is generally inet_aton. https://linux.die.net/man/3/inet_aton

Re: Google DNS at 010.010.010.010

#68

another DNS to avoid... using anything but your ISP's DNS decrease privacy... unless you are using a VPN, then the DNS should be from your VPN's ISP

> using anything but your ISP's DNS decrease privacy

Using your ISP's DNS decreases privacy. I assume you mean that because UDP/53 DNS is unencrypted, if you switch to another DNS provider, then both the ISP and the new DNS can see your requests? In which case I present to you DNS over HTTPS

Post reply on HN