Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

.INTERNAL is now reserved for private-use applications

icann.org

Post reply on HN
Print view View original

71–80 of 290 posts

Re: .INTERNAL is now reserved for private-use applications

#71

Post by jeroenhd »

arjvik wrote: post #25
jeroenhd wrote: post #19

Earlier quoted context omitted.

.local is in this weird state where it's _technically_ not reserved, but most PCs in the world already resolve it with special non-DNS software because of the Bonjour/mDNS protocol. So you end up with the IETF standardising .local, because Apple was already using it, but ICANN never did much with that standardisation. I doubt ICANN will actually touch .local, but they could. One could imagine a scheme where .local is…

Modern windows supports mDNS these days!

It does! I generally assume mDNS to just be available on every device these days. But I've also seen managed environments where mDNS has been turned off or blocked at the firewall.

Re: .INTERNAL is now reserved for private-use applications

#72

Post by jeroenhd »

throw0101d wrote: post #50
jeroenhd wrote: post #19

Earlier quoted context omitted.

.local is in this weird state where it's _technically_ not reserved, but most PCs in the world already resolve it with special non-DNS software because of the Bonjour/mDNS protocol. So you end up with the IETF standardising .local, because Apple was already using it, but ICANN never did much with that standardisation. I doubt ICANN will actually touch .local, but they could. One could imagine a scheme where .local is…

> .local is in this weird state where it's _technically_ not reserved […] I doubt ICANN will actually touch .local, but they could. It is. See §2.2.1.2.1, "Reserved Names", of ICANN's gTLD Applicant Guidebook : * https://newgtlds.icann.org/sites/default/files/guidebook-ful...

This document describes the process for requesting gTLDs. Some internal ICANN project could ignore the contents of the guidebook without breaking "the rules". Or they could invent some kind of new TLD system; branded gTLDs didn't exist twenty years ago and I doubt most people would've assumed them to become real, yet blog.google is a real thing that exists.

Re: .INTERNAL is now reserved for private-use applications

#73

Post by jeroenhd »

deathanatos wrote: post #43
jeroenhd wrote: post #15

Earlier quoted context omitted.

If you've got a couple hundred grant laying about, you could probably set up a shell company and acquire .intern through a several-year ccTLD acquisition process. I'd like to think people learned from .dev and such. I doubt any scammer will be able to use it.

I think you're referring to the new gTLD process, which yes, costs a small boatload. Those aren't, and .intern isn't, a ccTLD, nor do I believe there is a means of acquiring a ccTLD (…outside of somehow becoming a country, I guess).

You're right, I meant gTLD. Unfortunately I can't edit my comment anymore.

I think ccTLDs are restricted to two letter codes even if the country of Internia were to be be founded. The only exceptions I can think of are the localized names (.台湾 and 中国 for countries like Taiwan and China) which are technically encoded as .xn--kprw13d and .xn--fiqs8s. Pakistan's پاکستان. is the first ccTLD I've seen that's more than two visual characters when rendered (with the added bonus of being right-to-left to make URL rendering a tad more complex) so for Internia to claim .intern as a ccTLD, they'd probably need a special script.

Re: .INTERNAL is now reserved for private-use applications

#75

Post by jeroenhd »

xvilo wrote: post #37

Any ideas on how you would run SSL/TLS on these set-ups?

An internal certificate authority would probably be the easiest option. Combined with MDM/group policy, you could tell most devices in your network to set up a trust chain of your own. From then on you can automate access by running your own ACME server internally to automatically hand out certificates to local devices.

The automated setup probably isn't very secure, though. Anyone can register any .local name on the network, so spoofing hostnames becomes very easy once you get access to any device on the network. Send a fax with a bad JPEG and suddenly your office printer becomes xvilo.local, and the ACME server has no way to determine that it's not.

That means you probably need to deal with manual certificate generation, manually renewing your certificates every two years (and, if you're like me, forgetting to before they expire).

Re: .INTERNAL is now reserved for private-use applications

#76

Post by nox101 »

ghshephard wrote: post #52
jcrites wrote: post #24

Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? It's nice that this is available, but if I was building a new system today that was internal, I'd use a regular domain name as the root. There are a number of reasons, and one of them is that it's incredibly nice to have the flexibility to make a name visible on the Internet, even if it is c…

Number one reason that comes to mind is you prevent the possibility of information leakage. You can't screw up your split-dns configuration and end up leaking your internal IP space if everything is .internal. It's much the same reason why some very large IPv6 services deploy some protected IPv6 space in RFC4193 FC::/7 space. Of course you have firewalls. And of course you have all sorts of layers of IDS and air-gaps…

What about things like cookies, storage, caching, etc.. If my job has `https://testing.internal` and some company I visit also has `https://testing.internal` ...

Re: .INTERNAL is now reserved for private-use applications

#77

Post by slashdave »

jcrites wrote: post #24

Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? It's nice that this is available, but if I was building a new system today that was internal, I'd use a regular domain name as the root. There are a number of reasons, and one of them is that it's incredibly nice to have the flexibility to make a name visible on the Internet, even if it is c…

> it's helpful to have that flexibility in the future

On the contrary, it is helpful to make this is impossible. Otherwise you invite leaking private info by configuration mistake.

Re: .INTERNAL is now reserved for private-use applications

#78

Post by [deleted] »

jeroenhd wrote: post #23
LordKeren wrote: post #17

Earlier quoted context omitted.

Sorry, what happened with .dev? EDIT: just saw your comment about Google here https://news.ycombinator.com/item?id=41205394

To expand on my comment: Google bought .dev and started selling domains. In truth, developers probably only noticed because Google pre-loaded their .dev TLD into HSTS, which meant that any domain ending in .dev, even if it's a local one or one you own, must communicate over HTTPS if you want a browser to interact with it. As a result, even if you bought steves-laptop.dev for yourself, you still wouldn't be able to ru…

[deleted]

Re: .INTERNAL is now reserved for private-use applications

#79

Post by johannes1234321 »

jcrites wrote: post #24

Are there any good reasons to use a TLD like .internal for private-use applications, rather than just a regular gTLD like .com? It's nice that this is available, but if I was building a new system today that was internal, I'd use a regular domain name as the root. There are a number of reasons, and one of them is that it's incredibly nice to have the flexibility to make a name visible on the Internet, even if it is c…

A big area are consumer devices like WiFi routers. They can advertise the .internal name and probably even get TLS certificates for those names and things may work.

See for instance the trouble with AVM's fritz.box domain, which was used by their routers by default, then .box wasade an TLD and AVM was too late to register it.

Re: .INTERNAL is now reserved for private-use applications

#80

Post by booi »

mschuster91 wrote: post #65
8organicbits wrote: post #46

My biggest frustration with .internal is that it requires a private certificate authority. Lots of organizations struggle to fully set up trust for the private CA on all internal systems. When you add BYOD or contractor systems, it's a mess. Using a publicly valid domain offers a number of benefits, like being able to use a free public CA like Lets Encrypt. Every machine will trust your internal certificates out of t…

> Lots of organizations struggle to fully set up trust for the private CA on all internal systems. Made worse by the fact phone OSes have made it very difficult to install CAs.

And in on some platforms and configurations, impossible.

Same with the .dev domain

Post reply on HN